diff --git a/.ci/Jenkinsfile_baseline_capture b/.ci/Jenkinsfile_baseline_capture
index b729f5d9da082d..d074da1cb1926c 100644
--- a/.ci/Jenkinsfile_baseline_capture
+++ b/.ci/Jenkinsfile_baseline_capture
@@ -23,6 +23,7 @@ kibanaPipeline(timeoutMinutes: 210) {
             ) {
               withGcpServiceAccount.fromVaultSecret('secret/kibana-issues/dev/ci-artifacts-key', 'value') {
                 withEnv([
+                  'BUILD_TS_REFS_DISABLE=false', // disabled in root config so we need to override that here
                   'BUILD_TS_REFS_CACHE_ENABLE=true',
                   'BUILD_TS_REFS_CACHE_CAPTURE=true',
                   'DISABLE_BOOTSTRAP_VALIDATION=true',
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 0692e94e8b0283..cae64a24ec2cd5 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -272,7 +272,7 @@
 /x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/ @elastic/kibana-alerting-services
 /x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/ @elastic/kibana-alerting-services
 /docs/user/alerting/ @elastic/kibana-alerting-services
-/docs/management/alerting/ @elastic/kibana-alerting-services
+/docs/management/connectors/ @elastic/kibana-alerting-services
 #CC# /x-pack/plugins/stack_alerts @elastic/kibana-alerting-services
 
 # Enterprise Search
diff --git a/config/kibana.yml b/config/kibana.yml
index 7c7378fb5d29d2..eefb6bb8bacdab 100644
--- a/config/kibana.yml
+++ b/config/kibana.yml
@@ -23,7 +23,7 @@
 #server.publicBaseUrl: ""
 
 # The maximum payload size in bytes for incoming server requests.
-#server.maxPayloadBytes: 1048576
+#server.maxPayload: 1048576
 
 # The Kibana server's name.  This is used for display purposes.
 #server.name: "your-hostname"
diff --git a/docs/developer/getting-started/index.asciidoc b/docs/developer/getting-started/index.asciidoc
index d5fe7ebf470382..bc191fa828b58f 100644
--- a/docs/developer/getting-started/index.asciidoc
+++ b/docs/developer/getting-started/index.asciidoc
@@ -3,6 +3,18 @@
 
 Get started building your own plugins, or contributing directly to the {kib} repo.
 
+[discrete]
+[[developing-on-windows]]
+=== Developing on Windows
+
+In order to support Windows development we currently require you to use one of the following:
+
+- https://git-scm.com/download/win[Git bash] (other bash emulators like https://cmder.net/[Cmder] could work but we did not test them)
+- https://docs.microsoft.com/en-us/windows/wsl/about[WSL]
+
+Before running the steps listed below, please make sure you have installed Git bash or WSL and that 
+you are running the mentioned commands through one of them.
+
 [discrete]
 [[get-kibana-code]]
 === Get the code
diff --git a/docs/developer/getting-started/monorepo-packages.asciidoc b/docs/developer/getting-started/monorepo-packages.asciidoc
index bc47e46f6763b4..9564087dabefee 100644
--- a/docs/developer/getting-started/monorepo-packages.asciidoc
+++ b/docs/developer/getting-started/monorepo-packages.asciidoc
@@ -63,6 +63,7 @@ yarn kbn watch-bazel
 
 - @elastic/datemath
 - @kbn/apm-utils
+- @kbn/babel-preset
 - @kbn/config-schema
 - @kbn/tinymath
 - @kbn/utility-types
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index 2a88d65cb9bd05..64a62e36567848 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -448,8 +448,8 @@ the infrastructure monitoring use-case within Kibana.
 |Visualization editor allowing to quickly and easily configure compelling visualizations to use on dashboards and canvas workpads.
 
 
-|{kib-repo}blob/{branch}/x-pack/plugins/license_api_guard[licenseApiGuard]
-|WARNING: Missing README.
+|{kib-repo}blob/{branch}/x-pack/plugins/license_api_guard/README.md[licenseApiGuard]
+|This plugin is used by ES UI plugins to reject API requests when the plugin is unsupported by the user's license.
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/license_management/README.md[licenseManagement]
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
index 535bd8f11236df..3a383ee72b86a6 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
@@ -8,6 +8,9 @@
 
 ```typescript
 readonly links: {
+        readonly canvas: {
+            readonly guide: string;
+        };
         readonly dashboard: {
             readonly guide: string;
             readonly drilldowns: string;
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
index b8d0d2288993ec..c5bf4babd9da95 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
@@ -17,5 +17,5 @@ export interface DocLinksStart
 |  --- | --- | --- |
 |  [DOC\_LINK\_VERSION](./kibana-plugin-core-public.doclinksstart.doc_link_version.md) | <code>string</code> |  |
 |  [ELASTIC\_WEBSITE\_URL](./kibana-plugin-core-public.doclinksstart.elastic_website_url.md) | <code>string</code> |  |
-|  [links](./kibana-plugin-core-public.doclinksstart.links.md) | <code>{</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly drilldowns: string;</code><br/><code>            readonly drilldownsTriggerPicker: string;</code><br/><code>            readonly urlDrilldownTemplateSyntax: string;</code><br/><code>            readonly urlDrilldownVariables: string;</code><br/><code>        };</code><br/><code>        readonly discover: Record&lt;string, string&gt;;</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly elasticsearchModule: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly configure: string;</code><br/><code>            readonly httpEndpoint: string;</code><br/><code>            readonly install: string;</code><br/><code>            readonly start: string;</code><br/><code>        };</code><br/><code>        readonly enterpriseSearch: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly appSearchBase: string;</code><br/><code>            readonly workplaceSearchBase: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly composite: string;</code><br/><code>            readonly composite_missing_bucket: string;</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly date_format_pattern: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly runtimeFields: {</code><br/><code>            readonly overview: string;</code><br/><code>            readonly mapping: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessLangSpec: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly painlessWalkthrough: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly introduction: string;</code><br/><code>            readonly fieldFormattersNumber: string;</code><br/><code>            readonly fieldFormattersString: string;</code><br/><code>        };</code><br/><code>        readonly addData: string;</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly upgradeAssistant: string;</code><br/><code>        readonly elasticsearch: Record&lt;string, string&gt;;</code><br/><code>        readonly siem: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly eql: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly percolate: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>            readonly dateMathIndexNames: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>        readonly ml: Record&lt;string, string&gt;;</code><br/><code>        readonly transforms: Record&lt;string, string&gt;;</code><br/><code>        readonly visualize: Record&lt;string, string&gt;;</code><br/><code>        readonly apis: Readonly&lt;{</code><br/><code>            bulkIndexAlias: string;</code><br/><code>            createIndex: string;</code><br/><code>            createSnapshotLifecyclePolicy: string;</code><br/><code>            createRoleMapping: string;</code><br/><code>            createRoleMappingTemplates: string;</code><br/><code>            createApiKey: string;</code><br/><code>            createPipeline: string;</code><br/><code>            createTransformRequest: string;</code><br/><code>            cronExpressions: string;</code><br/><code>            executeWatchActionModes: string;</code><br/><code>            indexExists: string;</code><br/><code>            openIndex: string;</code><br/><code>            putComponentTemplate: string;</code><br/><code>            painlessExecute: string;</code><br/><code>            painlessExecuteAPIContexts: string;</code><br/><code>            putComponentTemplateMetadata: string;</code><br/><code>            putSnapshotLifecyclePolicy: string;</code><br/><code>            putIndexTemplateV1: string;</code><br/><code>            putWatch: string;</code><br/><code>            simulatePipeline: string;</code><br/><code>            updateTransform: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly observability: Record&lt;string, string&gt;;</code><br/><code>        readonly alerting: Record&lt;string, string&gt;;</code><br/><code>        readonly maps: Record&lt;string, string&gt;;</code><br/><code>        readonly monitoring: Record&lt;string, string&gt;;</code><br/><code>        readonly security: Readonly&lt;{</code><br/><code>            apiKeyServiceSettings: string;</code><br/><code>            clusterPrivileges: string;</code><br/><code>            elasticsearchSettings: string;</code><br/><code>            elasticsearchEnableSecurity: string;</code><br/><code>            indicesPrivileges: string;</code><br/><code>            kibanaTLS: string;</code><br/><code>            kibanaPrivileges: string;</code><br/><code>            mappingRoles: string;</code><br/><code>            mappingRolesFieldRules: string;</code><br/><code>            runAsPrivilege: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly watcher: Record&lt;string, string&gt;;</code><br/><code>        readonly ccs: Record&lt;string, string&gt;;</code><br/><code>        readonly plugins: Record&lt;string, string&gt;;</code><br/><code>        readonly snapshotRestore: Record&lt;string, string&gt;;</code><br/><code>        readonly ingest: Record&lt;string, string&gt;;</code><br/><code>    }</code> |  |
+|  [links](./kibana-plugin-core-public.doclinksstart.links.md) | <code>{</code><br/><code>        readonly canvas: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly drilldowns: string;</code><br/><code>            readonly drilldownsTriggerPicker: string;</code><br/><code>            readonly urlDrilldownTemplateSyntax: string;</code><br/><code>            readonly urlDrilldownVariables: string;</code><br/><code>        };</code><br/><code>        readonly discover: Record&lt;string, string&gt;;</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly elasticsearchModule: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly configure: string;</code><br/><code>            readonly httpEndpoint: string;</code><br/><code>            readonly install: string;</code><br/><code>            readonly start: string;</code><br/><code>        };</code><br/><code>        readonly enterpriseSearch: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly appSearchBase: string;</code><br/><code>            readonly workplaceSearchBase: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly composite: string;</code><br/><code>            readonly composite_missing_bucket: string;</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly date_format_pattern: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly runtimeFields: {</code><br/><code>            readonly overview: string;</code><br/><code>            readonly mapping: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessLangSpec: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly painlessWalkthrough: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly introduction: string;</code><br/><code>            readonly fieldFormattersNumber: string;</code><br/><code>            readonly fieldFormattersString: string;</code><br/><code>        };</code><br/><code>        readonly addData: string;</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly upgradeAssistant: string;</code><br/><code>        readonly elasticsearch: Record&lt;string, string&gt;;</code><br/><code>        readonly siem: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly eql: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly percolate: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>            readonly dateMathIndexNames: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>        readonly ml: Record&lt;string, string&gt;;</code><br/><code>        readonly transforms: Record&lt;string, string&gt;;</code><br/><code>        readonly visualize: Record&lt;string, string&gt;;</code><br/><code>        readonly apis: Readonly&lt;{</code><br/><code>            bulkIndexAlias: string;</code><br/><code>            createIndex: string;</code><br/><code>            createSnapshotLifecyclePolicy: string;</code><br/><code>            createRoleMapping: string;</code><br/><code>            createRoleMappingTemplates: string;</code><br/><code>            createApiKey: string;</code><br/><code>            createPipeline: string;</code><br/><code>            createTransformRequest: string;</code><br/><code>            cronExpressions: string;</code><br/><code>            executeWatchActionModes: string;</code><br/><code>            indexExists: string;</code><br/><code>            openIndex: string;</code><br/><code>            putComponentTemplate: string;</code><br/><code>            painlessExecute: string;</code><br/><code>            painlessExecuteAPIContexts: string;</code><br/><code>            putComponentTemplateMetadata: string;</code><br/><code>            putSnapshotLifecyclePolicy: string;</code><br/><code>            putIndexTemplateV1: string;</code><br/><code>            putWatch: string;</code><br/><code>            simulatePipeline: string;</code><br/><code>            updateTransform: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly observability: Record&lt;string, string&gt;;</code><br/><code>        readonly alerting: Record&lt;string, string&gt;;</code><br/><code>        readonly maps: Record&lt;string, string&gt;;</code><br/><code>        readonly monitoring: Record&lt;string, string&gt;;</code><br/><code>        readonly security: Readonly&lt;{</code><br/><code>            apiKeyServiceSettings: string;</code><br/><code>            clusterPrivileges: string;</code><br/><code>            elasticsearchSettings: string;</code><br/><code>            elasticsearchEnableSecurity: string;</code><br/><code>            indicesPrivileges: string;</code><br/><code>            kibanaTLS: string;</code><br/><code>            kibanaPrivileges: string;</code><br/><code>            mappingRoles: string;</code><br/><code>            mappingRolesFieldRules: string;</code><br/><code>            runAsPrivilege: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly watcher: Record&lt;string, string&gt;;</code><br/><code>        readonly ccs: Record&lt;string, string&gt;;</code><br/><code>        readonly plugins: Record&lt;string, string&gt;;</code><br/><code>        readonly snapshotRestore: Record&lt;string, string&gt;;</code><br/><code>        readonly ingest: Record&lt;string, string&gt;;</code><br/><code>    }</code> |  |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.openinnewtab.md b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.openinnewtab.md
new file mode 100644
index 00000000000000..4609fa68b38246
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.navigatetoappoptions.openinnewtab.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [NavigateToAppOptions](./kibana-plugin-core-public.navigatetoappoptions.md) &gt; [openInNewTab](./kibana-plugin-core-public.navigatetoappoptions.openinnewtab.md)
+
+## NavigateToAppOptions.openInNewTab property
+
+if true, will open the app in new tab, will share session information via window.open if base
+
+<b>Signature:</b>
+
+```typescript
+openInNewTab?: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.cspconfig.disableembedding.md b/docs/development/core/server/kibana-plugin-core-server.cspconfig.disableembedding.md
new file mode 100644
index 00000000000000..bbd7c42c302d1a
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.cspconfig.disableembedding.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [CspConfig](./kibana-plugin-core-server.cspconfig.md) &gt; [disableEmbedding](./kibana-plugin-core-server.cspconfig.disableembedding.md)
+
+## CspConfig.disableEmbedding property
+
+<b>Signature:</b>
+
+```typescript
+readonly disableEmbedding: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.cspconfig.md b/docs/development/core/server/kibana-plugin-core-server.cspconfig.md
index 6ff807929e6fba..9f4f3211ea2b1c 100644
--- a/docs/development/core/server/kibana-plugin-core-server.cspconfig.md
+++ b/docs/development/core/server/kibana-plugin-core-server.cspconfig.md
@@ -21,6 +21,7 @@ The constructor for this class is marked as internal. Third-party code should no
 |  Property | Modifiers | Type | Description |
 |  --- | --- | --- | --- |
 |  [DEFAULT](./kibana-plugin-core-server.cspconfig.default.md) | <code>static</code> | <code>CspConfig</code> |  |
+|  [disableEmbedding](./kibana-plugin-core-server.cspconfig.disableembedding.md) |  | <code>boolean</code> |  |
 |  [header](./kibana-plugin-core-server.cspconfig.header.md) |  | <code>string</code> |  |
 |  [rules](./kibana-plugin-core-server.cspconfig.rules.md) |  | <code>string[]</code> |  |
 |  [strict](./kibana-plugin-core-server.cspconfig.strict.md) |  | <code>boolean</code> |  |
diff --git a/docs/development/core/server/kibana-plugin-core-server.icspconfig.disableembedding.md b/docs/development/core/server/kibana-plugin-core-server.icspconfig.disableembedding.md
new file mode 100644
index 00000000000000..2cfd680459fbc9
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.icspconfig.disableembedding.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [ICspConfig](./kibana-plugin-core-server.icspconfig.md) &gt; [disableEmbedding](./kibana-plugin-core-server.icspconfig.disableembedding.md)
+
+## ICspConfig.disableEmbedding property
+
+Whether or not embedding (using iframes) should be allowed by the CSP. If embedding is disabled \*and\* no custom rules have been defined, a restrictive 'frame-ancestors' rule will be added to the default CSP rules.
+
+<b>Signature:</b>
+
+```typescript
+readonly disableEmbedding: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.icspconfig.md b/docs/development/core/server/kibana-plugin-core-server.icspconfig.md
index bf04b760a0636d..ee49950df076cc 100644
--- a/docs/development/core/server/kibana-plugin-core-server.icspconfig.md
+++ b/docs/development/core/server/kibana-plugin-core-server.icspconfig.md
@@ -16,6 +16,7 @@ export interface ICspConfig
 
 |  Property | Type | Description |
 |  --- | --- | --- |
+|  [disableEmbedding](./kibana-plugin-core-server.icspconfig.disableembedding.md) | <code>boolean</code> | Whether or not embedding (using iframes) should be allowed by the CSP. If embedding is disabled \*and\* no custom rules have been defined, a restrictive 'frame-ancestors' rule will be added to the default CSP rules. |
 |  [header](./kibana-plugin-core-server.icspconfig.header.md) | <code>string</code> | The CSP rules in a formatted directives string for use in a <code>Content-Security-Policy</code> header. |
 |  [rules](./kibana-plugin-core-server.icspconfig.rules.md) | <code>string[]</code> | The CSP rules used for Kibana. |
 |  [strict](./kibana-plugin-core-server.icspconfig.strict.md) | <code>boolean</code> | Specify whether browsers that do not support CSP should be able to use Kibana. Use <code>true</code> to block and <code>false</code> to allow. |
diff --git a/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.maxbytes.md b/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.maxbytes.md
index 474f7092b1b39d..4d2641255adb4e 100644
--- a/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.maxbytes.md
+++ b/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.maxbytes.md
@@ -6,7 +6,7 @@
 
 Limits the size of incoming payloads to the specified byte count. Allowing very large payloads may cause the server to run out of memory.
 
-Default value: The one set in the kibana.yml config file under the parameter `server.maxPayloadBytes`<!-- -->.
+Default value: The one set in the kibana.yml config file under the parameter `server.maxPayload`<!-- -->.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.md b/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.md
index 330935e42026a3..d27c67891161a3 100644
--- a/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.md
+++ b/docs/development/core/server/kibana-plugin-core-server.routeconfigoptionsbody.md
@@ -17,7 +17,7 @@ export interface RouteConfigOptionsBody
 |  Property | Type | Description |
 |  --- | --- | --- |
 |  [accepts](./kibana-plugin-core-server.routeconfigoptionsbody.accepts.md) | <code>RouteContentType &#124; RouteContentType[] &#124; string &#124; string[]</code> | A string or an array of strings with the allowed mime types for the endpoint. Use this settings to limit the set of allowed mime types. Note that allowing additional mime types not listed above will not enable them to be parsed, and if parse is true, the request will result in an error response.<!-- -->Default value: allows parsing of the following mime types: \* application/json \* application/\*+json \* application/octet-stream \* application/x-www-form-urlencoded \* multipart/form-data \* text/\* |
-|  [maxBytes](./kibana-plugin-core-server.routeconfigoptionsbody.maxbytes.md) | <code>number</code> | Limits the size of incoming payloads to the specified byte count. Allowing very large payloads may cause the server to run out of memory.<!-- -->Default value: The one set in the kibana.yml config file under the parameter <code>server.maxPayloadBytes</code>. |
+|  [maxBytes](./kibana-plugin-core-server.routeconfigoptionsbody.maxbytes.md) | <code>number</code> | Limits the size of incoming payloads to the specified byte count. Allowing very large payloads may cause the server to run out of memory.<!-- -->Default value: The one set in the kibana.yml config file under the parameter <code>server.maxPayload</code>. |
 |  [output](./kibana-plugin-core-server.routeconfigoptionsbody.output.md) | <code>typeof validBodyOutput[number]</code> | The processed payload format. The value must be one of: \* 'data' - the incoming payload is read fully into memory. If parse is true, the payload is parsed (JSON, form-decoded, multipart) based on the 'Content-Type' header. If parse is false, a raw Buffer is returned. \* 'stream' - the incoming payload is made available via a Stream.Readable interface. If the payload is 'multipart/form-data' and parse is true, field values are presented as text while files are provided as streams. File streams from a 'multipart/form-data' upload will also have a hapi property containing the filename and headers properties. Note that payload streams for multipart payloads are a synthetic interface created on top of the entire multipart content loaded into memory. To avoid loading large multipart payloads into memory, set parse to false and handle the multipart payload in the handler using a streaming parser (e.g. pez).<!-- -->Default value: 'data', unless no validation.body is provided in the route definition. In that case the default is 'stream' to alleviate memory pressure. |
 |  [parse](./kibana-plugin-core-server.routeconfigoptionsbody.parse.md) | <code>boolean &#124; 'gunzip'</code> | Determines if the incoming payload is processed or presented raw. Available values: \* true - if the request 'Content-Type' matches the allowed mime types set by allow (for the whole payload as well as parts), the payload is converted into an object when possible. If the format is unknown, a Bad Request (400) error response is sent. Any known content encoding is decoded. \* false - the raw payload is returned unmodified. \* 'gunzip' - the raw payload is returned unmodified after any known content encoding is decoded.<!-- -->Default value: true, unless no validation.body is provided in the route definition. In that case the default is false to alleviate memory pressure. |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.hierarchical.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.hierarchical.md
new file mode 100644
index 00000000000000..66d540c48c3bc8
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.hierarchical.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [hierarchical](./kibana-plugin-plugins-data-public.aggconfigs.hierarchical.md)
+
+## AggConfigs.hierarchical property
+
+<b>Signature:</b>
+
+```typescript
+hierarchical?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md
index 22f8994747aa29..02e9a63d95ba37 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md
@@ -22,6 +22,7 @@ export declare class AggConfigs
 |  --- | --- | --- | --- |
 |  [aggs](./kibana-plugin-plugins-data-public.aggconfigs.aggs.md) |  | <code>IAggConfig[]</code> |  |
 |  [createAggConfig](./kibana-plugin-plugins-data-public.aggconfigs.createaggconfig.md) |  | <code>&lt;T extends AggConfig = AggConfig&gt;(params: CreateAggConfigParams, { addToAggConfigs }?: {</code><br/><code>        addToAggConfigs?: boolean &#124; undefined;</code><br/><code>    }) =&gt; T</code> |  |
+|  [hierarchical](./kibana-plugin-plugins-data-public.aggconfigs.hierarchical.md) |  | <code>boolean</code> |  |
 |  [indexPattern](./kibana-plugin-plugins-data-public.aggconfigs.indexpattern.md) |  | <code>IndexPattern</code> |  |
 |  [timeFields](./kibana-plugin-plugins-data-public.aggconfigs.timefields.md) |  | <code>string[]</code> |  |
 |  [timeRange](./kibana-plugin-plugins-data-public.aggconfigs.timerange.md) |  | <code>TimeRange</code> |  |
@@ -46,5 +47,5 @@ export declare class AggConfigs
 |  [onSearchRequestStart(searchSource, options)](./kibana-plugin-plugins-data-public.aggconfigs.onsearchrequeststart.md) |  |  |
 |  [setTimeFields(timeFields)](./kibana-plugin-plugins-data-public.aggconfigs.settimefields.md) |  |  |
 |  [setTimeRange(timeRange)](./kibana-plugin-plugins-data-public.aggconfigs.settimerange.md) |  |  |
-|  [toDsl(hierarchical)](./kibana-plugin-plugins-data-public.aggconfigs.todsl.md) |  |  |
+|  [toDsl()](./kibana-plugin-plugins-data-public.aggconfigs.todsl.md) |  |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md
index 055c4113ca3e46..1327e976db0ce3 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md
@@ -7,15 +7,8 @@
 <b>Signature:</b>
 
 ```typescript
-toDsl(hierarchical?: boolean): Record<string, any>;
+toDsl(): Record<string, any>;
 ```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  hierarchical | <code>boolean</code> |  |
-
 <b>Returns:</b>
 
 `Record<string, any>`
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquerysortvalue.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquerysortvalue.md
index 83762c22f0f826..15f45532cce2fe 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquerysortvalue.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquerysortvalue.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-export declare type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric>;
+export declare type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric | SortDirectionFormat>;
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.requestresponder.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.inspector.md
similarity index 52%
rename from docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.requestresponder.md
rename to docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.inspector.md
index b4431b9467b71e..9961292aaf2177 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.requestresponder.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.inspector.md
@@ -1,11 +1,13 @@
 <!-- Do not edit this file. It is automatically generated by API Documenter. -->
 
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-public.isearchoptions.md) &gt; [requestResponder](./kibana-plugin-plugins-data-public.isearchoptions.requestresponder.md)
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-public.isearchoptions.md) &gt; [inspector](./kibana-plugin-plugins-data-public.isearchoptions.inspector.md)
 
-## ISearchOptions.requestResponder property
+## ISearchOptions.inspector property
+
+Inspector integration options
 
 <b>Signature:</b>
 
 ```typescript
-requestResponder?: RequestResponder;
+inspector?: IInspectorInfo;
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md
index cc0cb538be6113..21fb7e3dfc7e87 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchoptions.md
@@ -16,10 +16,10 @@ export interface ISearchOptions
 |  --- | --- | --- |
 |  [abortSignal](./kibana-plugin-plugins-data-public.isearchoptions.abortsignal.md) | <code>AbortSignal</code> | An <code>AbortSignal</code> that allows the caller of <code>search</code> to abort a search request. |
 |  [indexPattern](./kibana-plugin-plugins-data-public.isearchoptions.indexpattern.md) | <code>IndexPattern</code> | Index pattern reference is used for better error messages |
+|  [inspector](./kibana-plugin-plugins-data-public.isearchoptions.inspector.md) | <code>IInspectorInfo</code> | Inspector integration options |
 |  [isRestore](./kibana-plugin-plugins-data-public.isearchoptions.isrestore.md) | <code>boolean</code> | Whether the session is restored (i.e. search requests should re-use the stored search IDs, rather than starting from scratch) |
 |  [isStored](./kibana-plugin-plugins-data-public.isearchoptions.isstored.md) | <code>boolean</code> | Whether the session is already saved (i.e. sent to background) |
 |  [legacyHitsTotal](./kibana-plugin-plugins-data-public.isearchoptions.legacyhitstotal.md) | <code>boolean</code> | Request the legacy format for the total number of hits. If sending <code>rest_total_hits_as_int</code> to something other than <code>true</code>, this should be set to <code>false</code>. |
-|  [requestResponder](./kibana-plugin-plugins-data-public.isearchoptions.requestresponder.md) | <code>RequestResponder</code> |  |
 |  [sessionId](./kibana-plugin-plugins-data-public.isearchoptions.sessionid.md) | <code>string</code> | A session ID, grouping multiple search requests into a single session. |
 |  [strategy](./kibana-plugin-plugins-data-public.isearchoptions.strategy.md) | <code>string</code> | Use this option to force using a specific server side search strategy. Leave empty to use the default strategy. |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
index 623d6366d4d131..e6ba1a51a867d2 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
@@ -14,7 +14,7 @@ Fetch this source and reject the returned Promise on error
 <b>Signature:</b>
 
 ```typescript
-fetch(options?: ISearchOptions): Promise<import("@elastic/elasticsearch/api/types").SearchResponse<any>>;
+fetch(options?: ISearchOptions): Promise<estypes.SearchResponse<any>>;
 ```
 
 ## Parameters
@@ -25,5 +25,5 @@ fetch(options?: ISearchOptions): Promise<import("@elastic/elasticsearch/api/type
 
 <b>Returns:</b>
 
-`Promise<import("@elastic/elasticsearch/api/types").SearchResponse<any>>`
+`Promise<estypes.SearchResponse<any>>`
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch_.md
index d5641107a88aa1..4369cf7c087da7 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch_.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch_.md
@@ -9,7 +9,7 @@ Fetch this source from Elasticsearch, returning an observable over the response(
 <b>Signature:</b>
 
 ```typescript
-fetch$(options?: ISearchOptions): import("rxjs").Observable<import("@elastic/elasticsearch/api/types").SearchResponse<any>>;
+fetch$(options?: ISearchOptions): Observable<estypes.SearchResponse<any>>;
 ```
 
 ## Parameters
@@ -20,5 +20,5 @@ fetch$(options?: ISearchOptions): import("rxjs").Observable<import("@elastic/ela
 
 <b>Returns:</b>
 
-`import("rxjs").Observable<import("@elastic/elasticsearch/api/types").SearchResponse<any>>`
+`Observable<estypes.SearchResponse<any>>`
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md
index f6bab8e424857d..12011f82429969 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md
@@ -9,5 +9,5 @@
 <b>Signature:</b>
 
 ```typescript
-aggs?: any;
+aggs?: object | IAggConfigs | (() => object);
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md
index d0f53936eb56aa..981d956a9e89be 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md
@@ -16,7 +16,7 @@ export interface SearchSourceFields
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [aggs](./kibana-plugin-plugins-data-public.searchsourcefields.aggs.md) | <code>any</code> | [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) |
+|  [aggs](./kibana-plugin-plugins-data-public.searchsourcefields.aggs.md) | <code>object &#124; IAggConfigs &#124; (() =&gt; object)</code> | [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) |
 |  [fields](./kibana-plugin-plugins-data-public.searchsourcefields.fields.md) | <code>SearchFieldValue[]</code> | Retrieve fields via the search Fields API |
 |  [fieldsFromSource](./kibana-plugin-plugins-data-public.searchsourcefields.fieldsfromsource.md) | <code>NameList</code> | Retreive fields directly from \_source (legacy behavior) |
 |  [filter](./kibana-plugin-plugins-data-public.searchsourcefields.filter.md) | <code>Filter[] &#124; Filter &#124; (() =&gt; Filter[] &#124; Filter &#124; undefined)</code> | [Filter](./kibana-plugin-plugins-data-public.filter.md) |
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.requestresponder.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.inspector.md
similarity index 52%
rename from docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.requestresponder.md
rename to docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.inspector.md
index 7440f5a9d26cfc..ab755334643aae 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.requestresponder.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.inspector.md
@@ -1,11 +1,13 @@
 <!-- Do not edit this file. It is automatically generated by API Documenter. -->
 
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-server.isearchoptions.md) &gt; [requestResponder](./kibana-plugin-plugins-data-server.isearchoptions.requestresponder.md)
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchOptions](./kibana-plugin-plugins-data-server.isearchoptions.md) &gt; [inspector](./kibana-plugin-plugins-data-server.isearchoptions.inspector.md)
 
-## ISearchOptions.requestResponder property
+## ISearchOptions.inspector property
+
+Inspector integration options
 
 <b>Signature:</b>
 
 ```typescript
-requestResponder?: RequestResponder;
+inspector?: IInspectorInfo;
 ```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md
index 413a59be3d4278..cdb5664f96cddb 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchoptions.md
@@ -16,10 +16,10 @@ export interface ISearchOptions
 |  --- | --- | --- |
 |  [abortSignal](./kibana-plugin-plugins-data-server.isearchoptions.abortsignal.md) | <code>AbortSignal</code> | An <code>AbortSignal</code> that allows the caller of <code>search</code> to abort a search request. |
 |  [indexPattern](./kibana-plugin-plugins-data-server.isearchoptions.indexpattern.md) | <code>IndexPattern</code> | Index pattern reference is used for better error messages |
+|  [inspector](./kibana-plugin-plugins-data-server.isearchoptions.inspector.md) | <code>IInspectorInfo</code> | Inspector integration options |
 |  [isRestore](./kibana-plugin-plugins-data-server.isearchoptions.isrestore.md) | <code>boolean</code> | Whether the session is restored (i.e. search requests should re-use the stored search IDs, rather than starting from scratch) |
 |  [isStored](./kibana-plugin-plugins-data-server.isearchoptions.isstored.md) | <code>boolean</code> | Whether the session is already saved (i.e. sent to background) |
 |  [legacyHitsTotal](./kibana-plugin-plugins-data-server.isearchoptions.legacyhitstotal.md) | <code>boolean</code> | Request the legacy format for the total number of hits. If sending <code>rest_total_hits_as_int</code> to something other than <code>true</code>, this should be set to <code>false</code>. |
-|  [requestResponder](./kibana-plugin-plugins-data-server.isearchoptions.requestresponder.md) | <code>RequestResponder</code> |  |
 |  [sessionId](./kibana-plugin-plugins-data-server.isearchoptions.sessionid.md) | <code>string</code> | A session ID, grouping multiple search requests into a single session. |
 |  [strategy](./kibana-plugin-plugins-data-server.isearchoptions.strategy.md) | <code>string</code> | Use this option to force using a specific server side search strategy. Leave empty to use the default strategy. |
 
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.container.children.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.container.children.md
index e8f140219ed9c3..a334f37ba3e7dc 100644
--- a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.container.children.md
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.container.children.md
@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-protected readonly children: {
+readonly children: {
         [key: string]: IEmbeddable<any, any> | ErrorEmbeddable;
     };
 ```
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.getdescription.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.getdescription.md
new file mode 100644
index 00000000000000..1699351349bf84
--- /dev/null
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.getdescription.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-embeddable-public](./kibana-plugin-plugins-embeddable-public.md) &gt; [EmbeddableFactory](./kibana-plugin-plugins-embeddable-public.embeddablefactory.md) &gt; [getDescription](./kibana-plugin-plugins-embeddable-public.embeddablefactory.getdescription.md)
+
+## EmbeddableFactory.getDescription() method
+
+Returns a description about the embeddable.
+
+<b>Signature:</b>
+
+```typescript
+getDescription(): string;
+```
+<b>Returns:</b>
+
+`string`
+
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.geticontype.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.geticontype.md
new file mode 100644
index 00000000000000..58b987e5630c48
--- /dev/null
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.geticontype.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-embeddable-public](./kibana-plugin-plugins-embeddable-public.md) &gt; [EmbeddableFactory](./kibana-plugin-plugins-embeddable-public.embeddablefactory.md) &gt; [getIconType](./kibana-plugin-plugins-embeddable-public.embeddablefactory.geticontype.md)
+
+## EmbeddableFactory.getIconType() method
+
+Returns an EUI Icon type to be displayed in a menu.
+
+<b>Signature:</b>
+
+```typescript
+getIconType(): string;
+```
+<b>Returns:</b>
+
+`string`
+
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.grouping.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.grouping.md
new file mode 100644
index 00000000000000..c4dbe739ddfcb7
--- /dev/null
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.grouping.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-embeddable-public](./kibana-plugin-plugins-embeddable-public.md) &gt; [EmbeddableFactory](./kibana-plugin-plugins-embeddable-public.embeddablefactory.md) &gt; [grouping](./kibana-plugin-plugins-embeddable-public.embeddablefactory.grouping.md)
+
+## EmbeddableFactory.grouping property
+
+Indicates the grouping this factory should appear in a sub-menu. Example, this is used for grouping options in the editors menu in Dashboard for creating new embeddables
+
+<b>Signature:</b>
+
+```typescript
+readonly grouping?: UiActionsPresentableGrouping;
+```
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.md
index b355acd0567a82..8ee60e1f58a2b6 100644
--- a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.md
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactory.md
@@ -16,6 +16,7 @@ export interface EmbeddableFactory<TEmbeddableInput extends EmbeddableInput = Em
 
 |  Property | Type | Description |
 |  --- | --- | --- |
+|  [grouping](./kibana-plugin-plugins-embeddable-public.embeddablefactory.grouping.md) | <code>UiActionsPresentableGrouping</code> | Indicates the grouping this factory should appear in a sub-menu. Example, this is used for grouping options in the editors menu in Dashboard for creating new embeddables |
 |  [isContainerType](./kibana-plugin-plugins-embeddable-public.embeddablefactory.iscontainertype.md) | <code>boolean</code> | True if is this factory create embeddables that are Containers. Used in the add panel to conditionally show whether these can be added to another container. It's just not supported right now, but once nested containers are officially supported we can probably get rid of this interface. |
 |  [isEditable](./kibana-plugin-plugins-embeddable-public.embeddablefactory.iseditable.md) | <code>() =&gt; Promise&lt;boolean&gt;</code> | Returns whether the current user should be allowed to edit this type of embeddable. Most of the time this should be based off the capabilities service, hence it's async. |
 |  [savedObjectMetaData](./kibana-plugin-plugins-embeddable-public.embeddablefactory.savedobjectmetadata.md) | <code>SavedObjectMetaData&lt;TSavedObjectAttributes&gt;</code> |  |
@@ -29,6 +30,8 @@ export interface EmbeddableFactory<TEmbeddableInput extends EmbeddableInput = Em
 |  [create(initialInput, parent)](./kibana-plugin-plugins-embeddable-public.embeddablefactory.create.md) | Resolves to undefined if a new Embeddable cannot be directly created and the user will instead be redirected elsewhere.<!-- -->This will likely change in future iterations when we improve in place editing capabilities. |
 |  [createFromSavedObject(savedObjectId, input, parent)](./kibana-plugin-plugins-embeddable-public.embeddablefactory.createfromsavedobject.md) | Creates a new embeddable instance based off the saved object id. |
 |  [getDefaultInput(partial)](./kibana-plugin-plugins-embeddable-public.embeddablefactory.getdefaultinput.md) | Can be used to get any default input, to be passed in to during the creation process. Default input will not be stored in a parent container, so any inherited input from a container will trump default input parameters. |
+|  [getDescription()](./kibana-plugin-plugins-embeddable-public.embeddablefactory.getdescription.md) | Returns a description about the embeddable. |
 |  [getDisplayName()](./kibana-plugin-plugins-embeddable-public.embeddablefactory.getdisplayname.md) | Returns a display name for this type of embeddable. Used in "Create new... " options in the add panel for containers. |
 |  [getExplicitInput()](./kibana-plugin-plugins-embeddable-public.embeddablefactory.getexplicitinput.md) | Can be used to request explicit input from the user, to be passed in to <code>EmbeddableFactory:create</code>. Explicit input is stored on the parent container for this embeddable. It overrides any inherited input passed down from the parent container. |
+|  [getIconType()](./kibana-plugin-plugins-embeddable-public.embeddablefactory.geticontype.md) | Returns an EUI Icon type to be displayed in a menu. |
 
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactorydefinition.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactorydefinition.md
index 6ecb88e7c017ea..dd61272625160e 100644
--- a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactorydefinition.md
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.embeddablefactorydefinition.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-export declare type EmbeddableFactoryDefinition<I extends EmbeddableInput = EmbeddableInput, O extends EmbeddableOutput = EmbeddableOutput, E extends IEmbeddable<I, O> = IEmbeddable<I, O>, T extends SavedObjectAttributes = SavedObjectAttributes> = Pick<EmbeddableFactory<I, O, E, T>, 'create' | 'type' | 'isEditable' | 'getDisplayName'> & Partial<Pick<EmbeddableFactory<I, O, E, T>, 'createFromSavedObject' | 'isContainerType' | 'getExplicitInput' | 'savedObjectMetaData' | 'canCreateNew' | 'getDefaultInput' | 'telemetry' | 'extract' | 'inject' | 'migrations'>>;
+export declare type EmbeddableFactoryDefinition<I extends EmbeddableInput = EmbeddableInput, O extends EmbeddableOutput = EmbeddableOutput, E extends IEmbeddable<I, O> = IEmbeddable<I, O>, T extends SavedObjectAttributes = SavedObjectAttributes> = Pick<EmbeddableFactory<I, O, E, T>, 'create' | 'type' | 'isEditable' | 'getDisplayName'> & Partial<Pick<EmbeddableFactory<I, O, E, T>, 'createFromSavedObject' | 'isContainerType' | 'getExplicitInput' | 'savedObjectMetaData' | 'canCreateNew' | 'getDefaultInput' | 'telemetry' | 'extract' | 'inject' | 'migrations' | 'grouping' | 'getIconType' | 'getDescription'>>;
 ```
diff --git a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.openaddpanelflyout.md b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.openaddpanelflyout.md
index add46463753590..90caaa3035b348 100644
--- a/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.openaddpanelflyout.md
+++ b/docs/development/plugins/embeddable/public/kibana-plugin-plugins-embeddable-public.openaddpanelflyout.md
@@ -14,6 +14,7 @@ export declare function openAddPanelFlyout(options: {
     overlays: OverlayStart;
     notifications: NotificationsStart;
     SavedObjectFinder: React.ComponentType<any>;
+    showCreateNewMenu?: boolean;
 }): OverlayRef;
 ```
 
@@ -21,7 +22,7 @@ export declare function openAddPanelFlyout(options: {
 
 |  Parameter | Type | Description |
 |  --- | --- | --- |
-|  options | <code>{</code><br/><code>    embeddable: IContainer;</code><br/><code>    getFactory: EmbeddableStart['getEmbeddableFactory'];</code><br/><code>    getAllFactories: EmbeddableStart['getEmbeddableFactories'];</code><br/><code>    overlays: OverlayStart;</code><br/><code>    notifications: NotificationsStart;</code><br/><code>    SavedObjectFinder: React.ComponentType&lt;any&gt;;</code><br/><code>}</code> |  |
+|  options | <code>{</code><br/><code>    embeddable: IContainer;</code><br/><code>    getFactory: EmbeddableStart['getEmbeddableFactory'];</code><br/><code>    getAllFactories: EmbeddableStart['getEmbeddableFactories'];</code><br/><code>    overlays: OverlayStart;</code><br/><code>    notifications: NotificationsStart;</code><br/><code>    SavedObjectFinder: React.ComponentType&lt;any&gt;;</code><br/><code>    showCreateNewMenu?: boolean;</code><br/><code>}</code> |  |
 
 <b>Returns:</b>
 
diff --git a/docs/development/plugins/ui_actions/public/kibana-plugin-plugins-ui_actions-public.uiactionspresentable.getdisplaynametooltip.md b/docs/development/plugins/ui_actions/public/kibana-plugin-plugins-ui_actions-public.uiactionspresentable.getdisplaynametooltip.md
index 8fc859d5713e6a..a35f455f7af25e 100644
--- a/docs/development/plugins/ui_actions/public/kibana-plugin-plugins-ui_actions-public.uiactionspresentable.getdisplaynametooltip.md
+++ b/docs/development/plugins/ui_actions/public/kibana-plugin-plugins-ui_actions-public.uiactionspresentable.getdisplaynametooltip.md
@@ -9,7 +9,7 @@ Returns tooltip text which should be displayed when user hovers this object. Sho
 <b>Signature:</b>
 
 ```typescript
-getDisplayNameTooltip(context: Context): string;
+getDisplayNameTooltip?(context: Context): string;
 ```
 
 ## Parameters
diff --git a/docs/management/action-types.asciidoc b/docs/management/action-types.asciidoc
new file mode 100644
index 00000000000000..4d6dcb631792ea
--- /dev/null
+++ b/docs/management/action-types.asciidoc
@@ -0,0 +1,117 @@
+[role="xpack"]
+[[action-types]]
+== Connectors
+
+Connectors provide a central place to store connection information for services and integrations with third party systems. Actions are instantiations of a connector that are linked to rules and run as background tasks on the {kib} server when rule conditions are met. {kib} provides the following types of connectors:
+
+[cols="2"]
+|===
+
+a| <<email-action-type, Email>>
+
+| Send email from your server.
+
+a| <<resilient-action-type, IBM Resilient>>
+
+| Create an incident in IBM Resilient.
+
+a| <<index-action-type, Index>>
+
+| Index data into Elasticsearch.
+
+a| <<jira-action-type, Jira>>
+
+| Create an incident in Jira.
+
+a| <<teams-action-type, Microsoft Teams>>
+
+| Send a message to a Microsoft Teams channel.
+
+a| <<pagerduty-action-type, PagerDuty>>
+
+| Send an event in PagerDuty.
+
+a| <<server-log-action-type, ServerLog>>
+
+| Add a message to a Kibana log.
+
+a| <<servicenow-action-type, ServiceNow>>
+
+| Create an incident in ServiceNow.
+
+a| <<slack-action-type, Slack>>
+
+| Send a message to a Slack channel or user.
+
+a| <<webhook-action-type, Webhook>>
+
+| Send a request to a web service.
+|===
+
+[NOTE]
+==============================================
+Some connector types are paid commercial features, while others are free.
+For a comparison of the Elastic subscription levels,
+see https://www.elastic.co/subscriptions[the subscription page].
+==============================================
+
+[float]
+[[connector-management]]
+=== Managing Connectors
+
+Rules use *Connectors* to route actions to different destinations like log files, ticketing systems, and messaging tools. While each {kib} app can offer their own types of rules, they typically share connectors. The *Connectors* tab offers a central place to view and manage all the connectors in the current space.
+
+For more information on connectors and the types of actions available see <<action-types>>.
+
+[role="screenshot"]
+image::images/connector-listing.png[Example connector listing in the Rules and Connectors UI]
+
+[float]
+=== Required permissions
+
+Access to connectors is granted based on your privileges to alerting-enabled features. See <<alerting-security, Alerting Security>> for more information.
+
+[float]
+[[connectors-list]]
+=== Connector list
+
+The *Connectors* tab lists all connectors in the current space. The *search bar* can be used to find specific connectors by name and/or type.
+
+[role="screenshot"]
+image::images/connector-filter-by-search.png[Filtering the connector list using the search bar]
+
+
+The *type* dropdown also lets you filter to a subset of connector types.
+
+[role="screenshot"]
+image::images/connector-filter-by-type.png[Filtering the connector list by types of connectors]
+
+You can delete individual connectors using the trash icon. Connectors can also be deleted in bulk by multi-selecting them and clicking the *Delete* button to the left of the search box. 
+
+[role="screenshot"]
+image::images/connector-delete.png[Deleting connectors individually or in bulk]
+
+[NOTE]
+============================================================================
+You can delete a connector even if there are still actions referencing it.
+When this happens the action will fail to execute, and appear as errors in the {kib} logs.
+============================================================================
+
+[float]
+[[creating-new-connector]]
+=== Creating a new connector
+
+New connectors can be created by clicking the *Create connector* button, which will guide you to select the type of connector and configure its properties. Refer to <<action-types>> for the types of connectors available and how to configure them. Once you create a connector it will be made available to you anytime you set up an action in the current space.
+
+[role="screenshot"]
+image::images/connector-select-type.png[Connector select type]
+
+[float]
+[[create-connectors]]
+=== Preconfigured connectors
+
+For out-of-the-box and standardized connectors, you can <<preconfigured-connector-example, preconfigure connectors>>
+before {kib} starts.
+
+
+include::connectors/index.asciidoc[]
diff --git a/docs/management/alerting/connector-management.asciidoc b/docs/management/alerting/connector-management.asciidoc
deleted file mode 100644
index dd3b5209ed4a0c..00000000000000
--- a/docs/management/alerting/connector-management.asciidoc
+++ /dev/null
@@ -1,40 +0,0 @@
-[role="xpack"]
-[[connector-management]]
-=== Managing Connectors
-
-Rules use *Connectors* to route actions to different destinations like log files, ticketing systems, and messaging tools. While each {kib} app can offer their own types of rules, they typically share connectors. The *Connectors* tab offers a central place to view and manage all the connectors in the current space.
-
-For more information on connectors and the types of actions available see <<action-types>>.
-
-[role="screenshot"]
-image::images/connector-listing.png[Example connector listing in the Rules and Connectors UI]
-
-
-[float]
-==== Connector list
-
-The *Connectors* tab lists all connectors in the current space. The *search bar* can be used to find specific connectors by name and/or type.
-
-[role="screenshot"]
-image::images/connector-filter-by-search.png[Filtering the connector list using the search bar]
-
-
-The *type* dropdown also lets you filter to a subset of connector types.
-
-[role="screenshot"]
-image::images/connector-filter-by-type.png[Filtering the connector list by types of connectors]
-
-You can delete individual connectors using the trash icon. Connectors can also be deleted in bulk by multi-selecting them and clicking the *Delete* button to the left of the search box. 
-
-[role="screenshot"]
-image::images/connector-delete.png[Deleting connectors individually or in bulk]
-
-[NOTE]
-============================================================================
-You can delete a connector even if there are still actions referencing it.
-When this happens the action will fail to execute, and appear as errors in the {kib} logs.
-============================================================================
-
-==== Creating a new connector
-
-New connectors can be created by clicking the *Create connector* button, which will guide you to select the type of connector and configure its properties. Refer to <<action-types>> for the types of connectors available and how to configure them. Once you create a connector it will be made available to you anytime you set up an action in the current space.
diff --git a/docs/management/alerting/rules-and-connectors-intro.asciidoc b/docs/management/alerting/rules-and-connectors-intro.asciidoc
deleted file mode 100644
index 6e23ca95e2266e..00000000000000
--- a/docs/management/alerting/rules-and-connectors-intro.asciidoc
+++ /dev/null
@@ -1,29 +0,0 @@
-[role="xpack"]
-[[managing-alerts-and-actions]]
-== Rules and Connectors
-
-
-The *Rules and Connectors* UI lets you <<alert-management, see and control all the rules>> in a space, and provides tools to <<connector-management, create and manage connectors>> so that rules can trigger actions like notification, indexing, and ticketing.
-
-To manage rules and connectors, open the main menu, then click *Stack Management > Alerts and Insights > Rules and Connectors*.
-
-[role="screenshot"]
-image:management/alerting/images/rules-and-connectors-ui.png[Example rule listing in the Rules and Connectors UI]
-
-[NOTE]
-============================================================================
-Similar to dashboards, rules and connectors reside in a <<xpack-spaces, space>>.
-The *Rules and Connectors* UI only shows rules and connectors for the current space.
-============================================================================
-
-[NOTE]
-============================================================================
-{es} also offers alerting capabilities through Watcher, which
-can be managed through the <<watcher-ui, Watcher UI>>. See
-<<alerting-concepts-differences>> for more information.
-============================================================================
-
-[float]
-=== Required permissions
-
-Access to rules and connectors is granted based on your privileges to alerting-enabled features. See <<alerting-security, Alerting Security>> for more information.
diff --git a/docs/user/alerting/action-types/email.asciidoc b/docs/management/connectors/action-types/email.asciidoc
similarity index 93%
rename from docs/user/alerting/action-types/email.asciidoc
rename to docs/management/connectors/action-types/email.asciidoc
index 58f1300d0c2872..1c2f9212b48871 100644
--- a/docs/user/alerting/action-types/email.asciidoc
+++ b/docs/management/connectors/action-types/email.asciidoc
@@ -25,7 +25,7 @@ Username::  Username for login type authentication.
 Password::  Password for login type authentication.
 
 [float]
-[[Preconfigured-email-configuration]]
+[[preconfigured-email-configuration]]
 ==== Preconfigured connector type
 
 [source,text]
@@ -57,6 +57,19 @@ Secrets defines sensitive information for the connector type.
 `user`:: A string that corresponds to *Username*. Required if `hasAuth` is set to `true`.
 `password`:: A string that corresponds to *Password*. Should be stored in the <<creating-keystore, {kib} keystore>>. Required if `hasAuth` is set to `true`.
 
+[float]
+[[define-email-ui]]
+==== Define connector in Stack Management
+
+Define email connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/email-connector.png[Email connector]
+
+Test email action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/email-params-test.png[Email params test]
 
 [float]
 [[email-action-configuration]]
@@ -68,6 +81,7 @@ To, CC, BCC::    Each item is a list of addresses. Addresses can be specified in
 Subject::       The subject line of the email.
 Message::       The message text of the email. Markdown format is supported.
 
+[float]
 [[configuring-email]]
 ==== Configuring email accounts for well-known services
 
@@ -84,7 +98,7 @@ For other email servers, you can check the list of well-known services that Node
 
 [float]
 [[gmail]]
-===== Sending email from Gmail
+==== Sending email from Gmail
 
 Use the following email connector configuration to send email from the
 https://mail.google.com[Gmail] SMTP service:
@@ -112,7 +126,7 @@ for more information.
 
 [float]
 [[outlook]]
-===== Sending email from Outlook.com
+==== Sending email from Outlook.com
 
 Use the following email connector configuration to send email from the
 https://www.outlook.com/[Outlook.com] SMTP service:
@@ -137,7 +151,7 @@ NOTE:   You must use a unique App Password if two-step verification is enabled.
 
 [float]
 [[amazon-ses]]
-===== Sending email from Amazon SES (Simple Email Service)
+==== Sending email from Amazon SES (Simple Email Service)
 
 Use the following email connector configuration to send email from the
 http://aws.amazon.com/ses[Amazon Simple Email Service] (SES) SMTP service:
@@ -164,7 +178,7 @@ NOTE:   You must use your Amazon SES SMTP credentials to send email through
 
 [float]
 [[exchange]]
-===== Sending email from Microsoft Exchange
+==== Sending email from Microsoft Exchange
 
 Use the following email connector configuration to send email from Microsoft
 Exchange:
diff --git a/docs/user/alerting/action-types/index.asciidoc b/docs/management/connectors/action-types/index.asciidoc
similarity index 92%
rename from docs/user/alerting/action-types/index.asciidoc
rename to docs/management/connectors/action-types/index.asciidoc
index e23dcbf298fd5b..d3bd3d431748c9 100644
--- a/docs/user/alerting/action-types/index.asciidoc
+++ b/docs/management/connectors/action-types/index.asciidoc
@@ -39,6 +39,20 @@ Config defines information for the connector type.
 `refresh`:: A boolean that corresponds to *Refresh*. Defaults to `false`.
 `executionTimeField`:: A string that corresponds to *Execution time field*.
 
+[float]
+[[define-index-ui]]
+==== Define connector in Stack Management
+
+Define Index connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/index-connector.png[Index connector]
+
+Test Index action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/index-params-test.png[Index params test]
+
 [float]
 [[index-action-configuration]]
 ==== Action configuration
diff --git a/docs/user/alerting/action-types/jira.asciidoc b/docs/management/connectors/action-types/jira.asciidoc
similarity index 86%
rename from docs/user/alerting/action-types/jira.asciidoc
rename to docs/management/connectors/action-types/jira.asciidoc
index 7b4dc69bb639a3..a5e629887d5c6e 100644
--- a/docs/user/alerting/action-types/jira.asciidoc
+++ b/docs/management/connectors/action-types/jira.asciidoc
@@ -46,6 +46,20 @@ Secrets defines sensitive information for the connector type.
 `email`:: A string that corresponds to *Email*.
 `apiToken`:: A string that corresponds to *API Token*. Should be stored in the <<creating-keystore, {kib} keystore>>.
 
+[float]
+[[define-jira-ui]]
+==== Define connector in Stack Management
+
+Define Jira connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/jira-connector.png[Jira connector]
+
+Test Jira action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/jira-params-test.png[Jira params test]
+
 [float]
 [[jira-action-configuration]]
 ==== Action configuration
@@ -60,6 +74,7 @@ Description:: The details about the incident.
 Parent:: The ID or key of the parent issue. Only for `Subtask` issue types.
 Additional comments:: Additional information for the client, such as how to troubleshoot the issue.
 
+[float]
 [[configuring-jira]]
 ==== Configure Jira
 
diff --git a/docs/user/alerting/action-types/pagerduty.asciidoc b/docs/management/connectors/action-types/pagerduty.asciidoc
similarity index 93%
rename from docs/user/alerting/action-types/pagerduty.asciidoc
rename to docs/management/connectors/action-types/pagerduty.asciidoc
index c32e6c8a6635fa..25cba050105480 100644
--- a/docs/user/alerting/action-types/pagerduty.asciidoc
+++ b/docs/management/connectors/action-types/pagerduty.asciidoc
@@ -40,6 +40,20 @@ Secrets defines sensitive information for the connector type.
 
 `routingKey`:: A string that corresponds to *Integration Key*.
 
+[float]
+[[define-pagerduty-ui]]
+==== Define connector in Stack Management
+
+Define PagerDuty connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/pagerduty-connector.png[PagerDuty connector]
+
+Test PagerDuty action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/pagerduty-params-test.png[PagerDuty params test]
+
 [float]
 [[pagerduty-action-configuration]]
 ==== Action configuration
@@ -70,14 +84,14 @@ By integrating PagerDuty with rules, you can:
 
 [float]
 [[pagerduty-support]]
-===== Support
+==== Support
 If you need help with this integration, get in touch with the {kib} team by visiting
 https://support.elastic.co[support.elastic.co] or by using the *Ask Elastic* option in the {kib} Help menu.
 You can also select the {kib} category at https://discuss.elastic.co/[discuss.elastic.co].
 
 [float]
 [[pagerduty-integration-walkthrough]]
-===== Integration with PagerDuty walkthrough
+==== Integration with PagerDuty walkthrough
 
 [[pagerduty-in-pagerduty]]
 *In PagerDuty*
@@ -101,7 +115,7 @@ and select *Elastic Alerts* from the *Integration Type* menu.
 You will be redirected to the *Integrations* tab for your service. An Integration Key is generated on this screen.
 +
 [role="screenshot"]
-image::user/alerting/images/pagerduty-integration.png[PagerDuty Integrations tab]
+image::images/pagerduty-integration.png[PagerDuty Integrations tab]
 
 . Save this key, as you will use it when you configure the integration with Elastic in the next section.
 
diff --git a/docs/user/alerting/action-types/resilient.asciidoc b/docs/management/connectors/action-types/resilient.asciidoc
similarity index 85%
rename from docs/user/alerting/action-types/resilient.asciidoc
rename to docs/management/connectors/action-types/resilient.asciidoc
index 862af0e5263371..454ae145bbc579 100644
--- a/docs/user/alerting/action-types/resilient.asciidoc
+++ b/docs/management/connectors/action-types/resilient.asciidoc
@@ -46,6 +46,20 @@ Secrets defines sensitive information for the connector type.
 `apiKeyId`:: A string that corresponds to *API key ID*.
 `apiKeySecret`:: A string that corresponds to *API Key secret*. Should be stored in the <<creating-keystore, {kib} keystore>>.
 
+[float]
+[[define-resilient-ui]]
+==== Define connector in Stack Management
+
+Define IBM Resilient connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/resilient-connector.png[IBM Resilient connector]
+
+Test IBM Resilient action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/resilient-params-test.png[IBM Resilient params test]
+
 [float]
 [[resilient-action-configuration]]
 ==== Action configuration
@@ -58,6 +72,7 @@ Name:: A name for the issue, used for searching the contents of the knowledge ba
 Description:: The details about the incident.
 Additional comments:: Additional information for the client, such as how to troubleshoot the issue.
 
+[float]
 [[configuring-resilient]]
 ==== Configure IBM Resilient
 
diff --git a/docs/user/alerting/action-types/server-log.asciidoc b/docs/management/connectors/action-types/server-log.asciidoc
similarity index 72%
rename from docs/user/alerting/action-types/server-log.asciidoc
rename to docs/management/connectors/action-types/server-log.asciidoc
index e497ed3a4467af..0810724d39ead3 100644
--- a/docs/user/alerting/action-types/server-log.asciidoc
+++ b/docs/management/connectors/action-types/server-log.asciidoc
@@ -26,6 +26,20 @@ Name::      The name of the connector. The name is used to identify a  connector
    actionTypeId: .server-log
 --
 
+[float]
+[[define-serverlog-ui]]
+==== Define connector in Stack Management
+
+Define Server log connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/serverlog-connector.png[Server log connector]
+
+Test Server log action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/serverlog-params-test.png[Server log params test]
+
 [float]
 [[server-log-action-configuration]]
 ==== Action configuration
diff --git a/docs/user/alerting/action-types/servicenow.asciidoc b/docs/management/connectors/action-types/servicenow.asciidoc
similarity index 86%
rename from docs/user/alerting/action-types/servicenow.asciidoc
rename to docs/management/connectors/action-types/servicenow.asciidoc
index 35d50f1bfeb722..24892c62e804b2 100644
--- a/docs/user/alerting/action-types/servicenow.asciidoc
+++ b/docs/management/connectors/action-types/servicenow.asciidoc
@@ -43,6 +43,20 @@ Secrets defines sensitive information for the connector type.
 `username`:: A string that corresponds to *Username*.
 `password`::  A string that corresponds to *Password*. Should be stored in the <<creating-keystore, {kib} keystore>>.
 
+[float]
+[[define-servicenow-ui]]
+==== Define connector in Stack Management
+
+Define ServiceNow connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/servicenow-connector.png[ServiceNow connector]
+
+Test ServiceNow action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/servicenow-params-test.png[ServiceNow params test]
+
 [float]
 [[servicenow-action-configuration]]
 ==== Action configuration
@@ -56,6 +70,7 @@ Short description::    A short description for the incident, used for searching
 Description::          The details about the incident.
 Additional comments::  Additional information for the client, such as how to troubleshoot the issue.
 
+[float]
 [[configuring-servicenow]]
 ==== Configure ServiceNow
 
diff --git a/docs/user/alerting/action-types/slack.asciidoc b/docs/management/connectors/action-types/slack.asciidoc
similarity index 86%
rename from docs/user/alerting/action-types/slack.asciidoc
rename to docs/management/connectors/action-types/slack.asciidoc
index 3ef369e2a4e4a3..da0bf321f9ade7 100644
--- a/docs/user/alerting/action-types/slack.asciidoc
+++ b/docs/management/connectors/action-types/slack.asciidoc
@@ -33,6 +33,20 @@ Secrets defines sensitive information for the connector type.
 
 `webhookUrl`:: A string that corresponds to *Webhook URL*.
 
+[float]
+[[define-slack-ui]]
+==== Define connector in Stack Management
+
+Define Slack connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/slack-connector.png[Slack connector]
+
+Test Slack action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/slack-params-test.png[Slack params test]
+
 [float]
 [[slack-action-configuration]]
 ==== Action configuration
@@ -41,6 +55,7 @@ Slack actions have the following properties.
 
 Message::   The message	text, converted to the `text` field in the Webhook JSON payload. Currently only the text field is supported. Markdown, images, and other advanced formatting are not yet supported.
 
+[float]
 [[configuring-slack]]
 ==== Configure a Slack account
 
diff --git a/docs/user/alerting/action-types/teams.asciidoc b/docs/management/connectors/action-types/teams.asciidoc
similarity index 88%
rename from docs/user/alerting/action-types/teams.asciidoc
rename to docs/management/connectors/action-types/teams.asciidoc
index 1a0e52141ee9c4..ba723a6f33c860 100644
--- a/docs/user/alerting/action-types/teams.asciidoc
+++ b/docs/management/connectors/action-types/teams.asciidoc
@@ -33,6 +33,20 @@ Secrets defines sensitive information for the connector type.
 
 `webhookUrl`:: A string that corresponds to *Webhook URL*.
 
+[float]
+[[define-teams-ui]]
+==== Define connector in Stack Management
+
+Define Teams connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/teams-connector.png[Teams connector]
+
+Test Teams action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/teams-params-test.png[Teams params test]
+
 [float]
 [[teams-action-configuration]]
 ==== Action configuration
@@ -41,6 +55,7 @@ Microsoft Teams actions have the following properties.
 
 Message::   The message	text, converted to the `text` field in the Webhook JSON payload. Currently only the text field is supported. Markdown, images, and other advanced formatting are not yet supported.
 
+[float]
 [[configuring-teams]]
 ==== Configure a Microsoft Teams account
 
diff --git a/docs/user/alerting/action-types/webhook.asciidoc b/docs/management/connectors/action-types/webhook.asciidoc
similarity index 88%
rename from docs/user/alerting/action-types/webhook.asciidoc
rename to docs/management/connectors/action-types/webhook.asciidoc
index 01ddfee288fc8e..a2024b9457a1c5 100644
--- a/docs/user/alerting/action-types/webhook.asciidoc
+++ b/docs/management/connectors/action-types/webhook.asciidoc
@@ -52,6 +52,20 @@ Secrets defines sensitive information for the connector type.
 `user`:: A string that corresponds to *User*. Required if `hasAuth` is set to `true`.
 `password`:: A string that corresponds to *Password*. Should be stored in the <<creating-keystore, {kib} keystore>>. Required if `hasAuth` is set to `true`.
 
+[float]
+[[define-webhook-ui]]
+==== Define connector in Stack Management
+
+Define Webhook connector properties.
+
+[role="screenshot"]
+image::management/connectors/images/webhook-connector.png[Webhook connector]
+
+Test Webhook action parameters.
+
+[role="screenshot"]
+image::management/connectors/images/webhook-params-test.png[Webhook params test]
+
 [float]
 [[webhook-action-configuration]]
 ==== Action configuration
diff --git a/docs/management/alerting/images/connector-action-count.png b/docs/management/connectors/images/connector-action-count.png
similarity index 100%
rename from docs/management/alerting/images/connector-action-count.png
rename to docs/management/connectors/images/connector-action-count.png
diff --git a/docs/management/alerting/images/connector-delete.png b/docs/management/connectors/images/connector-delete.png
similarity index 100%
rename from docs/management/alerting/images/connector-delete.png
rename to docs/management/connectors/images/connector-delete.png
diff --git a/docs/management/alerting/images/connector-filter-by-search.png b/docs/management/connectors/images/connector-filter-by-search.png
similarity index 100%
rename from docs/management/alerting/images/connector-filter-by-search.png
rename to docs/management/connectors/images/connector-filter-by-search.png
diff --git a/docs/management/alerting/images/connector-filter-by-type.png b/docs/management/connectors/images/connector-filter-by-type.png
similarity index 100%
rename from docs/management/alerting/images/connector-filter-by-type.png
rename to docs/management/connectors/images/connector-filter-by-type.png
diff --git a/docs/management/alerting/images/connector-listing.png b/docs/management/connectors/images/connector-listing.png
similarity index 100%
rename from docs/management/alerting/images/connector-listing.png
rename to docs/management/connectors/images/connector-listing.png
diff --git a/docs/management/connectors/images/connector-select-type.png b/docs/management/connectors/images/connector-select-type.png
new file mode 100644
index 00000000000000..ef5825b1493112
Binary files /dev/null and b/docs/management/connectors/images/connector-select-type.png differ
diff --git a/docs/management/connectors/images/email-connector.png b/docs/management/connectors/images/email-connector.png
new file mode 100644
index 00000000000000..b837fa545a4d11
Binary files /dev/null and b/docs/management/connectors/images/email-connector.png differ
diff --git a/docs/management/connectors/images/email-params-test.png b/docs/management/connectors/images/email-params-test.png
new file mode 100644
index 00000000000000..3745bcd3235e93
Binary files /dev/null and b/docs/management/connectors/images/email-params-test.png differ
diff --git a/docs/management/connectors/images/index-connector.png b/docs/management/connectors/images/index-connector.png
new file mode 100644
index 00000000000000..b3a81a7c0e7618
Binary files /dev/null and b/docs/management/connectors/images/index-connector.png differ
diff --git a/docs/management/connectors/images/index-params-test.png b/docs/management/connectors/images/index-params-test.png
new file mode 100644
index 00000000000000..6f4f83bd4297c8
Binary files /dev/null and b/docs/management/connectors/images/index-params-test.png differ
diff --git a/docs/management/connectors/images/jira-connector.png b/docs/management/connectors/images/jira-connector.png
new file mode 100644
index 00000000000000..5ff5ebf83afc76
Binary files /dev/null and b/docs/management/connectors/images/jira-connector.png differ
diff --git a/docs/management/connectors/images/jira-params-test.png b/docs/management/connectors/images/jira-params-test.png
new file mode 100644
index 00000000000000..78d51e823fb61b
Binary files /dev/null and b/docs/management/connectors/images/jira-params-test.png differ
diff --git a/docs/management/connectors/images/pagerduty-connector.png b/docs/management/connectors/images/pagerduty-connector.png
new file mode 100644
index 00000000000000..2e5d240f42c110
Binary files /dev/null and b/docs/management/connectors/images/pagerduty-connector.png differ
diff --git a/docs/user/alerting/images/pagerduty-integration.png b/docs/management/connectors/images/pagerduty-integration.png
similarity index 100%
rename from docs/user/alerting/images/pagerduty-integration.png
rename to docs/management/connectors/images/pagerduty-integration.png
diff --git a/docs/management/connectors/images/pagerduty-params-test.png b/docs/management/connectors/images/pagerduty-params-test.png
new file mode 100644
index 00000000000000..3fb4a9bb5dc821
Binary files /dev/null and b/docs/management/connectors/images/pagerduty-params-test.png differ
diff --git a/docs/user/alerting/images/pre-configured-connectors-managing.png b/docs/management/connectors/images/pre-configured-connectors-managing.png
similarity index 100%
rename from docs/user/alerting/images/pre-configured-connectors-managing.png
rename to docs/management/connectors/images/pre-configured-connectors-managing.png
diff --git a/docs/user/alerting/images/pre-configured-connectors-view-screen.png b/docs/management/connectors/images/pre-configured-connectors-view-screen.png
similarity index 100%
rename from docs/user/alerting/images/pre-configured-connectors-view-screen.png
rename to docs/management/connectors/images/pre-configured-connectors-view-screen.png
diff --git a/docs/management/connectors/images/resilient-connector.png b/docs/management/connectors/images/resilient-connector.png
new file mode 100644
index 00000000000000..b7d216d150f8c1
Binary files /dev/null and b/docs/management/connectors/images/resilient-connector.png differ
diff --git a/docs/management/connectors/images/resilient-params-test.png b/docs/management/connectors/images/resilient-params-test.png
new file mode 100644
index 00000000000000..865d5b517aea28
Binary files /dev/null and b/docs/management/connectors/images/resilient-params-test.png differ
diff --git a/docs/management/connectors/images/serverlog-connector.png b/docs/management/connectors/images/serverlog-connector.png
new file mode 100644
index 00000000000000..983bb6afadd65b
Binary files /dev/null and b/docs/management/connectors/images/serverlog-connector.png differ
diff --git a/docs/management/connectors/images/serverlog-params-test.png b/docs/management/connectors/images/serverlog-params-test.png
new file mode 100644
index 00000000000000..762721c7ead453
Binary files /dev/null and b/docs/management/connectors/images/serverlog-params-test.png differ
diff --git a/docs/management/connectors/images/servicenow-connector.png b/docs/management/connectors/images/servicenow-connector.png
new file mode 100644
index 00000000000000..9891a80ee758fe
Binary files /dev/null and b/docs/management/connectors/images/servicenow-connector.png differ
diff --git a/docs/management/connectors/images/servicenow-params-test.png b/docs/management/connectors/images/servicenow-params-test.png
new file mode 100644
index 00000000000000..79f1580c873d26
Binary files /dev/null and b/docs/management/connectors/images/servicenow-params-test.png differ
diff --git a/docs/management/connectors/images/servicenow-sir-connector.png b/docs/management/connectors/images/servicenow-sir-connector.png
new file mode 100644
index 00000000000000..fbb137bd4f7d96
Binary files /dev/null and b/docs/management/connectors/images/servicenow-sir-connector.png differ
diff --git a/docs/management/connectors/images/servicenow-sir-params-test.png b/docs/management/connectors/images/servicenow-sir-params-test.png
new file mode 100644
index 00000000000000..16ea83c60b3c32
Binary files /dev/null and b/docs/management/connectors/images/servicenow-sir-params-test.png differ
diff --git a/docs/user/alerting/images/slack-add-webhook-integration.png b/docs/management/connectors/images/slack-add-webhook-integration.png
similarity index 100%
rename from docs/user/alerting/images/slack-add-webhook-integration.png
rename to docs/management/connectors/images/slack-add-webhook-integration.png
diff --git a/docs/management/connectors/images/slack-connector.png b/docs/management/connectors/images/slack-connector.png
new file mode 100644
index 00000000000000..7342d962d2a2bb
Binary files /dev/null and b/docs/management/connectors/images/slack-connector.png differ
diff --git a/docs/user/alerting/images/slack-copy-webhook-url.png b/docs/management/connectors/images/slack-copy-webhook-url.png
similarity index 100%
rename from docs/user/alerting/images/slack-copy-webhook-url.png
rename to docs/management/connectors/images/slack-copy-webhook-url.png
diff --git a/docs/management/connectors/images/slack-params-test.png b/docs/management/connectors/images/slack-params-test.png
new file mode 100644
index 00000000000000..603f66301af122
Binary files /dev/null and b/docs/management/connectors/images/slack-params-test.png differ
diff --git a/docs/user/alerting/images/teams-add-webhook-integration.png b/docs/management/connectors/images/teams-add-webhook-integration.png
similarity index 100%
rename from docs/user/alerting/images/teams-add-webhook-integration.png
rename to docs/management/connectors/images/teams-add-webhook-integration.png
diff --git a/docs/management/connectors/images/teams-connector.png b/docs/management/connectors/images/teams-connector.png
new file mode 100644
index 00000000000000..4b9112db28474d
Binary files /dev/null and b/docs/management/connectors/images/teams-connector.png differ
diff --git a/docs/user/alerting/images/teams-copy-webhook-url.png b/docs/management/connectors/images/teams-copy-webhook-url.png
similarity index 100%
rename from docs/user/alerting/images/teams-copy-webhook-url.png
rename to docs/management/connectors/images/teams-copy-webhook-url.png
diff --git a/docs/management/connectors/images/teams-params-test.png b/docs/management/connectors/images/teams-params-test.png
new file mode 100644
index 00000000000000..01efb84ae60d46
Binary files /dev/null and b/docs/management/connectors/images/teams-params-test.png differ
diff --git a/docs/management/connectors/images/webhook-connector.png b/docs/management/connectors/images/webhook-connector.png
new file mode 100644
index 00000000000000..6046572734afd3
Binary files /dev/null and b/docs/management/connectors/images/webhook-connector.png differ
diff --git a/docs/management/connectors/images/webhook-params-test.png b/docs/management/connectors/images/webhook-params-test.png
new file mode 100644
index 00000000000000..7b7007a72a0b63
Binary files /dev/null and b/docs/management/connectors/images/webhook-params-test.png differ
diff --git a/docs/management/connectors/index.asciidoc b/docs/management/connectors/index.asciidoc
new file mode 100644
index 00000000000000..ea4fa46d3e8082
--- /dev/null
+++ b/docs/management/connectors/index.asciidoc
@@ -0,0 +1,11 @@
+include::action-types/email.asciidoc[]
+include::action-types/resilient.asciidoc[]
+include::action-types/index.asciidoc[]
+include::action-types/jira.asciidoc[]
+include::action-types/teams.asciidoc[]
+include::action-types/pagerduty.asciidoc[]
+include::action-types/server-log.asciidoc[]
+include::action-types/servicenow.asciidoc[]
+include::action-types/slack.asciidoc[]
+include::action-types/webhook.asciidoc[]
+include::pre-configured-connectors.asciidoc[]
diff --git a/docs/user/alerting/action-types/pre-configured-connectors.asciidoc b/docs/management/connectors/pre-configured-connectors.asciidoc
similarity index 99%
rename from docs/user/alerting/action-types/pre-configured-connectors.asciidoc
rename to docs/management/connectors/pre-configured-connectors.asciidoc
index 557404f24288a2..4d304cdd6c5a20 100644
--- a/docs/user/alerting/action-types/pre-configured-connectors.asciidoc
+++ b/docs/management/connectors/pre-configured-connectors.asciidoc
@@ -1,6 +1,5 @@
 [role="xpack"]
 [[pre-configured-connectors]]
-
 === Preconfigured connectors
 
 You can preconfigure a connector to have all the information it needs prior to startup by adding it to the `kibana.yml` file.
diff --git a/docs/management/alerting/images/rules-and-connectors-ui.png b/docs/management/images/rules-and-connectors-ui.png
similarity index 100%
rename from docs/management/alerting/images/rules-and-connectors-ui.png
rename to docs/management/images/rules-and-connectors-ui.png
diff --git a/docs/maps/trouble-shooting.asciidoc b/docs/maps/trouble-shooting.asciidoc
index 11aa636e0d8522..0e1ed0b9e1bec5 100644
--- a/docs/maps/trouble-shooting.asciidoc
+++ b/docs/maps/trouble-shooting.asciidoc
@@ -32,7 +32,7 @@ image::maps/images/inspector.png[]
   ** Ensure your geospatial field is searchable and aggregatable.
   ** If your geospatial field type does not match your Elasticsearch mapping, click the *Refresh* button to refresh the field list from Elasticsearch.
 * Index patterns with thousands of fields can exceed the default maximum payload size.
-Increase <<settings, `server.maxPayloadBytes`>> for large index patterns.
+Increase <<settings, `server.maxPayload`>> for large index patterns.
 
 [float]
 ==== Features are not displayed
diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 90e813afad6f44..a7af5901363557 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -25,12 +25,12 @@ which may cause a delay before pages start being served.
 Set to `false` to disable Console. *Default: `true`*
 
 | `cpu.cgroup.path.override:`
- | deprecated:[7.10.0,"This setting will no longer be supported as of 8.0."]
+ | deprecated:[7.10.0,"In 8.0 and later, this setting will no longer be supported."]
  This setting has been renamed to
  <<ops-cGroupOverrides-cpuPath,`ops.cGroupOverrides.cpuPath`>>.
 
 | `cpuacct.cgroup.path.override:`
- | deprecated:[7.10.0,"This setting will no longer be supported as of 8.0."]
+ | deprecated:[7.10.0,"In 8.0 and later, this setting will no longer be supported."]
  This setting has been renamed to
  <<ops-cGroupOverrides-cpuAcctPath, `ops.cGroupOverrides.cpuAcctPath`>>.
 
@@ -473,7 +473,7 @@ confident your server can hold this many objects in memory.
  | The maximum byte size of a saved objects import that the {kib} server will accept.
 This setting exists to prevent the {kib} server from runnning out of memory when handling
 a large import payload. Note that this setting overrides the more general
-<<server-maxPayloadBytes, `server.maxPayloadBytes`>> for saved object imports only.
+<<server-maxPayload, `server.maxPayload`>> for saved object imports only.
 *Default: `26214400`*
 
 |[[server-basePath]] `server.basePath:`
@@ -504,6 +504,55 @@ deprecation warning at startup. This setting cannot end in a slash (`/`).
 proxy sitting in front of it. This determines whether HTTP compression may be used for responses, based on the request `Referer` header.
 This setting may not be used when <<server-compression, `server.compression.enabled`>> is set to `false`. *Default: `none`*
 
+
+a| [[server-securityResponseHeaders-strictTransportSecurity]]
+----
+server.securityResponseHeaders:
+  strictTransportSecurity:
+----
+| Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security[`Strict-Transport-Security`]
+header is used in all responses to the client from the {kib} server, and specifies what value is used. Allowed values are any text value or
+`null`. To disable, set to `null`. *Default:* `null`
+
+a| [[server-securityResponseHeaders-xContentTypeOptions]]
+----
+server.securityResponseHeaders:
+  xContentTypeOptions:
+----
+| Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options[`X-Content-Type-Options`] header is
+used in all responses to the client from the {kib} server, and specifies what value is used. Allowed values are `nosniff` or `null`. To
+disable, set to `null`. *Default:* `"nosniff"`
+
+a| [[server-securityResponseHeaders-referrerPolicy]]
+----
+server.securityResponseHeaders:
+  referrerPolicy:
+----
+| Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy[`Referrer-Policy`] header is used in all
+responses to the client from the {kib} server, and specifies what value is used. Allowed values are `no-referrer`,
+`no-referrer-when-downgrade`, `origin`, `origin-when-cross-origin`, `same-origin`, `strict-origin`, `strict-origin-when-cross-origin`,
+`unsafe-url`, or `null`. To disable, set to `null`. *Default:* `"no-referrer-when-downgrade"`
+
+a| [[server-securityResponseHeaders-permissionsPolicy]]
+----
+server.securityResponseHeaders:
+  permissionsPolicy:
+----
+| experimental[] Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy[`Permissions-Policy`] header
+is used in all responses to the client from the {kib} server, and specifies what value is used. Allowed values are any text value or `null`.
+To disable, set to `null`. *Default:* `null`
+
+a| [[server-securityResponseHeaders-disableEmbedding]]
+----
+server.securityResponseHeaders:
+  disableEmbedding:
+----
+| Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy[`Content-Security-Policy`] and
+https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options[`X-Frame-Options`] headers are configured to disable embedding
+{kib} in other webpages using iframes. When set to `true`, secure headers are used to disable embedding, which adds the `frame-ancestors:
+'self'` directive to the `Content-Security-Policy` response header (if you are using the default CSP rules), and adds the `X-Frame-Options:
+SAMEORIGIN` response header. *Default:* `false`
+
 | `server.customResponseHeaders:` {ess-icon}
  | Header names and values to
 send on all responses to the client from the {kib} server. *Default: `{}`*
@@ -517,6 +566,10 @@ back end server. To allow remote users to connect, set the value to the IP addre
 the <<server-socketTimeout, `server.socketTimeout`>> counter. *Default: `"120000"`*
 
 |[[server-maxPayloadBytes]] `server.maxPayloadBytes:`
+ | deprecated:[7.13.0,"In 8.0 and later, this setting will no longer be supported."]
+ This setting has been renamed to <<server-maxPayload,`server.maxPayload`>>.
+
+|[[server-maxPayload]] `server.maxPayload:`
  | The maximum payload size in bytes
 for incoming server requests. *Default: `1048576`*
 
diff --git a/docs/user/alerting/action-types.asciidoc b/docs/user/alerting/action-types.asciidoc
deleted file mode 100644
index b648f5a9ccde53..00000000000000
--- a/docs/user/alerting/action-types.asciidoc
+++ /dev/null
@@ -1,75 +0,0 @@
-[role="xpack"]
-[[action-types]]
-== Connectors and actions
-
-Connectors provide a central place to store connection information for services and integrations with third party systems. Actions are instantiations of a connector that are linked to rules and run as background tasks on the {kib} server when rule conditions are met. {kib} provides the following types of connectors:
-
-[cols="2"]
-|===
-
-a| <<email-action-type, Email>>
-
-| Send email from your server.
-
-a| <<resilient-action-type, IBM Resilient>>
-
-| Create an incident in IBM Resilient.
-
-a| <<index-action-type, Index>>
-
-| Index data into Elasticsearch.
-
-a| <<jira-action-type, Jira>>
-
-| Create an incident in Jira.
-
-a| <<teams-action-type, Microsoft Teams>>
-
-| Send a message to a Microsoft Teams channel.
-
-a| <<pagerduty-action-type, PagerDuty>>
-
-| Send an event in PagerDuty.
-
-a| <<server-log-action-type, ServerLog>>
-
-| Add a message to a Kibana log.
-
-a| <<servicenow-action-type, ServiceNow>>
-
-| Create an incident in ServiceNow.
-
-a| <<slack-action-type, Slack>>
-
-| Send a message to a Slack channel or user.
-
-a| <<webhook-action-type, Webhook>>
-
-| Send a request to a web service.
-|===
-
-[NOTE]
-==============================================
-Some connector types are paid commercial features, while others are free.
-For a comparison of the Elastic subscription levels,
-see https://www.elastic.co/subscriptions[the subscription page].
-==============================================
-
-[float]
-[[create-connectors]]
-=== Preconfigured connectors
-
-For out-of-the-box and standardized connectors, you can <<preconfigured-connector-example, preconfigure connectors>>
-before {kib} starts.
-
-include::action-types/email.asciidoc[]
-include::action-types/resilient.asciidoc[]
-include::action-types/index.asciidoc[]
-include::action-types/jira.asciidoc[]
-include::action-types/teams.asciidoc[]
-include::action-types/pagerduty.asciidoc[]
-include::action-types/server-log.asciidoc[]
-include::action-types/servicenow.asciidoc[]
-include::action-types/slack.asciidoc[]
-include::action-types/webhook.asciidoc[]
-include::action-types/pre-configured-connectors.asciidoc[]
diff --git a/docs/user/alerting/alerting-getting-started.asciidoc b/docs/user/alerting/alerting-getting-started.asciidoc
index 2c8985075398e4..bb11d2a0be4233 100644
--- a/docs/user/alerting/alerting-getting-started.asciidoc
+++ b/docs/user/alerting/alerting-getting-started.asciidoc
@@ -5,7 +5,7 @@
 
 --
 
-Alerting allows you to define *rules* to detect complex conditions within different {kib} apps and trigger actions when those conditions are met. Alerting is integrated with {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <<geo-alerting,*Maps*>> and {ml-docs}/ml-configuring-alerts.html[*{ml-app}*], can be centrally managed from the <<management,*Management*>> UI, and provides a set of built-in <<action-types, connectors>> and <<rule-types, rules>> (known as stack rules) for you to use.
+Alerting allows you to define *rules* to detect complex conditions within different {kib} apps and trigger actions when those conditions are met. Alerting is integrated with {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <<geo-alerting,*Maps*>> and {ml-docs}/ml-configuring-alerts.html[*{ml-app}*], can be centrally managed from the <<management,*Management*>> UI, and provides a set of built-in <<action-types, connectors>> and <<stack-rules, rules>> (known as stack rules) for you to use.
 
 image::images/alerting-overview.png[Rules and Connectors UI]
 
@@ -47,7 +47,7 @@ to control the details of the conditions to detect.
 
 For example, an <<rule-type-index-threshold, index threshold rule type>> lets you specify the index to query, an aggregation field, and a time window, but the details of the underlying {es} query are hidden.
 
-See <<rule-types>> for the types of rules provided by {kib} and how they express their conditions.
+See <<stack-rules>> and <<domain-specific-rules>> for the types of rules provided by {kib} and how they express their conditions.
 
 [float]
 [[alerting-concepts-scheduling]]
diff --git a/docs/user/alerting/domain-specific-rules.asciidoc b/docs/user/alerting/domain-specific-rules.asciidoc
new file mode 100644
index 00000000000000..f509f9e5288234
--- /dev/null
+++ b/docs/user/alerting/domain-specific-rules.asciidoc
@@ -0,0 +1,20 @@
+[role="xpack"]
+[[domain-specific-rules]]
+== Domain-specific rules
+
+For domain-specific rules, refer to the documentation for that app.
+{kib} supports these rules:
+
+* {observability-guide}/create-alerts.html[Observability rules]
+* {security-guide}/prebuilt-rules.html[Security rules]
+* <<geo-alerting, Maps rules>>
+* {ml-docs}/ml-configuring-alerts.html[{ml-cap} rules] beta:[]
+
+[NOTE]
+==============================================
+Some rule types are subscription features, while others are free features.
+For a comparison of the Elastic subscription levels,
+see {subscriptions}[the subscription page].
+==============================================
+
+include::map-rules/geo-rule-types.asciidoc[]
diff --git a/docs/management/alerting/images/bulk-mute-disable.png b/docs/user/alerting/images/bulk-mute-disable.png
similarity index 100%
rename from docs/management/alerting/images/bulk-mute-disable.png
rename to docs/user/alerting/images/bulk-mute-disable.png
diff --git a/docs/management/alerting/images/follower_indices.png b/docs/user/alerting/images/follower_indices.png
similarity index 100%
rename from docs/management/alerting/images/follower_indices.png
rename to docs/user/alerting/images/follower_indices.png
diff --git a/docs/management/alerting/images/individual-mute-disable.png b/docs/user/alerting/images/individual-mute-disable.png
similarity index 100%
rename from docs/management/alerting/images/individual-mute-disable.png
rename to docs/user/alerting/images/individual-mute-disable.png
diff --git a/docs/management/alerting/images/rule-details-alert-muting.png b/docs/user/alerting/images/rule-details-alert-muting.png
similarity index 100%
rename from docs/management/alerting/images/rule-details-alert-muting.png
rename to docs/user/alerting/images/rule-details-alert-muting.png
diff --git a/docs/management/alerting/images/rule-details-alerts-active.png b/docs/user/alerting/images/rule-details-alerts-active.png
similarity index 100%
rename from docs/management/alerting/images/rule-details-alerts-active.png
rename to docs/user/alerting/images/rule-details-alerts-active.png
diff --git a/docs/management/alerting/images/rule-details-alerts-inactive.png b/docs/user/alerting/images/rule-details-alerts-inactive.png
similarity index 100%
rename from docs/management/alerting/images/rule-details-alerts-inactive.png
rename to docs/user/alerting/images/rule-details-alerts-inactive.png
diff --git a/docs/management/alerting/images/rule-details-disabling.png b/docs/user/alerting/images/rule-details-disabling.png
similarity index 100%
rename from docs/management/alerting/images/rule-details-disabling.png
rename to docs/user/alerting/images/rule-details-disabling.png
diff --git a/docs/management/alerting/images/rule-details-muting.png b/docs/user/alerting/images/rule-details-muting.png
similarity index 100%
rename from docs/management/alerting/images/rule-details-muting.png
rename to docs/user/alerting/images/rule-details-muting.png
diff --git a/docs/user/alerting/images/rules-and-connectors-ui.png b/docs/user/alerting/images/rules-and-connectors-ui.png
new file mode 100644
index 00000000000000..3a464fa7cf3755
Binary files /dev/null and b/docs/user/alerting/images/rules-and-connectors-ui.png differ
diff --git a/docs/management/alerting/images/rules-filter-by-action-type.png b/docs/user/alerting/images/rules-filter-by-action-type.png
similarity index 100%
rename from docs/management/alerting/images/rules-filter-by-action-type.png
rename to docs/user/alerting/images/rules-filter-by-action-type.png
diff --git a/docs/management/alerting/images/rules-filter-by-search.png b/docs/user/alerting/images/rules-filter-by-search.png
similarity index 100%
rename from docs/management/alerting/images/rules-filter-by-search.png
rename to docs/user/alerting/images/rules-filter-by-search.png
diff --git a/docs/management/alerting/images/rules-filter-by-type.png b/docs/user/alerting/images/rules-filter-by-type.png
similarity index 100%
rename from docs/management/alerting/images/rules-filter-by-type.png
rename to docs/user/alerting/images/rules-filter-by-type.png
diff --git a/docs/user/alerting/index.asciidoc b/docs/user/alerting/index.asciidoc
index a29ca1c4ca012f..f8a5aacce8f0e1 100644
--- a/docs/user/alerting/index.asciidoc
+++ b/docs/user/alerting/index.asciidoc
@@ -1,5 +1,7 @@
 include::alerting-getting-started.asciidoc[]
 include::defining-rules.asciidoc[]
-include::action-types.asciidoc[]
-include::rule-types.asciidoc[]
+include::rule-management.asciidoc[]
+include::rule-details.asciidoc[]
+include::stack-rules.asciidoc[]
+include::domain-specific-rules.asciidoc[]
 include::alerting-troubleshooting.asciidoc[]
diff --git a/docs/management/alerting/rule-details.asciidoc b/docs/user/alerting/rule-details.asciidoc
similarity index 99%
rename from docs/management/alerting/rule-details.asciidoc
rename to docs/user/alerting/rule-details.asciidoc
index a893db280c7f78..6e743595e5c33b 100644
--- a/docs/management/alerting/rule-details.asciidoc
+++ b/docs/user/alerting/rule-details.asciidoc
@@ -1,6 +1,6 @@
 [role="xpack"]
 [[rule-details]]
-=== Rule details
+== Rule details
 
 
 The *Rule details* page tells you about the state of the rule and provides granular control over the actions it is taking. 
diff --git a/docs/management/alerting/rule-management.asciidoc b/docs/user/alerting/rule-management.asciidoc
similarity index 74%
rename from docs/management/alerting/rule-management.asciidoc
rename to docs/user/alerting/rule-management.asciidoc
index b43dc9eb635e94..b908bd03b09927 100644
--- a/docs/management/alerting/rule-management.asciidoc
+++ b/docs/user/alerting/rule-management.asciidoc
@@ -1,6 +1,6 @@
 [role="xpack"]
 [[alert-management]]
-=== Managing Rules
+== Managing rules
 
 
 The *Rules* tab provides a cross-app view of alerting. Different {kib} apps like {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <<geo-alerting, *Maps*>> and <<xpack-ml, *Machine Learning*>> can offer their own rules. The *Rules* tab provides a central place to:
@@ -10,12 +10,12 @@ The *Rules* tab provides a cross-app view of alerting. Different {kib} apps like
 * Drill-down to <<rule-details, rule details>>
 
 [role="screenshot"]
-image:management/alerting/images/rules-and-connectors-ui.png[Example rule listing in the Rules and Connectors UI]
+image:images/rules-and-connectors-ui.png[Example rule listing in the Rules and Connectors UI]
 
 For more information on alerting concepts and the types of rules and connectors available, see <<alerting-getting-started>>.
 
 [float]
-==== Finding rules
+=== Finding rules
 
 The *Rules* tab lists all rules in the current space, including summary information about their execution frequency, tags, and type.
 
@@ -36,23 +36,28 @@ image::images/rules-filter-by-action-type.png[Filtering the rule list by type of
 
 [float]
 [[create-edit-rules]]
-==== Creating and editing rules
+=== Creating and editing rules
 
-Many rules must be created within the context of a {kib} app like <<metrics-app, Metrics>>, <<xpack-apm, APM>>, or <<uptime-app, Uptime>>, but others are generic. Generic rule types can be created in the *Rules* management UI by clicking the *Create* button. This will launch a flyout that guides you through selecting a rule type and configuring its properties. Refer to <<rule-types>> for details on what types of rules are available and how to configure them.
+Many rules must be created within the context of a {kib} app like <<metrics-app, Metrics>>, <<xpack-apm, APM>>, or <<uptime-app, Uptime>>, but others are generic. Generic rule types can be created in the *Rules* management UI by clicking the *Create* button. This will launch a flyout that guides you through selecting a rule type and configuring its properties. Refer to <<stack-rules>> for details on what types of rules are available and how to configure them.
 
 After a rule is created, you can re-open the flyout and change a rule's properties by clicking the *Edit* button shown on each row of the rule listing.
 
 
 [float]
 [[controlling-rules]]
-==== Controlling rules
+=== Controlling rules
 
 The rule listing allows you to quickly mute/unmute, disable/enable, and delete individual rules by clicking the action button. 
 
 [role="screenshot"]
-image:management/alerting/images/individual-mute-disable.png[The actions button allows an individual rule to be muted, disabled, or deleted]
+image:images/individual-mute-disable.png[The actions button allows an individual rule to be muted, disabled, or deleted]
 
 These operations can also be performed in bulk by multi-selecting rules and clicking the *Manage rules* button:
 
 [role="screenshot"]
-image:management/alerting/images/bulk-mute-disable.png[The Manage rules button lets you mute/unmute, enable/disable, and delete in bulk]
+image:images/bulk-mute-disable.png[The Manage rules button lets you mute/unmute, enable/disable, and delete in bulk]
+
+[float]
+=== Required permissions
+
+Access to rules is granted based on your privileges to alerting-enabled features. See <<alerting-security, Alerting Security>> for more information.
diff --git a/docs/user/alerting/rule-types.asciidoc b/docs/user/alerting/stack-rules.asciidoc
similarity index 58%
rename from docs/user/alerting/rule-types.asciidoc
rename to docs/user/alerting/stack-rules.asciidoc
index 44a22c548757cc..483834c78806e2 100644
--- a/docs/user/alerting/rule-types.asciidoc
+++ b/docs/user/alerting/stack-rules.asciidoc
@@ -1,14 +1,11 @@
 [role="xpack"]
-[[rule-types]]
-== Rules
+[[stack-rules]]
+== Stack rule types
 
 Kibana provides two types of rules:
 
 * Stack rules, which are built into {kib}
-* Domain-specific rules, which are registered by {kib} apps.
-
-[float]
-==== Standard stack rules
+* <<domain-specific-rules, Domain-specific rules>>, which are registered by {kib} apps.
 
 {kib} provides two stack rules: 
 
@@ -18,17 +15,6 @@ Kibana provides two types of rules:
 Users require the `all` privilege to access the *Stack Rules* feature and create and edit rules.
 See <<kibana-feature-privileges, feature privileges>> for more information.
 
-[float]
-==== Domain-specific rules
-
-For domain-specific rules, refer to the documentation for that app.
-{kib} supports these rules:
-
-* {observability-guide}/create-alerts.html[Observability rules]
-* {security-guide}/prebuilt-rules.html[Security rules]
-* <<geo-alerting, Maps rules>>
-* {ml-docs}/ml-configuring-alerts.html[{ml-cap} rules] beta:[]
-
 [NOTE]
 ==============================================
 Some rule types are subscription features, while others are free features.
@@ -39,4 +25,3 @@ see {subscriptions}[the subscription page].
 
 include::stack-rules/index-threshold.asciidoc[]
 include::stack-rules/es-query.asciidoc[]
-include::map-rules/geo-rule-types.asciidoc[]
diff --git a/docs/user/index.asciidoc b/docs/user/index.asciidoc
index 81ded1e54d8fdb..47d86004fdc664 100644
--- a/docs/user/index.asciidoc
+++ b/docs/user/index.asciidoc
@@ -29,6 +29,8 @@ include::ml/index.asciidoc[]
 
 include::graph/index.asciidoc[]
 
+include::alerting/index.asciidoc[]
+
 include::{kib-repo-dir}/observability/index.asciidoc[]
 
 include::{kib-repo-dir}/apm/index.asciidoc[]
@@ -45,8 +47,6 @@ include::{kib-repo-dir}/fleet/fleet.asciidoc[]
 
 include::reporting/index.asciidoc[]
 
-include::alerting/index.asciidoc[]
-
 include::api.asciidoc[]
 
 include::plugins.asciidoc[]
diff --git a/docs/user/management.asciidoc b/docs/user/management.asciidoc
index 7c73a80362eb6f..83e18734f65d43 100644
--- a/docs/user/management.asciidoc
+++ b/docs/user/management.asciidoc
@@ -78,9 +78,9 @@ You can add and remove remote clusters, and check their connectivity.
 [cols="50, 50"]
 |===
 
-| <<managing-alerts-and-actions, Rules&nbsp;and Connectors>>
-| Centrally manage your rules across {kib}. Create and manage reusable
-connectors for triggering actions.
+| <<alerting-getting-started, Rules&nbsp;and Connectors>>
+| Centrally <<alert-management, manage your rules>> across {kib}. Create and <<connector-management, manage reusable
+connectors>> for triggering actions.
 
 | <<reporting-getting-started, Reporting>>
 | Monitor the generation of reports&mdash;PDF, PNG, and CSV&mdash;and download reports that you previously generated.
@@ -182,16 +182,10 @@ next major version of {es}, and then reindex, if needed.
 
 include::{kib-repo-dir}/management/advanced-options.asciidoc[]
 
-include::{kib-repo-dir}/management/alerting/rules-and-connectors-intro.asciidoc[]
-
-include::{kib-repo-dir}/management/alerting/rule-management.asciidoc[]
-
-include::{kib-repo-dir}/management/alerting/rule-details.asciidoc[]
-
-include::{kib-repo-dir}/management/alerting/connector-management.asciidoc[]
-
 include::{kib-repo-dir}/management/managing-beats.asciidoc[]
 
+include::{kib-repo-dir}/management/action-types.asciidoc[]
+
 include::{kib-repo-dir}/management/managing-fields.asciidoc[]
 
 include::{kib-repo-dir}/management/managing-licenses.asciidoc[]
@@ -202,14 +196,14 @@ include::{kib-repo-dir}/management/rollups/create_and_manage_rollups.asciidoc[]
 
 include::{kib-repo-dir}/management/managing-saved-objects.asciidoc[]
 
-include::{kib-repo-dir}/management/managing-tags.asciidoc[]
-
 include::security/index.asciidoc[]
 
 include::{kib-repo-dir}/management/snapshot-restore/index.asciidoc[]
 
 include::{kib-repo-dir}/spaces/index.asciidoc[]
 
+include::{kib-repo-dir}/management/managing-tags.asciidoc[]
+
 include::{kib-repo-dir}/management/upgrade-assistant/index.asciidoc[]
 
 include::{kib-repo-dir}/management/watcher-ui/index.asciidoc[]
diff --git a/docs/user/monitoring/kibana-alerts.asciidoc b/docs/user/monitoring/kibana-alerts.asciidoc
index 2944921edd2eea..58bf419d8d54a9 100644
--- a/docs/user/monitoring/kibana-alerts.asciidoc
+++ b/docs/user/monitoring/kibana-alerts.asciidoc
@@ -20,7 +20,7 @@ analyze past performance. You can also modify active alerts.
 image::user/monitoring/images/monitoring-kibana-alerts.png["Kibana alerts in the Stack Monitoring app"]
 
 To review and modify all the available alerts, use
-<<managing-alerts-and-actions,*{alerts-ui}*>> in *{stack-manage-app}*.
+<<alert-management,*{alerts-ui}*>> in *{stack-manage-app}*.
 
 [discrete]
 [[kibana-alerts-cpu-threshold]]
diff --git a/examples/search_examples/public/index.scss b/examples/search_examples/public/index.scss
index e69de29bb2d1d6..b623fecf78640f 100644
--- a/examples/search_examples/public/index.scss
+++ b/examples/search_examples/public/index.scss
@@ -0,0 +1,6 @@
+@import '@elastic/eui/src/global_styling/variables/header';
+
+.searchExampleStepDsc {
+  padding-left: $euiSizeXL;
+  font-style: italic;
+}
diff --git a/examples/search_examples/public/search/app.tsx b/examples/search_examples/public/search/app.tsx
index 8f31d242faf5ea..65d939088515a9 100644
--- a/examples/search_examples/public/search/app.tsx
+++ b/examples/search_examples/public/search/app.tsx
@@ -20,13 +20,13 @@ import {
   EuiTitle,
   EuiText,
   EuiFlexGrid,
-  EuiFlexGroup,
   EuiFlexItem,
   EuiCheckbox,
   EuiSpacer,
   EuiCode,
   EuiComboBox,
   EuiFormLabel,
+  EuiTabbedContent,
 } from '@elastic/eui';
 
 import { CoreStart } from '../../../../src/core/public';
@@ -60,6 +60,11 @@ function getNumeric(fields?: IndexPatternField[]) {
   return fields?.filter((f) => f.type === 'number' && f.aggregatable);
 }
 
+function getAggregatableStrings(fields?: IndexPatternField[]) {
+  if (!fields) return [];
+  return fields?.filter((f) => f.type === 'string' && f.aggregatable);
+}
+
 function formatFieldToComboBox(field?: IndexPatternField | null) {
   if (!field) return [];
   return formatFieldsToComboBox([field]);
@@ -90,6 +95,9 @@ export const SearchExamplesApp = ({
   const [selectedNumericField, setSelectedNumericField] = useState<
     IndexPatternField | null | undefined
   >();
+  const [selectedBucketField, setSelectedBucketField] = useState<
+    IndexPatternField | null | undefined
+  >();
   const [request, setRequest] = useState<Record<string, any>>({});
   const [response, setResponse] = useState<Record<string, any>>({});
 
@@ -108,6 +116,7 @@ export const SearchExamplesApp = ({
     setFields(indexPattern?.fields);
   }, [indexPattern]);
   useEffect(() => {
+    setSelectedBucketField(fields?.length ? getAggregatableStrings(fields)[0] : null);
     setSelectedNumericField(fields?.length ? getNumeric(fields)[0] : null);
   }, [fields]);
 
@@ -186,7 +195,7 @@ export const SearchExamplesApp = ({
       });
   };
 
-  const doSearchSourceSearch = async () => {
+  const doSearchSourceSearch = async (otherBucket: boolean) => {
     if (!indexPattern) return;
 
     const query = data.query.queryString.getQuery();
@@ -203,28 +212,40 @@ export const SearchExamplesApp = ({
         .setField('index', indexPattern)
         .setField('filter', filters)
         .setField('query', query)
-        .setField('fields', selectedFields.length ? selectedFields.map((f) => f.name) : ['*'])
+        .setField('fields', selectedFields.length ? selectedFields.map((f) => f.name) : [''])
+        .setField('size', selectedFields.length ? 100 : 0)
         .setField('trackTotalHits', 100);
 
-      if (selectedNumericField) {
-        searchSource.setField('aggs', () => {
-          return data.search.aggs
-            .createAggConfigs(indexPattern, [
-              { type: 'avg', params: { field: selectedNumericField.name } },
-            ])
-            .toDsl();
+      const aggDef = [];
+      if (selectedBucketField) {
+        aggDef.push({
+          type: 'terms',
+          schema: 'split',
+          params: { field: selectedBucketField.name, size: 2, otherBucket },
         });
       }
+      if (selectedNumericField) {
+        aggDef.push({ type: 'avg', params: { field: selectedNumericField.name } });
+      }
+      if (aggDef.length > 0) {
+        const ac = data.search.aggs.createAggConfigs(indexPattern, aggDef);
+        searchSource.setField('aggs', ac);
+      }
 
       setRequest(searchSource.getSearchRequestBody());
       const res = await searchSource.fetch$().toPromise();
       setResponse(res);
 
       const message = <EuiText>Searched {res.hits.total} documents.</EuiText>;
-      notifications.toasts.addSuccess({
-        title: 'Query result',
-        text: mountReactNode(message),
-      });
+      notifications.toasts.addSuccess(
+        {
+          title: 'Query result',
+          text: mountReactNode(message),
+        },
+        {
+          toastLifeTimeMs: 300000,
+        }
+      );
     } catch (e) {
       setResponse(e.body);
       notifications.toasts.addWarning(`An error has occurred: ${e.message}`);
@@ -259,10 +280,59 @@ export const SearchExamplesApp = ({
     }
   };
 
-  const onSearchSourceClickHandler = () => {
-    doSearchSourceSearch();
+  const onSearchSourceClickHandler = (withOtherBucket: boolean) => {
+    doSearchSourceSearch(withOtherBucket);
   };
 
+  const reqTabs = [
+    {
+      id: 'request',
+      name: <EuiText data-test-subj="requestTab">Request</EuiText>,
+      content: (
+        <>
+          <EuiSpacer />
+          <EuiText size="xs">Search body sent to ES</EuiText>
+          <EuiCodeBlock
+            language="json"
+            fontSize="s"
+            paddingSize="s"
+            overflowHeight={450}
+            isCopyable
+            data-test-subj="requestCodeBlock"
+          >
+            {JSON.stringify(request, null, 2)}
+          </EuiCodeBlock>
+        </>
+      ),
+    },
+    {
+      id: 'response',
+      name: <EuiText data-test-subj="responseTab">Response</EuiText>,
+      content: (
+        <>
+          <EuiSpacer />
+          <EuiText size="xs">
+            <FormattedMessage
+              id="searchExamples.timestampText"
+              defaultMessage="Took: {time} ms"
+              values={{ time: timeTook ?? 'Unknown' }}
+            />
+          </EuiText>
+          <EuiCodeBlock
+            language="json"
+            fontSize="s"
+            paddingSize="s"
+            overflowHeight={450}
+            isCopyable
+            data-test-subj="responseCodeBlock"
+          >
+            {JSON.stringify(response, null, 2)}
+          </EuiCodeBlock>
+        </>
+      ),
+    },
+  ];
+
   return (
     <EuiPageBody>
       <EuiPageHeader>
@@ -284,59 +354,76 @@ export const SearchExamplesApp = ({
             useDefaultBehaviors={true}
             indexPatterns={indexPattern ? [indexPattern] : undefined}
           />
-          <EuiFlexGrid columns={3}>
+          <EuiFlexGrid columns={4}>
+            <EuiFlexItem>
+              <EuiFormLabel>Index Pattern</EuiFormLabel>
+              <IndexPatternSelect
+                placeholder={i18n.translate('searchSessionExample.selectIndexPatternPlaceholder', {
+                  defaultMessage: 'Select index pattern',
+                })}
+                indexPatternId={indexPattern?.id || ''}
+                onChange={async (newIndexPatternId: any) => {
+                  const newIndexPattern = await data.indexPatterns.get(newIndexPatternId);
+                  setIndexPattern(newIndexPattern);
+                }}
+                isClearable={false}
+                data-test-subj="indexPatternSelector"
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiFormLabel>Field (bucket)</EuiFormLabel>
+              <EuiComboBox
+                options={formatFieldsToComboBox(getAggregatableStrings(fields))}
+                selectedOptions={formatFieldToComboBox(selectedBucketField)}
+                singleSelection={true}
+                onChange={(option) => {
+                  if (option.length) {
+                    const fld = indexPattern?.getFieldByName(option[0].label);
+                    setSelectedBucketField(fld || null);
+                  } else {
+                    setSelectedBucketField(null);
+                  }
+                }}
+                sortMatchesBy="startsWith"
+                data-test-subj="searchBucketField"
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiFormLabel>Numeric Field (metric)</EuiFormLabel>
+              <EuiComboBox
+                options={formatFieldsToComboBox(getNumeric(fields))}
+                selectedOptions={formatFieldToComboBox(selectedNumericField)}
+                singleSelection={true}
+                onChange={(option) => {
+                  if (option.length) {
+                    const fld = indexPattern?.getFieldByName(option[0].label);
+                    setSelectedNumericField(fld || null);
+                  } else {
+                    setSelectedNumericField(null);
+                  }
+                }}
+                sortMatchesBy="startsWith"
+                data-test-subj="searchMetricField"
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiFormLabel>Fields to queryString</EuiFormLabel>
+              <EuiComboBox
+                options={formatFieldsToComboBox(fields)}
+                selectedOptions={formatFieldsToComboBox(selectedFields)}
+                singleSelection={false}
+                onChange={(option) => {
+                  const flds = option
+                    .map((opt) => indexPattern?.getFieldByName(opt?.label))
+                    .filter((f) => f);
+                  setSelectedFields(flds.length ? (flds as IndexPatternField[]) : []);
+                }}
+                sortMatchesBy="startsWith"
+              />
+            </EuiFlexItem>
+          </EuiFlexGrid>
+          <EuiFlexGrid columns={2}>
             <EuiFlexItem style={{ width: '40%' }}>
-              <EuiText>
-                <EuiFlexGrid columns={2}>
-                  <EuiFlexItem>
-                    <EuiFormLabel>Index Pattern</EuiFormLabel>
-                    <IndexPatternSelect
-                      placeholder={i18n.translate(
-                        'searchSessionExample.selectIndexPatternPlaceholder',
-                        {
-                          defaultMessage: 'Select index pattern',
-                        }
-                      )}
-                      indexPatternId={indexPattern?.id || ''}
-                      onChange={async (newIndexPatternId: any) => {
-                        const newIndexPattern = await data.indexPatterns.get(newIndexPatternId);
-                        setIndexPattern(newIndexPattern);
-                      }}
-                      isClearable={false}
-                    />
-                  </EuiFlexItem>
-                  <EuiFlexItem>
-                    <EuiFormLabel>Numeric Field to Aggregate</EuiFormLabel>
-                    <EuiComboBox
-                      options={formatFieldsToComboBox(getNumeric(fields))}
-                      selectedOptions={formatFieldToComboBox(selectedNumericField)}
-                      singleSelection={true}
-                      onChange={(option) => {
-                        const fld = indexPattern?.getFieldByName(option[0].label);
-                        setSelectedNumericField(fld || null);
-                      }}
-                      sortMatchesBy="startsWith"
-                    />
-                  </EuiFlexItem>
-                </EuiFlexGrid>
-                <EuiFlexGroup>
-                  <EuiFlexItem>
-                    <EuiFormLabel>Fields to query (leave blank to include all fields)</EuiFormLabel>
-                    <EuiComboBox
-                      options={formatFieldsToComboBox(fields)}
-                      selectedOptions={formatFieldsToComboBox(selectedFields)}
-                      singleSelection={false}
-                      onChange={(option) => {
-                        const flds = option
-                          .map((opt) => indexPattern?.getFieldByName(opt?.label))
-                          .filter((f) => f);
-                        setSelectedFields(flds.length ? (flds as IndexPatternField[]) : []);
-                      }}
-                      sortMatchesBy="startsWith"
-                    />
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-              </EuiText>
               <EuiSpacer />
               <EuiTitle size="s">
                 <h3>
@@ -352,15 +439,49 @@ export const SearchExamplesApp = ({
                 <EuiButtonEmpty size="xs" onClick={onClickHandler} iconType="play">
                   <FormattedMessage
                     id="searchExamples.buttonText"
-                    defaultMessage="Request from low-level client (data.search.search)"
+                    defaultMessage="Request from low-level client (data.search.search)."
+                  />
+                </EuiButtonEmpty>
+                <EuiText size="xs" color="subdued" className="searchExampleStepDsc">
+                  <FormattedMessage
+                    id="searchExamples.buttonText"
+                    defaultMessage="Metrics aggregation with raw documents in response."
+                  />
+                </EuiText>
+                <EuiButtonEmpty
+                  size="xs"
+                  onClick={() => onSearchSourceClickHandler(true)}
+                  iconType="play"
+                  data-test-subj="searchSourceWithOther"
+                >
+                  <FormattedMessage
+                    id="searchExamples.searchSource.buttonText"
+                    defaultMessage="Request from high-level client (data.search.searchSource)"
                   />
                 </EuiButtonEmpty>
-                <EuiButtonEmpty size="xs" onClick={onSearchSourceClickHandler} iconType="play">
+                <EuiText size="xs" color="subdued" className="searchExampleStepDsc">
+                  <FormattedMessage
+                    id="searchExamples.buttonText"
+                    defaultMessage="Bucket and metrics aggregations with other bucket."
+                  />
+                </EuiText>
+                <EuiButtonEmpty
+                  size="xs"
+                  onClick={() => onSearchSourceClickHandler(false)}
+                  iconType="play"
+                  data-test-subj="searchSourceWithoutOther"
+                >
                   <FormattedMessage
                     id="searchExamples.searchSource.buttonText"
                     defaultMessage="Request from high-level client (data.search.searchSource)"
                   />
                 </EuiButtonEmpty>
+                <EuiText size="xs" color="subdued" className="searchExampleStepDsc">
+                  <FormattedMessage
+                    id="searchExamples.buttonText"
+                    defaultMessage="Bucket and metrics aggregations without other bucket."
+                  />
+                </EuiText>
               </EuiText>
               <EuiSpacer />
               <EuiTitle size="s">
@@ -446,41 +567,8 @@ export const SearchExamplesApp = ({
                 </EuiButtonEmpty>
               </EuiText>
             </EuiFlexItem>
-            <EuiFlexItem style={{ width: '30%' }}>
-              <EuiTitle size="xs">
-                <h4>Request</h4>
-              </EuiTitle>
-              <EuiText size="xs">Search body sent to ES</EuiText>
-              <EuiCodeBlock
-                language="json"
-                fontSize="s"
-                paddingSize="s"
-                overflowHeight={450}
-                isCopyable
-              >
-                {JSON.stringify(request, null, 2)}
-              </EuiCodeBlock>
-            </EuiFlexItem>
-            <EuiFlexItem style={{ width: '30%' }}>
-              <EuiTitle size="xs">
-                <h4>Response</h4>
-              </EuiTitle>
-              <EuiText size="xs">
-                <FormattedMessage
-                  id="searchExamples.timestampText"
-                  defaultMessage="Took: {time} ms"
-                  values={{ time: timeTook ?? 'Unknown' }}
-                />
-              </EuiText>
-              <EuiCodeBlock
-                language="json"
-                fontSize="s"
-                paddingSize="s"
-                overflowHeight={450}
-                isCopyable
-              >
-                {JSON.stringify(response, null, 2)}
-              </EuiCodeBlock>
+            <EuiFlexItem style={{ width: '60%' }}>
+              <EuiTabbedContent tabs={reqTabs} />
             </EuiFlexItem>
           </EuiFlexGrid>
         </EuiPageContentBody>
diff --git a/package.json b/package.json
index c6f33d263df84a..23241a37ffe476 100644
--- a/package.json
+++ b/package.json
@@ -176,17 +176,6 @@
     "angular-sortable-view": "^0.0.17",
     "angular-ui-ace": "0.2.3",
     "antlr4ts": "^0.5.0-alpha.3",
-    "apollo-cache-inmemory": "1.6.2",
-    "apollo-client": "^2.3.8",
-    "apollo-link": "^1.2.3",
-    "apollo-link-error": "^1.1.7",
-    "apollo-link-http": "^1.5.16",
-    "apollo-link-http-common": "^0.2.15",
-    "apollo-link-schema": "^1.1.0",
-    "apollo-link-state": "^0.4.1",
-    "apollo-server-core": "^1.3.6",
-    "apollo-server-errors": "^2.0.2",
-    "apollo-server-hapi": "^1.3.6",
     "archiver": "^5.2.0",
     "axios": "^0.21.1",
     "base64-js": "^1.3.1",
@@ -243,9 +232,7 @@
     "glob-all": "^3.2.1",
     "globby": "^11.0.3",
     "graphql": "^0.13.2",
-    "graphql-fields": "^1.0.2",
     "graphql-tag": "^2.10.3",
-    "graphql-tools": "^3.0.2",
     "handlebars": "4.7.7",
     "he": "^1.2.0",
     "history": "^4.9.0",
@@ -333,7 +320,6 @@
     "re2": "^1.15.4",
     "react": "^16.12.0",
     "react-ace": "^5.9.0",
-    "react-apollo": "^2.1.4",
     "react-beautiful-dnd": "^13.0.0",
     "react-color": "^2.13.8",
     "react-datetime": "^2.14.0",
@@ -348,7 +334,7 @@
     "react-moment-proptypes": "^1.7.0",
     "react-monaco-editor": "^0.41.2",
     "react-popper-tooltip": "^2.10.1",
-    "react-query": "^3.12.0",
+    "react-query": "^3.13.10",
     "react-resize-detector": "^4.2.0",
     "react-reverse-portal": "^1.0.4",
     "react-router-redux": "^4.0.8",
@@ -454,7 +440,7 @@
     "@istanbuljs/schema": "^0.1.2",
     "@jest/reporters": "^26.5.2",
     "@kbn/babel-code-parser": "link:packages/kbn-babel-code-parser",
-    "@kbn/babel-preset": "link:packages/kbn-babel-preset",
+    "@kbn/babel-preset": "link:bazel-bin/packages/kbn-babel-preset/npm_module",
     "@kbn/cli-dev-mode": "link:packages/kbn-cli-dev-mode",
     "@kbn/dev-utils": "link:packages/kbn-dev-utils",
     "@kbn/docs-utils": "link:packages/kbn-docs-utils",
@@ -728,13 +714,6 @@
     "form-data": "^4.0.0",
     "geckodriver": "^1.22.2",
     "glob-watcher": "5.0.3",
-    "graphql-code-generator": "^0.18.2",
-    "graphql-codegen-add": "^0.18.2",
-    "graphql-codegen-introspection": "^0.18.2",
-    "graphql-codegen-typescript-client": "^0.18.2",
-    "graphql-codegen-typescript-common": "^0.18.2",
-    "graphql-codegen-typescript-resolvers": "^0.18.2",
-    "graphql-codegen-typescript-server": "^0.18.2",
     "grunt": "1.3.0",
     "grunt-available-tasks": "^0.6.3",
     "grunt-peg": "^2.0.1",
diff --git a/packages/BUILD.bazel b/packages/BUILD.bazel
index fe0e8efe0d44f2..e1a85e926f049d 100644
--- a/packages/BUILD.bazel
+++ b/packages/BUILD.bazel
@@ -5,6 +5,7 @@ filegroup(
   srcs = [
       "//packages/elastic-datemath:build",
       "//packages/kbn-apm-utils:build",
+      "//packages/kbn-babel-preset:build",
       "//packages/kbn-config-schema:build",
       "//packages/kbn-tinymath:build",
       "//packages/kbn-utility-types:build",
diff --git a/packages/kbn-ace/package.json b/packages/kbn-ace/package.json
index 30f37b4786f367..5b4b0312aa1aec 100644
--- a/packages/kbn-ace/package.json
+++ b/packages/kbn-ace/package.json
@@ -10,7 +10,6 @@
     "kbn:bootstrap": "yarn build --dev"
   },
   "devDependencies": {
-    "@kbn/dev-utils": "link:../kbn-dev-utils",
-    "@kbn/babel-preset": "link:../kbn-babel-preset"
+    "@kbn/dev-utils": "link:../kbn-dev-utils"
   }
 }
\ No newline at end of file
diff --git a/packages/kbn-analytics/package.json b/packages/kbn-analytics/package.json
index 715f0af96ea3e5..5b9db79febd777 100644
--- a/packages/kbn-analytics/package.json
+++ b/packages/kbn-analytics/package.json
@@ -14,7 +14,6 @@
     "kbn:watch": "node scripts/build --source-maps --watch"
   },
   "devDependencies": {
-    "@kbn/dev-utils": "link:../kbn-dev-utils",
-    "@kbn/babel-preset": "link:../kbn-babel-preset"
+    "@kbn/dev-utils": "link:../kbn-dev-utils"
   }
 }
\ No newline at end of file
diff --git a/packages/kbn-babel-code-parser/package.json b/packages/kbn-babel-code-parser/package.json
index bfe01c6eae8e38..a5e05da6f8ee47 100755
--- a/packages/kbn-babel-code-parser/package.json
+++ b/packages/kbn-babel-code-parser/package.json
@@ -13,8 +13,5 @@
     "build": "../../node_modules/.bin/babel src --out-dir target",
     "kbn:bootstrap": "yarn build --quiet",
     "kbn:watch": "yarn build --watch"
-  },
-  "dependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset"
   }
 }
diff --git a/packages/kbn-babel-preset/BUILD.bazel b/packages/kbn-babel-preset/BUILD.bazel
new file mode 100644
index 00000000000000..13542ed6e73ad4
--- /dev/null
+++ b/packages/kbn-babel-preset/BUILD.bazel
@@ -0,0 +1,63 @@
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library", "pkg_npm")
+
+PKG_BASE_NAME = "kbn-babel-preset"
+PKG_REQUIRE_NAME = "@kbn/babel-preset"
+
+SOURCE_FILES = glob([
+  "common_babel_parser_options.js",
+  "common_preset.js",
+  "istanbul_preset.js",
+  "node_preset.js",
+  "webpack_preset.js",
+])
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+  "README.md",
+]
+
+DEPS = [
+  "@npm//@babel/plugin-proposal-class-properties",
+  "@npm//@babel/plugin-proposal-export-namespace-from",
+  "@npm//@babel/plugin-proposal-nullish-coalescing-operator",
+  "@npm//@babel/plugin-proposal-optional-chaining",
+  "@npm//@babel/plugin-proposal-private-methods",
+  "@npm//@babel/preset-env",
+  "@npm//@babel/preset-react",
+  "@npm//@babel/preset-typescript",
+  "@npm//babel-plugin-add-module-exports",
+  "@npm//babel-plugin-styled-components",
+]
+
+js_library(
+  name = PKG_BASE_NAME,
+  srcs = [
+    ":srcs",
+  ],
+  deps = DEPS,
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = [
+    ":%s" % PKG_BASE_NAME,
+  ]
+)
+
+filegroup(
+  name = "build",
+  srcs = [
+    ":npm_module",
+  ],
+  visibility = ["//visibility:public"],
+)
diff --git a/packages/kbn-dev-utils/package.json b/packages/kbn-dev-utils/package.json
index e1990fca4e0bbf..87e142c3bece7d 100644
--- a/packages/kbn-dev-utils/package.json
+++ b/packages/kbn-dev-utils/package.json
@@ -17,7 +17,6 @@
     "@kbn/utils": "link:../kbn-utils"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/expect": "link:../kbn-expect"
   }
 }
\ No newline at end of file
diff --git a/packages/kbn-es/package.json b/packages/kbn-es/package.json
index c8fe2101bd6396..f47f042505cad0 100644
--- a/packages/kbn-es/package.json
+++ b/packages/kbn-es/package.json
@@ -14,8 +14,5 @@
   },
   "dependencies": {
     "@kbn/dev-utils": "link:../kbn-dev-utils"
-  },
-  "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset"
   }
 }
\ No newline at end of file
diff --git a/packages/kbn-i18n/package.json b/packages/kbn-i18n/package.json
index d3b4e56fe05d48..570110589490bb 100644
--- a/packages/kbn-i18n/package.json
+++ b/packages/kbn-i18n/package.json
@@ -12,7 +12,6 @@
     "kbn:watch": "node scripts/build --watch --source-maps"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/dev-utils": "link:../kbn-dev-utils"
   }
 }
\ No newline at end of file
diff --git a/packages/kbn-interpreter/package.json b/packages/kbn-interpreter/package.json
index 59a14fa8285831..491a7205be210e 100644
--- a/packages/kbn-interpreter/package.json
+++ b/packages/kbn-interpreter/package.json
@@ -13,7 +13,6 @@
     "@kbn/i18n": "link:../kbn-i18n"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/dev-utils": "link:../kbn-dev-utils"
   }
 }
\ No newline at end of file
diff --git a/packages/kbn-monaco/package.json b/packages/kbn-monaco/package.json
index bdf36915bab3ae..f4309e08f5bdb1 100644
--- a/packages/kbn-monaco/package.json
+++ b/packages/kbn-monaco/package.json
@@ -11,7 +11,6 @@
     "build:antlr4ts": "../../node_modules/antlr4ts-cli/antlr4ts ./src/painless/antlr/painless_lexer.g4 ./src/painless/antlr/painless_parser.g4 && node ./scripts/fix_generated_antlr.js"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/dev-utils": "link:../kbn-dev-utils"
   },
   "dependencies": {
diff --git a/packages/kbn-optimizer/package.json b/packages/kbn-optimizer/package.json
index ac73fbc0fc16a9..3c14d98755a32a 100644
--- a/packages/kbn-optimizer/package.json
+++ b/packages/kbn-optimizer/package.json
@@ -11,7 +11,6 @@
     "kbn:watch": "yarn build --watch"
   },
   "dependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/config": "link:../kbn-config",
     "@kbn/dev-utils": "link:../kbn-dev-utils",
     "@kbn/std": "link:../kbn-std",
diff --git a/packages/kbn-test/package.json b/packages/kbn-test/package.json
index a2dc8f84cfb513..2afbe41e0e00ec 100644
--- a/packages/kbn-test/package.json
+++ b/packages/kbn-test/package.json
@@ -19,7 +19,6 @@
     "@kbn/optimizer": "link:../kbn-optimizer"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/dev-utils": "link:../kbn-dev-utils",
     "@kbn/expect": "link:../kbn-expect",
     "@kbn/utils": "link:../kbn-utils"
diff --git a/packages/kbn-ui-shared-deps/entry.js b/packages/kbn-ui-shared-deps/entry.js
index f14c793d22a097..4029ce28faf5bf 100644
--- a/packages/kbn-ui-shared-deps/entry.js
+++ b/packages/kbn-ui-shared-deps/entry.js
@@ -49,3 +49,4 @@ export const TsLib = require('tslib');
 export const KbnAnalytics = require('@kbn/analytics');
 export const KbnStd = require('@kbn/std');
 export const SaferLodashSet = require('@elastic/safer-lodash-set');
+export const RisonNode = require('rison-node');
diff --git a/packages/kbn-ui-shared-deps/index.js b/packages/kbn-ui-shared-deps/index.js
index 0542bc89ff9e48..62ddb09d25add7 100644
--- a/packages/kbn-ui-shared-deps/index.js
+++ b/packages/kbn-ui-shared-deps/index.js
@@ -60,5 +60,6 @@ exports.externals = {
   '@kbn/analytics': '__kbnSharedDeps__.KbnAnalytics',
   '@kbn/std': '__kbnSharedDeps__.KbnStd',
   '@elastic/safer-lodash-set': '__kbnSharedDeps__.SaferLodashSet',
+  'rison-node': '__kbnSharedDeps__.RisonNode',
 };
 exports.publicPathLoader = require.resolve('./public_path_loader');
diff --git a/packages/kbn-ui-shared-deps/package.json b/packages/kbn-ui-shared-deps/package.json
index 47a2fa19e7a8ea..00c6f677cd223f 100644
--- a/packages/kbn-ui-shared-deps/package.json
+++ b/packages/kbn-ui-shared-deps/package.json
@@ -14,7 +14,6 @@
     "@kbn/monaco": "link:../kbn-monaco"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/dev-utils": "link:../kbn-dev-utils"
   }
 }
\ No newline at end of file
diff --git a/rfcs/images/url_service/new_architecture.png b/rfcs/images/url_service/new_architecture.png
new file mode 100644
index 00000000000000..9faa025d429bf8
Binary files /dev/null and b/rfcs/images/url_service/new_architecture.png differ
diff --git a/rfcs/images/url_service/old_architecture.png b/rfcs/images/url_service/old_architecture.png
new file mode 100644
index 00000000000000..fdb1c13fabf349
Binary files /dev/null and b/rfcs/images/url_service/old_architecture.png differ
diff --git a/rfcs/text/0017_url_service.md b/rfcs/text/0017_url_service.md
new file mode 100644
index 00000000000000..87a8a92c090d68
--- /dev/null
+++ b/rfcs/text/0017_url_service.md
@@ -0,0 +1,600 @@
+- Start Date: 2021-03-26
+- RFC PR: (leave this empty)
+- Kibana Issue: (leave this empty)
+
+
+# Summary
+
+Currently in the Kibana `share` plugin we have two services that deal with URLs.
+
+One is *Short URL Service*: given a long internal Kibana URL it returns an ID.
+That ID can be used to "resolve" back to the long URL and redirect the user to
+that long URL page. (The Short URL Service is now used in Dashboard, Discover,
+Visualize apps, and have a few upcoming users, for example, when sharing panels
+by Slack or e-mail we will want to use short URLs.)
+
+```ts
+// It does not have a plugin API, you can only use it through an HTTP request.
+const shortUrl = await http.post('/api/shorten_url', {
+  url: '/some/long/kibana/url/.../very?long=true#q=(rison:approved)'
+});
+```
+
+The other is the *URL Generator Service*: it simply receives an object of
+parameters and returns back a deep link within Kibana. (You can use it, for
+example, to navigate to some specific query with specific filters for a
+specific index pattern in the Discover app. As of this writing, there are
+eight registered URL generators, which are used by ten plugins.)
+
+```ts
+// You first register a URL generator.
+const myGenerator = plugins.share.registerUrlGenerator(/* ... */);
+
+// You can fetch it from the registry (if you don't already have it).
+const myGenerator = plugins.share.getUrlGenerator(/* ... */);
+
+// Now you can use it to generate a deep link into Kibana.
+const deepLink: string = myGenerator.createUrl({ /* ... */ });
+```
+
+
+## Goals of the project
+
+The proposal is to unify both of these services (Short URL Service and URL
+Generator Service) into a single new *URL Service*. The new unified service
+will still provide all the functionality the above mentioned services provide
+and in addition will implement the following improvements:
+
+1. Standardize a way for apps to deep link and navigate into other Kibana apps,
+   with ability to use *location state* to specify the state of the app which is
+   not part of the URL.
+2. Combine Short URL Service with URL Generator Service to allow short URLs to
+   be constructed from URL generators, which will also allow us to automatically
+   migrate the short URLs if the parameters of the underlying URL generator
+   change and be able to store location state in every short URL.
+3. Make the short url service easier to use. (It was previously undocumented,
+   and no server side plugin APIs existed, which meant consumers had to use
+   REST APIs which is discouraged. Merging the two services will help achieve
+   this goal by simplifying the APIs.)
+4. Support short urls being deleted (previously not possible).
+5. Support short urls being migrated (previously not possible). 
+
+See more detailed explanation and other small improvements in the "Motivation"
+section below.
+
+
+# Terminology
+
+In the proposed new service we introduce "locators". This is mostly a change
+in language, we are renaming "URL generators" to "locators". The old name would
+no longer make sense as we are not returning URLs from locators.
+
+
+# Basic example
+
+The URL Service will have a client (`UrlServiceClient`) which will have the same
+interface, both, on the server-side and the client-side. It will also have a
+documented public set of HTTP API endpoints for use by: (1) the client-side
+client; (2) external users, Elastic Cloud, and Support.
+
+The following code examples will work, both, on the server-side and the
+client-side, as the base `UrlServiceClient` interface will be similar in both
+environments.
+
+Below we consider four main examples of usage of the URL Service. All four
+examples are existing use cases we currently have in Kibana.
+
+
+## Navigating within Kibana using locators
+
+In this example let's consider a case where Discover app creates a locator,
+then another plugin uses that locator to navigate to a deep link within the
+Discover app.
+
+First, the Discover plugin creates its locator (usually one per app). It needs
+to do this on the client and server.
+
+
+```ts
+const locator = plugins.share.locators.create({
+  id: 'DISCOVER_DEEP_LINKS',
+  getLocation: ({
+    indexPattern,
+    highlightedField,
+    filters: [],
+    query: {},
+    fields: [],
+    activeDoc: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx',
+  }) => {
+    app: 'discover',
+    route: `/${indexPatten}#_a=(${risonEncode({filters, query, fields})})`,
+    state: {
+      highlightedField,
+      activeDoc,
+    },
+  },
+});
+```
+
+Now, the Discover plugin exports this locator from its plugin contract.
+
+```ts
+class DiscoverPlugin() {
+  start() {
+    return {
+      locator,
+    };
+  }
+}
+```
+
+Finally, if any other app now wants to navigate to a deep link within the
+Discover application, they use this exported locator.
+
+```ts
+plugins.discover.locator.navigate({
+  indexPattern: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+  highlightedField: 'foo',
+});
+```
+
+Note, in this example the `highlightedField` parameter will not appear in the
+URL bar, it will be passed to the Discover app through [`history.pushState()`](https://developer.mozilla.org/en-US/docs/Web/API/History/pushState)
+mechanism (in Kibana case, using the [`history`](https://www.npmjs.com/package/history) package, which is used by `core.application.navigateToApp`).
+
+
+## Sending a deep link to Kibana
+
+We have use cases were a deep link to some Kibana app is sent out, for example,
+through e-mail or as a Slack message.
+
+In this example, lets consider some plugin gets hold of the Discover locator
+on the server-side.
+
+```ts
+const location = plugins.discover.locator.getRedirectPath({
+  indexPattern: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+  highlightedField: 'foo',
+});
+```
+
+This would return the location of the client-side redirect endpoint. The redirect
+endpoint could look like this:
+
+```
+/app/goto/_redirect/DISCOVER_DEEP_LINKS?params={"indexPattern":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","highlightedField":"foo"}&paramsVersion=7.x
+```
+
+This redirect client-side endpoint would find the Discover locator and and
+execute the `.navigate()` method on it.
+
+
+## Creating a short link
+
+In this example, lets create a short link using the Discover locator.
+
+```ts
+const shortUrl = await plugins.discover.locator.createShortUrl(
+  {
+    indexPattern: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+    highlightedField: 'foo',
+  }
+  'human-readable-slug',
+});
+```
+
+The above example creates a short link and persists it in a saved object. The
+short URL can have a human-readable slug, which uniquely identifies that short
+URL.
+
+```ts
+shortUrl.slug === 'human-readable-slug'
+```
+
+The short URL can be used to navigate to the Discover app. The redirect
+client-side endpoint currently looks like this:
+
+```
+/app/goto/human-readable-slug
+```
+
+This persisted short URL would effectively work the same as the full version:
+
+```
+/app/goto/_redirect/DISCOVER_DEEP_LINKS?params={"indexPattern":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","highlightedField":"foo"}&paramsVersion=7.x
+```
+
+
+## External users navigating to a Kibana deep link
+
+Currently Elastic Cloud and Support have many links linking into Kibana. Most of
+them are deep links into Discover and Dashboard apps where, for example, index
+pattern is selected, or filters and time range are set.
+
+The external users could use the above mentioned client-side redirect endpoint
+to navigate to their desired deep location within Kibana, for example, to the
+Discover application:
+
+```
+/app/goto/_redirect/DISCOVER_DEEP_LINKS?params={"indexPattern":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","highlightedField":"foo"}&paramsVersion=7.x
+```
+
+
+# Motivation
+
+Our motivation to improve the URL services comes from us intending to use them
+more, for example, for panel sharing to Slack or e-mail; and we believe that the
+current state of the URL services needs an upgrade.
+
+
+## Limitations of the Short URL Service
+
+We have identified the following limitations in the current implementation of
+the Short URL Service:
+
+1. There is no migration system. If an application exposes this functionality,
+   every possible URL that might be generated should be supported forever. A
+   migration could be written inside the app itself, on page load, but this is a
+   risky path for URLs with many possibilities.
+   1. __Will do:__ Short URLs will be created using locators. We will use
+      migrations provided by the locators to migrate the stored parameters
+      in the short URL saved object.
+1. Short URLs store only the URL of the destination page. However, the
+   destination page might have other state which affects the display of the page
+   but is not present in the URL. Once the short URL is used to navigate to that
+   page, any state that is kept only in memory is lost.
+   1. __Will do:__ The new implementation of the short URLs will also persist
+      the location state of the URL. That state would be provided to a
+      Kibana app once a user navigates to that app using a short URL.
+1. It exposes only HTTP endpoint API.
+   1. __Will do:__ We will also expose a URL Service client through plugin
+      contract on the server and browser.
+1. It only has 3 HTTP endpoints, yet all three have different paths:
+   (1) `/short_url`, (2) `/shorten_url`; and (3) `/goto`.
+   1. __Will do:__ We will normalize the HTTP endpoints. We will use HTTP
+      method "verbs" like POST, instead of verbs in the url like "shorten_url".
+1. There is not much documentation for developers.
+   1. __Will do:__ The new service will have a much nicer API and docs.
+1. There is no way to delete short URLs once they are created.
+   1. __Will do:__ The new service will provide CRUD API to manage short URLs,
+      including deletion.
+1. Short URL service uses MD5 algorithm to hash long URLs. Security team
+   requested to stop using that algorithm.
+   1. __Will do:__ The new URL Service will not use MD5 algorithm.
+1. Short URLs are not automatically deleted when the target (say dashboard) is
+   deleted. (#10450)
+   1. __Could do:__ The URL Service will not provide such feature. Though the
+      short URLs will keep track of saved object references used in the params
+      to generate a short URL. Maybe those saved references could somehow be
+      used in the future to provide such a facility.
+      
+      Currently, there are two possible avenues for deleting a short URL when
+      the underlying dashboard is deleted:
+
+      1. The Dashboard app could keep track of short URLs it generates for each
+         dashboard. Once a dashboard is deleted, the Dashboard app also
+         deletes all short URLs associated with that dashboard.
+      1. Saved Objects Service could implement *cascading deletes*. Once a saved
+         object is deleted, the associated saved objects are also deleted
+         (#71453).
+1. Add additional metadata to each short URL.
+   1. __Could do:__ Each short URL already keeps a counter of how often it was
+      resolved, we could also keep track of a timestamp when it was last
+      resolved, and have an ability for users to give a title to each short URL.
+1. Short URLs don't have a management UI.
+   1. __Will NOT do:__ We will not create a dedicated UI for managing short
+      URLs. We could improve how short URLs saved objects are presented in saved
+      object management UI.
+1. Short URLs can't be created by read-only users (#18006).
+   1. __Will NOT do:__ Currently short URLs are stored as saved objects of type
+      `url`, we would like to keep it that way and benefit from saved object
+      facilities like references, migrations, authorization etc.. The consensus
+      is that we will not allow anonymous users to create short URLs. We want to
+      continue using saved object for short URLs going forward and not
+      compromise on their security model.
+
+
+## Limitations of the URL Generator Service
+
+We have identified the following limitations in the current implementation of
+the URL Generator Service:
+
+1. URL generator generate only the URL of the destination. However there is
+   also the ability to use location state with `core.application.navigateToApp`
+   navigation method.
+   1. __Will do:__ The new locators will also generate the location state, which
+      will be used in `.navigateToApp` method.
+1. URL generators are available only on the client-side. There is no way to use
+   them together with short URLs.
+   1. __Will do:__ We will implement locators also on the server-side
+      (they will be available in both environments) and we will combine them
+      with the Short URL Service.
+1. URL generators are not exposed externally, thus Cloud and Support cannot use
+   them to generate deep links into Kibana.
+   1. __Will do:__ We will expose HTTP endpoints on the server-side and the
+      "redirect" app on the client-side which external users will be able to use
+      to deep link into Kibana using locators.
+
+
+## Limitations of the architecture
+
+One major reason we want to "refresh" the Short URL Service and the URL
+Generator Service is their architecture.
+
+Currently, the Short URL Service is implemented on top of the `url` type saved
+object on the server-side. However, it only exposes the
+HTTP endpoints, it does not expose any API on the server for the server-side
+plugins to consume; on the client-side there is no plugin API either, developers
+need to manually execute HTTP requests. 
+
+The URL Generator Service is only available on the client-side, there is no way
+to use it on the server-side, yet we already have use cases (for example ML
+team) where a server-side plugin wants to use a URL generator.
+
+![Current Short URL Service and URL Generator Service architecture](../images/url_service/old_architecture.png)
+
+The current architecture does not allow both services to be conveniently used,
+also as they are implemented in different locations, they are disjointed&mdash;
+we cannot create a short URL using an URL generator.
+
+
+# Detailed design
+
+In general we will try to provide as much as possible the same API on the
+server-side and the client-side.
+
+
+## High level architecture
+
+Below diagram shows the proposed architecture of the URL Service.
+
+![URL Service architecture](../images/url_service/new_architecture.png)
+
+
+## Plugin contracts
+
+The aim is to provide developers the same experience on the server and browser.
+
+Below are preliminary interfaces of the new URL Service. `IUrlService` will be
+a shared interface defined in `/common` folder shared across server and browser.
+This will allow us to provide users a common API interface on the server and
+browser, wherever they choose to use the URL Service:
+
+```ts
+/**
+ * Common URL Service client interface for the server-side and the client-side.
+ */
+interface IUrlService {
+  locators: ILocatorClient;
+  shortUrls: IShortUrlClient;
+}
+```
+
+
+### Locators
+
+The locator business logic will be contained in `ILocatorClient` client and will
+provide two main functionalities:
+
+1. It will provide a facility to create locators.
+1. It will also be a registry of locators, every newly created locator is
+   automatically added to the registry. The registry should never be used when
+   locator ID is known at the compile time, but is reserved only for use cases
+   when we only know ID of a locator at runtime.
+
+```ts
+interface ILocatorClient {
+  create<P>(definition: LocatorDefinition<P>): Locator<P>;
+  get<P>(id: string): Locator<P>;
+}
+```
+
+The `LocatorDefinition` interface is a developer-friendly interface for creating
+new locators. Mainly two things will be required from each new locator:
+
+1. Implement the `getLocation()` method, which gives the locator specific `params`
+   object returns a Kibana location, see description of `KibanaLocation` below.
+2. Implement the `PersistableState` interface which we use in Kibana. This will
+   allow to migrate the locator `params`. Implementation of the `PersistableState`
+   interface will replace the `.isDeprecated` and `.migrate()` properties of URL
+   generators.
+
+
+```ts
+interface LocatorDefinition<P> extends PeristableState<P> {
+  id: string;
+  getLocation(params: P): KibanaLocation;
+}
+```
+
+Each constructed locator will have the following interface:
+
+```ts
+interface Locator<P> {
+  /** Creates a new short URL saved object using this locator. */
+  createShortUrl(params: P, slug?: string): Promise<ShortUrl>;
+  /** Returns a relative URL to the client-side redirect endpoint using this locator. */
+  getRedirectPath(params: P): string;
+  /** Navigate using core.application.navigateToApp() using this locator. */
+  navigate(params: P): void; // Only on browser.
+}
+```
+
+
+### Short URLs
+
+The short URL client `IShortUrlClient` which will be the same on the server and
+browser. However, the server and browser might add extra utility methods for
+convenience.
+
+```ts
+/**
+ * CRUD-like API for short URLs.
+ */
+interface IShortUrlClient {
+  /**
+   * Delete a short URL.
+   * 
+   * @param slug The slug (ID) of the short URL.
+   * @return Returns true if deletion was successful.
+   */
+  delete(slug: string): Promise<boolean>;
+
+  /**
+   * Fetch short URL.
+   * 
+   * @param slug The slug (ID) of the short URL.
+   */
+  get(slug: string): Promise<ShortUrl>;
+
+  /**
+   * Same as `get()` but it also increments the "view" counter and the
+   * "last view" timestamp of this short URL.
+   * 
+   * @param slug The slug (ID) of the short URL.
+   */
+  resolve(slug: string): Promise<ShortUrl>;
+}
+```
+
+Note, that in this new service to create a short URL the developer will have to
+use a locator (instead of creating it directly from a long URL).
+
+```ts
+const shortUrl = await plugins.share.shortUrls.create(
+  plugins.discover.locator,
+  {
+    indexPattern: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+    highlightedField: 'foo',
+  },
+  'optional-human-readable-slug',
+);
+```
+
+These short URLs will be stored in saved objects of type `url` and will be
+automatically migrated using the locator. The long URL will NOT be stored in the
+saved object. The locator ID and locator params will be stored in the saved
+object, that will allow us to do the migrations for short URLs.
+
+
+### `KibanaLocation` interface
+
+The `KibanaLocation` interface is a simple interface to store a location in some
+Kibana application.
+
+```ts
+interface KibanaLocation {
+  app: string;
+  route: string;
+  state: object;
+}
+```
+
+It maps directly to a `.navigateToApp()` call.
+
+```ts
+let location: KibanaLocation;
+
+core.application.navigateToApp(location.app, {
+  route: location.route,
+  state: location.state,
+});
+```
+
+
+## HTTP endpoints
+
+
+### Short URL CRUD+ HTTP endpoints
+
+Below HTTP endpoints are designed to work specifically with short URLs:
+
+| HTTP method           | Path                                | Description                                                                                                                              |
+|-----------------------|-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
+| __POST__              | `/api/short_url`                    | Endpoint for creating new short URLs.                                                                                                    |
+| __GET__               | `/api/short_url/<slug>`             | Endpoint for retrieving information about an existing short URL.                                                                         |
+| __DELETE__            | `/api/short_url/<slug>`             | Endpoint for deleting an existing short URL.                                                                                             |
+| __POST__              | `/api/short_url/<slug>`             | Endpoint for updating information about an existing short URL.                                                                           |
+| __POST__              | `/api/short_url/<slug>/_resolve`    | Similar to `GET /api/short_url/<slug>`, but also increments the short URL access count counter and the last access timestamp.            |
+
+
+### The client-side navigate endpoint
+
+__NOTE.__ We are currently investigating if we really need this endpoint. The
+main user of it was expected to be Cloud and Support to deeply link into Kibana,
+but we are now reconsidering if we want to support this endpoint and possibly
+find a different solution.
+
+The `/app/goto/_redirect/<locatorId>?params=...&paramsVersion=...` client-side
+endpoint will receive the locator ID and locator params, it will use those to
+find the locator and execute `locator.navigate(params)` method.
+
+The `paramsVersion` parameter will be used to specify the version of the
+`params` parameter. If the version is behind the latest version, then the migration
+facilities of the locator will be used to on-the-fly migrate the `params` to the
+latest version.
+
+
+### Legacy endpoints
+
+Below are the legacy HTTP endpoints implemented by the `share` plugin, with a
+plan of action for each endpoint:
+
+| HTTP method           | Path                                | Description                                                                                                                              |
+|-----------------------|-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
+| __ANY__               | `/goto/<slug>`                      | Endpoint for redirecting short URLs, we will keep it to redirect short URLs.                                                             |
+| __GET__               | `/api/short_url/<slug>`             | The new `GET /api/short_url/<slug>` endpoint will return a superset of the payload that the legacy endpoint now returns.                 |
+| __POST__              | `/api/shorten_url`                  | The legacy endpoints for creating short URLs. We will remove it or deprecate this endpoint and maintain it until 8.0 major release.      |
+
+
+# Drawbacks
+
+Why should we *not* do this?
+
+- Implementation cost will be a few weeks, but the code complexity and quality
+  will improve.
+- There is a cost of migrating existing Kibana plugins to use the new API.
+
+
+# Alternatives
+
+We haven't considered other design alternatives.
+
+One alternative is still do the short URL improvements outlined above. But
+reconsider URL generators:
+
+- Do we need URL generators at all?
+  - Kibana URLs are not stable and have changed in our past experience. Hence,
+    the URL generators were created to make the URL generator parameters stable
+    unless a migration is available.
+- Do we want to put migration support in URL generators?
+  - Alternative would be for each app to support URLs forever or do the
+    migrations on the fly for old URLs.
+- Should Kibana URLs be stable and break only during major releases?
+- Should the Kibana application interface be extended such that some version of
+  URL generators is built in?
+
+The impact of not doing this change is essentially extending technical debt. 
+
+
+# Adoption strategy
+
+Is this a breaking change? It is a breaking change in the sense that the API
+will change. However, all the existing use cases will be supported. When
+implementing this we will also adjust all Kibana code to use the new API. From
+the perspective of the developers when using the existing URL services nothing
+will change, they will simply need to review a PR which stops using the URL
+Generator Service and uses the combined URL Service instead, which will provide
+a superset of features.
+
+Alternatively, we can deprecate the URL Generator Service and maintain it for a
+few minor releases.
+
+
+# How we teach this
+
+For the existing short URL and URL generator functionality there is nothing to
+teach, as they will continue working with a largely similar API.
+
+Everything else in the new URL Service will have JSDoc comments and good
+documentation on our website.
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 4220d3e490f63a..0ecfc152197d3c 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -21,12 +21,16 @@ export class DocLinksService {
     const DOC_LINK_VERSION = injectedMetadata.getKibanaBranch();
     const ELASTIC_WEBSITE_URL = 'https://www.elastic.co/';
     const ELASTICSEARCH_DOCS = `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/reference/${DOC_LINK_VERSION}/`;
+    const KIBANA_DOCS = `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/`;
     const PLUGIN_DOCS = `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/plugins/${DOC_LINK_VERSION}/`;
 
     return deepFreeze({
       DOC_LINK_VERSION,
       ELASTIC_WEBSITE_URL,
       links: {
+        canvas: {
+          guide: `${KIBANA_DOCS}canvas.html`,
+        },
         dashboard: {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/dashboard.html`,
           drilldowns: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/drilldowns.html`,
@@ -245,10 +249,10 @@ export class DocLinksService {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/index.html`,
         },
         alerting: {
-          guide: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/managing-alerts-and-actions.html`,
+          guide: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/alert-management.html`,
           actionTypes: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/action-types.html`,
           emailAction: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/email-action-type.html`,
-          emailActionConfig: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/email-action-type.html#configuring-email`,
+          emailActionConfig: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/email-action-type.html`,
           generalSettings: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/alert-action-settings-kb.html#general-alert-action-settings`,
           indexAction: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/index-action-type.html`,
           esQuery: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/rule-type-es-query.html`,
@@ -397,6 +401,9 @@ export interface DocLinksStart {
   readonly DOC_LINK_VERSION: string;
   readonly ELASTIC_WEBSITE_URL: string;
   readonly links: {
+    readonly canvas: {
+      readonly guide: string;
+    };
     readonly dashboard: {
       readonly guide: string;
       readonly drilldowns: string;
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 18133ebec33533..b3ded52a98171a 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -490,6 +490,9 @@ export interface DocLinksStart {
     readonly ELASTIC_WEBSITE_URL: string;
     // (undocumented)
     readonly links: {
+        readonly canvas: {
+            readonly guide: string;
+        };
         readonly dashboard: {
             readonly guide: string;
             readonly drilldowns: string;
diff --git a/src/core/server/core_usage_data/core_usage_data_service.mock.ts b/src/core/server/core_usage_data/core_usage_data_service.mock.ts
index 8ed627cebec7e4..7fb15a921a4134 100644
--- a/src/core/server/core_usage_data/core_usage_data_service.mock.ts
+++ b/src/core/server/core_usage_data/core_usage_data_service.mock.ts
@@ -95,6 +95,13 @@ const createStartContractMock = () => {
               supportedProtocols: ['TLSv1.1', 'TLSv1.2'],
               truststoreConfigured: false,
             },
+            securityResponseHeaders: {
+              strictTransportSecurity: 'NULL', // `null` values are coalesced to `"NULL"` strings
+              xContentTypeOptions: 'nosniff',
+              referrerPolicy: 'no-referrer-when-downgrade',
+              permissionsPolicyConfigured: false,
+              disableEmbedding: false,
+            },
             xsrf: {
               disableProtection: false,
               allowlistConfigured: false,
diff --git a/src/core/server/core_usage_data/core_usage_data_service.test.ts b/src/core/server/core_usage_data/core_usage_data_service.test.ts
index 1c28eca1f1decb..d1f047c129efef 100644
--- a/src/core/server/core_usage_data/core_usage_data_service.test.ts
+++ b/src/core/server/core_usage_data/core_usage_data_service.test.ts
@@ -187,6 +187,13 @@ describe('CoreUsageDataService', () => {
                   "ipAllowlistConfigured": false,
                 },
                 "rewriteBasePath": false,
+                "securityResponseHeaders": Object {
+                  "disableEmbedding": false,
+                  "permissionsPolicyConfigured": false,
+                  "referrerPolicy": "no-referrer-when-downgrade",
+                  "strictTransportSecurity": "NULL",
+                  "xContentTypeOptions": "nosniff",
+                },
                 "socketTimeout": 120000,
                 "ssl": Object {
                   "certificateAuthoritiesConfigured": false,
diff --git a/src/core/server/core_usage_data/core_usage_data_service.ts b/src/core/server/core_usage_data/core_usage_data_service.ts
index dff68bf1c524fe..78ac977c31a7d5 100644
--- a/src/core/server/core_usage_data/core_usage_data_service.ts
+++ b/src/core/server/core_usage_data/core_usage_data_service.ts
@@ -225,6 +225,16 @@ export class CoreUsageDataService implements CoreService<CoreUsageDataSetup, Cor
             keystoreConfigured: isConfigured.record(http.ssl.keystore),
             truststoreConfigured: isConfigured.record(http.ssl.truststore),
           },
+          securityResponseHeaders: {
+            // ES does not index `null` and it cannot be searched, so we coalesce these to string values instead
+            strictTransportSecurity: http.securityResponseHeaders.strictTransportSecurity ?? 'NULL',
+            xContentTypeOptions: http.securityResponseHeaders.xContentTypeOptions ?? 'NULL',
+            referrerPolicy: http.securityResponseHeaders.referrerPolicy ?? 'NULL',
+            permissionsPolicyConfigured: isConfigured.string(
+              http.securityResponseHeaders.permissionsPolicy ?? undefined
+            ),
+            disableEmbedding: http.securityResponseHeaders.disableEmbedding,
+          },
         },
 
         logging: {
diff --git a/src/core/server/core_usage_data/types.ts b/src/core/server/core_usage_data/types.ts
index 46148e314bfee5..b29cf41da68264 100644
--- a/src/core/server/core_usage_data/types.ts
+++ b/src/core/server/core_usage_data/types.ts
@@ -212,6 +212,13 @@ export interface CoreConfigUsageData {
       supportedProtocols: string[];
       clientAuthentication: 'none' | 'optional' | 'required';
     };
+    securityResponseHeaders: {
+      strictTransportSecurity: string;
+      xContentTypeOptions: string;
+      referrerPolicy: string;
+      permissionsPolicyConfigured: boolean;
+      disableEmbedding: boolean;
+    };
   };
 
   logging: {
diff --git a/src/core/server/csp/config.test.ts b/src/core/server/csp/config.test.ts
new file mode 100644
index 00000000000000..c7f6c4a214faca
--- /dev/null
+++ b/src/core/server/csp/config.test.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { config } from './config';
+
+describe('config.validate()', () => {
+  test(`does not allow "disableEmbedding" to be set to true`, () => {
+    // This is intentionally not editable in the raw CSP config.
+    // Users should set `server.securityResponseHeaders.disableEmbedding` to control this config property.
+    expect(() => config.schema.validate({ disableEmbedding: true })).toThrowError(
+      '[disableEmbedding.0]: expected value to equal [false]'
+    );
+  });
+});
diff --git a/src/core/server/csp/config.ts b/src/core/server/csp/config.ts
index 3fc9faa26179e6..a61fa1b03a45c8 100644
--- a/src/core/server/csp/config.ts
+++ b/src/core/server/csp/config.ts
@@ -27,5 +27,8 @@ export const config = {
     }),
     strict: schema.boolean({ defaultValue: true }),
     warnLegacyBrowsers: schema.boolean({ defaultValue: true }),
+    disableEmbedding: schema.oneOf([schema.literal<boolean>(false)], { defaultValue: false }),
   }),
 };
+
+export const FRAME_ANCESTORS_RULE = `frame-ancestors 'self'`; // only used by CspConfig when embedding is disabled
diff --git a/src/core/server/csp/csp_config.test.ts b/src/core/server/csp/csp_config.test.ts
index ed13d363c41665..1e023c6f08ea80 100644
--- a/src/core/server/csp/csp_config.test.ts
+++ b/src/core/server/csp/csp_config.test.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { CspConfig } from '.';
+import { CspConfig } from './csp_config';
+import { FRAME_ANCESTORS_RULE } from './config';
 
 // CSP rules aren't strictly additive, so any change can potentially expand or
 // restrict the policy in a way we consider a breaking change. For that reason,
@@ -25,6 +26,7 @@ describe('CspConfig', () => {
   test('DEFAULT', () => {
     expect(CspConfig.DEFAULT).toMatchInlineSnapshot(`
       CspConfig {
+        "disableEmbedding": false,
         "header": "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
         "rules": Array [
           "script-src 'unsafe-eval' 'self'",
@@ -38,49 +40,51 @@ describe('CspConfig', () => {
   });
 
   test('defaults from config', () => {
-    expect(new CspConfig()).toMatchInlineSnapshot(`
-      CspConfig {
-        "header": "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
-        "rules": Array [
-          "script-src 'unsafe-eval' 'self'",
-          "worker-src blob: 'self'",
-          "style-src 'unsafe-inline' 'self'",
-        ],
-        "strict": true,
-        "warnLegacyBrowsers": true,
-      }
-    `);
+    expect(new CspConfig()).toEqual(CspConfig.DEFAULT);
   });
 
-  test('creates from partial config', () => {
-    expect(new CspConfig({ strict: false, warnLegacyBrowsers: false })).toMatchInlineSnapshot(`
-      CspConfig {
-        "header": "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
-        "rules": Array [
-          "script-src 'unsafe-eval' 'self'",
-          "worker-src blob: 'self'",
-          "style-src 'unsafe-inline' 'self'",
-        ],
-        "strict": false,
-        "warnLegacyBrowsers": false,
-      }
-    `);
-  });
+  describe('partial config', () => {
+    test('allows "rules" to be set and changes header', () => {
+      const rules = ['foo', 'bar'];
+      const config = new CspConfig({ rules });
+      expect(config.rules).toEqual(rules);
+      expect(config.header).toMatchInlineSnapshot(`"foo; bar"`);
+    });
 
-  test('computes header from rules', () => {
-    const cspConfig = new CspConfig({ rules: ['alpha', 'beta', 'gamma'] });
+    test('allows "strict" to be set', () => {
+      const config = new CspConfig({ strict: false });
+      expect(config.strict).toEqual(false);
+      expect(config.strict).not.toEqual(CspConfig.DEFAULT.strict);
+    });
 
-    expect(cspConfig).toMatchInlineSnapshot(`
-      CspConfig {
-        "header": "alpha; beta; gamma",
-        "rules": Array [
-          "alpha",
-          "beta",
-          "gamma",
-        ],
-        "strict": true,
-        "warnLegacyBrowsers": true,
-      }
-    `);
+    test('allows "warnLegacyBrowsers" to be set', () => {
+      const warnLegacyBrowsers = false;
+      const config = new CspConfig({ warnLegacyBrowsers });
+      expect(config.warnLegacyBrowsers).toEqual(warnLegacyBrowsers);
+      expect(config.warnLegacyBrowsers).not.toEqual(CspConfig.DEFAULT.warnLegacyBrowsers);
+    });
+
+    describe('allows "disableEmbedding" to be set', () => {
+      const disableEmbedding = true;
+
+      test('and changes rules/header if custom rules are not defined', () => {
+        const config = new CspConfig({ disableEmbedding });
+        expect(config.disableEmbedding).toEqual(disableEmbedding);
+        expect(config.disableEmbedding).not.toEqual(CspConfig.DEFAULT.disableEmbedding);
+        expect(config.rules).toEqual(expect.arrayContaining([FRAME_ANCESTORS_RULE]));
+        expect(config.header).toMatchInlineSnapshot(
+          `"script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'; frame-ancestors 'self'"`
+        );
+      });
+
+      test('and does not change rules/header if custom rules are defined', () => {
+        const rules = ['foo', 'bar'];
+        const config = new CspConfig({ disableEmbedding, rules });
+        expect(config.disableEmbedding).toEqual(disableEmbedding);
+        expect(config.disableEmbedding).not.toEqual(CspConfig.DEFAULT.disableEmbedding);
+        expect(config.rules).toEqual(rules);
+        expect(config.header).toMatchInlineSnapshot(`"foo; bar"`);
+      });
+    });
   });
 });
diff --git a/src/core/server/csp/csp_config.ts b/src/core/server/csp/csp_config.ts
index dd0e7ef2dbee4c..649c81576ef522 100644
--- a/src/core/server/csp/csp_config.ts
+++ b/src/core/server/csp/csp_config.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { config } from './config';
+import { config, FRAME_ANCESTORS_RULE } from './config';
 
 const DEFAULT_CONFIG = Object.freeze(config.schema.validate({}));
 
@@ -32,6 +32,12 @@ export interface ICspConfig {
    */
   readonly warnLegacyBrowsers: boolean;
 
+  /**
+   * Whether or not embedding (using iframes) should be allowed by the CSP. If embedding is disabled *and* no custom rules have been
+   * defined, a restrictive 'frame-ancestors' rule will be added to the default CSP rules.
+   */
+  readonly disableEmbedding: boolean;
+
   /**
    * The CSP rules in a formatted directives string for use
    * in a `Content-Security-Policy` header.
@@ -49,6 +55,7 @@ export class CspConfig implements ICspConfig {
   public readonly rules: string[];
   public readonly strict: boolean;
   public readonly warnLegacyBrowsers: boolean;
+  public readonly disableEmbedding: boolean;
   public readonly header: string;
 
   /**
@@ -58,9 +65,13 @@ export class CspConfig implements ICspConfig {
   constructor(rawCspConfig: Partial<Omit<ICspConfig, 'header'>> = {}) {
     const source = { ...DEFAULT_CONFIG, ...rawCspConfig };
 
-    this.rules = source.rules;
+    this.rules = [...source.rules];
     this.strict = source.strict;
     this.warnLegacyBrowsers = source.warnLegacyBrowsers;
-    this.header = source.rules.join('; ');
+    this.disableEmbedding = source.disableEmbedding;
+    if (!rawCspConfig.rules?.length && source.disableEmbedding) {
+      this.rules.push(FRAME_ANCESTORS_RULE);
+    }
+    this.header = this.rules.join('; ');
   }
 }
diff --git a/src/core/server/http/__snapshots__/http_config.test.ts.snap b/src/core/server/http/__snapshots__/http_config.test.ts.snap
index 4545396c27b5e9..589e4e118991a8 100644
--- a/src/core/server/http/__snapshots__/http_config.test.ts.snap
+++ b/src/core/server/http/__snapshots__/http_config.test.ts.snap
@@ -64,6 +64,13 @@ Object {
     "ipAllowlist": Array [],
   },
   "rewriteBasePath": false,
+  "securityResponseHeaders": Object {
+    "disableEmbedding": false,
+    "permissionsPolicy": null,
+    "referrerPolicy": "no-referrer-when-downgrade",
+    "strictTransportSecurity": null,
+    "xContentTypeOptions": "nosniff",
+  },
   "socketTimeout": 120000,
   "ssl": Object {
     "cipherSuites": Array [
diff --git a/src/core/server/http/http_config.ts b/src/core/server/http/http_config.ts
index daf7424b8f8bd3..c7e53bb600377d 100644
--- a/src/core/server/http/http_config.ts
+++ b/src/core/server/http/http_config.ts
@@ -14,6 +14,10 @@ import url from 'url';
 import { ServiceConfigDescriptor } from '../internal_types';
 import { CspConfigType, CspConfig, ICspConfig } from '../csp';
 import { ExternalUrlConfig, IExternalUrlConfig } from '../external_url';
+import {
+  securityResponseHeadersSchema,
+  parseRawSecurityResponseHeadersConfig,
+} from './security_response_headers_config';
 
 const validBasePathRegex = /^\/.*[^\/]$/;
 const uuidRegexp = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -53,6 +57,7 @@ const configSchema = schema.object(
         },
       }
     ),
+    securityResponseHeaders: securityResponseHeadersSchema,
     customResponseHeaders: schema.recordOf(schema.string(), schema.any(), {
       defaultValue: {},
     }),
@@ -171,6 +176,7 @@ export class HttpConfig implements IHttpConfig {
     allowCredentials: boolean;
     allowOrigin: string[];
   };
+  public securityResponseHeaders: Record<string, string | string[]>;
   public customResponseHeaders: Record<string, string | string[]>;
   public maxPayload: ByteSizeValue;
   public basePath?: string;
@@ -195,6 +201,10 @@ export class HttpConfig implements IHttpConfig {
     this.host = rawHttpConfig.host;
     this.port = rawHttpConfig.port;
     this.cors = rawHttpConfig.cors;
+    const { securityResponseHeaders, disableEmbedding } = parseRawSecurityResponseHeadersConfig(
+      rawHttpConfig.securityResponseHeaders
+    );
+    this.securityResponseHeaders = securityResponseHeaders;
     this.customResponseHeaders = Object.entries(rawHttpConfig.customResponseHeaders ?? {}).reduce(
       (headers, [key, value]) => {
         return {
@@ -213,7 +223,7 @@ export class HttpConfig implements IHttpConfig {
     this.rewriteBasePath = rawHttpConfig.rewriteBasePath;
     this.ssl = new SslConfig(rawHttpConfig.ssl || {});
     this.compression = rawHttpConfig.compression;
-    this.csp = new CspConfig(rawCspConfig);
+    this.csp = new CspConfig({ ...rawCspConfig, disableEmbedding });
     this.externalUrl = rawExternalUrlConfig;
     this.xsrf = rawHttpConfig.xsrf;
     this.requestId = rawHttpConfig.requestId;
diff --git a/src/core/server/http/integration_tests/lifecycle_handlers.test.ts b/src/core/server/http/integration_tests/lifecycle_handlers.test.ts
index 2f9d393b632f72..8d4cf31a5c7052 100644
--- a/src/core/server/http/integration_tests/lifecycle_handlers.test.ts
+++ b/src/core/server/http/integration_tests/lifecycle_handlers.test.ts
@@ -53,8 +53,16 @@ describe('core lifecycle handlers', () => {
           },
           compression: { enabled: true },
           name: kibanaName,
+          securityResponseHeaders: {
+            // reflects default config
+            strictTransportSecurity: null,
+            xContentTypeOptions: 'nosniff',
+            referrerPolicy: 'strict-origin-when-cross-origin',
+            permissionsPolicy: null,
+          },
           customResponseHeaders: {
             'some-header': 'some-value',
+            'referrer-policy': 'strict-origin', // overrides a header that is defined by securityResponseHeaders
           },
           xsrf: { disableProtection: false, allowlist: [allowlistedTestPath] },
           requestId: {
@@ -117,6 +125,13 @@ describe('core lifecycle handlers', () => {
     const testRoute = '/custom_headers/test/route';
     const testErrorRoute = '/custom_headers/test/error_route';
 
+    const expectedHeaders = {
+      [nameHeader]: kibanaName,
+      'x-content-type-options': 'nosniff',
+      'referrer-policy': 'strict-origin',
+      'some-header': 'some-value',
+    };
+
     beforeEach(async () => {
       router.get({ path: testRoute, validate: false }, (context, req, res) => {
         return res.ok({ body: 'ok' });
@@ -127,36 +142,16 @@ describe('core lifecycle handlers', () => {
       await server.start();
     });
 
-    it('adds the kbn-name header', async () => {
-      const result = await supertest(innerServer.listener).get(testRoute).expect(200, 'ok');
-      const headers = result.header as Record<string, string>;
-      expect(headers).toEqual(
-        expect.objectContaining({
-          [nameHeader]: kibanaName,
-        })
-      );
-    });
-
-    it('adds the kbn-name header in case of error', async () => {
-      const result = await supertest(innerServer.listener).get(testErrorRoute).expect(400);
-      const headers = result.header as Record<string, string>;
-      expect(headers).toEqual(
-        expect.objectContaining({
-          [nameHeader]: kibanaName,
-        })
-      );
-    });
-
-    it('adds the custom headers', async () => {
+    it('adds the expected headers in case of success', async () => {
       const result = await supertest(innerServer.listener).get(testRoute).expect(200, 'ok');
       const headers = result.header as Record<string, string>;
-      expect(headers).toEqual(expect.objectContaining({ 'some-header': 'some-value' }));
+      expect(headers).toEqual(expect.objectContaining(expectedHeaders));
     });
 
-    it('adds the custom headers in case of error', async () => {
+    it('adds the expected headers in case of error', async () => {
       const result = await supertest(innerServer.listener).get(testErrorRoute).expect(400);
       const headers = result.header as Record<string, string>;
-      expect(headers).toEqual(expect.objectContaining({ 'some-header': 'some-value' }));
+      expect(headers).toEqual(expect.objectContaining(expectedHeaders));
     });
   });
 
diff --git a/src/core/server/http/lifecycle_handlers.test.ts b/src/core/server/http/lifecycle_handlers.test.ts
index cd8caa7c76ab18..e777cbb1c1ff07 100644
--- a/src/core/server/http/lifecycle_handlers.test.ts
+++ b/src/core/server/http/lifecycle_handlers.test.ts
@@ -241,12 +241,15 @@ describe('customHeaders pre-response handler', () => {
     expect(toolkit.next).toHaveBeenCalledWith({ headers: { 'kbn-name': 'my-server-name' } });
   });
 
-  it('adds the custom headers defined in the configuration', () => {
+  it('adds the security headers and custom headers defined in the configuration', () => {
     const config = createConfig({
       name: 'my-server-name',
-      customResponseHeaders: {
+      securityResponseHeaders: {
         headerA: 'value-A',
-        headerB: 'value-B',
+        headerB: 'value-B', // will be overridden by the custom response header below
+      },
+      customResponseHeaders: {
+        headerB: 'x',
       },
     });
     const handler = createCustomHeadersPreResponseHandler(config as HttpConfig);
@@ -258,7 +261,7 @@ describe('customHeaders pre-response handler', () => {
       headers: {
         'kbn-name': 'my-server-name',
         headerA: 'value-A',
-        headerB: 'value-B',
+        headerB: 'x',
       },
     });
   });
diff --git a/src/core/server/http/lifecycle_handlers.ts b/src/core/server/http/lifecycle_handlers.ts
index a1fae89b68e11e..eed24c8071eaf9 100644
--- a/src/core/server/http/lifecycle_handlers.ts
+++ b/src/core/server/http/lifecycle_handlers.ts
@@ -62,12 +62,12 @@ export const createVersionCheckPostAuthHandler = (kibanaVersion: string): OnPost
 };
 
 export const createCustomHeadersPreResponseHandler = (config: HttpConfig): OnPreResponseHandler => {
-  const serverName = config.name;
-  const customHeaders = config.customResponseHeaders;
+  const { name: serverName, securityResponseHeaders, customResponseHeaders } = config;
 
   return (request, response, toolkit) => {
     const additionalHeaders = {
-      ...customHeaders,
+      ...securityResponseHeaders,
+      ...customResponseHeaders,
       [KIBANA_NAME_HEADER]: serverName,
     };
 
diff --git a/src/core/server/http/router/route.ts b/src/core/server/http/router/route.ts
index 77b40ca5995bb9..ea70f1b4f543b8 100644
--- a/src/core/server/http/router/route.ts
+++ b/src/core/server/http/router/route.ts
@@ -70,7 +70,7 @@ export interface RouteConfigOptionsBody {
   /**
    * Limits the size of incoming payloads to the specified byte count. Allowing very large payloads may cause the server to run out of memory.
    *
-   * Default value: The one set in the kibana.yml config file under the parameter `server.maxPayloadBytes`.
+   * Default value: The one set in the kibana.yml config file under the parameter `server.maxPayload`.
    */
   maxBytes?: number;
 
diff --git a/src/core/server/http/security_response_headers_config.test.ts b/src/core/server/http/security_response_headers_config.test.ts
new file mode 100644
index 00000000000000..b1c8bb23102f5c
--- /dev/null
+++ b/src/core/server/http/security_response_headers_config.test.ts
@@ -0,0 +1,99 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  securityResponseHeadersSchema as schema,
+  parseRawSecurityResponseHeadersConfig as parse,
+} from './security_response_headers_config';
+
+describe('parseRawSecurityResponseHeadersConfig', () => {
+  it('returns default values', () => {
+    const config = schema.validate({});
+    const result = parse(config);
+    expect(result.disableEmbedding).toBe(false);
+    expect(result.securityResponseHeaders).toMatchInlineSnapshot(`
+      Object {
+        "Referrer-Policy": "no-referrer-when-downgrade",
+        "X-Content-Type-Options": "nosniff",
+      }
+    `);
+  });
+
+  describe('strictTransportSecurity', () => {
+    it('a custom value results in the expected Strict-Transport-Security header', () => {
+      const strictTransportSecurity = 'max-age=31536000; includeSubDomains';
+      const config = schema.validate({ strictTransportSecurity });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['Strict-Transport-Security']).toEqual(
+        strictTransportSecurity
+      );
+    });
+
+    it('a null value removes the Strict-Transport-Security header', () => {
+      const config = schema.validate({ strictTransportSecurity: null });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['Strict-Transport-Security']).toBeUndefined();
+    });
+  });
+
+  describe('xContentTypeOptions', () => {
+    it('a custom value results in the expected X-Content-Type-Options header', () => {
+      const xContentTypeOptions = 'nosniff'; // there is no other valid value to test with
+      const config = schema.validate({ xContentTypeOptions });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['X-Content-Type-Options']).toEqual(xContentTypeOptions);
+    });
+
+    it('a null value removes the X-Content-Type-Options header', () => {
+      const config = schema.validate({ xContentTypeOptions: null });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['X-Content-Type-Options']).toBeUndefined();
+    });
+  });
+
+  describe('referrerPolicy', () => {
+    it('a custom value results in the expected Referrer-Policy header', () => {
+      const referrerPolicy = 'strict-origin-when-cross-origin';
+      const config = schema.validate({ referrerPolicy });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['Referrer-Policy']).toEqual(referrerPolicy);
+    });
+
+    it('a null value removes the Referrer-Policy header', () => {
+      const config = schema.validate({ referrerPolicy: null });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['Referrer-Policy']).toBeUndefined();
+    });
+  });
+
+  describe('permissionsPolicy', () => {
+    it('a custom value results in the expected Permissions-Policy header', () => {
+      const permissionsPolicy = 'display-capture=(self)';
+      const config = schema.validate({ permissionsPolicy });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['Permissions-Policy']).toEqual(permissionsPolicy);
+    });
+
+    it('a null value removes the Permissions-Policy header', () => {
+      const config = schema.validate({ permissionsPolicy: null });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['Permissions-Policy']).toBeUndefined();
+    });
+  });
+
+  describe('disableEmbedding', () => {
+    it('a true value results in the expected X-Frame-Options header and expected disableEmbedding result value', () => {
+      const config = schema.validate({ disableEmbedding: true });
+      const result = parse(config);
+      expect(result.securityResponseHeaders['X-Frame-Options']).toMatchInlineSnapshot(
+        `"SAMEORIGIN"`
+      );
+      expect(result.disableEmbedding).toBe(true);
+    });
+  });
+});
diff --git a/src/core/server/http/security_response_headers_config.ts b/src/core/server/http/security_response_headers_config.ts
new file mode 100644
index 00000000000000..917d737d59297e
--- /dev/null
+++ b/src/core/server/http/security_response_headers_config.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { schema, TypeOf } from '@kbn/config-schema';
+
+export const securityResponseHeadersSchema = schema.object({
+  strictTransportSecurity: schema.oneOf([schema.string(), schema.literal(null)], {
+    // See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+    defaultValue: null,
+  }),
+  xContentTypeOptions: schema.oneOf([schema.literal('nosniff'), schema.literal(null)], {
+    // See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+    defaultValue: 'nosniff',
+  }),
+  referrerPolicy: schema.oneOf(
+    // See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+    [
+      schema.literal('no-referrer'),
+      schema.literal('no-referrer-when-downgrade'),
+      schema.literal('origin'),
+      schema.literal('origin-when-cross-origin'),
+      schema.literal('same-origin'),
+      schema.literal('strict-origin'),
+      schema.literal('strict-origin-when-cross-origin'),
+      schema.literal('unsafe-url'),
+      schema.literal(null),
+    ],
+    { defaultValue: 'no-referrer-when-downgrade' }
+  ),
+  permissionsPolicy: schema.oneOf([schema.string(), schema.literal(null)], {
+    // See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
+    // Note: Feature-Policy is superseded by Permissions-Policy; the link above is temporary until MDN releases an updated page
+    defaultValue: null,
+  }),
+  disableEmbedding: schema.boolean({ defaultValue: false }), // is used to control X-Frame-Options and CSP headers
+});
+
+/**
+ * Parses raw security header config info, returning an object with the appropriate header keys and values.
+ *
+ * @param raw
+ * @internal
+ */
+export function parseRawSecurityResponseHeadersConfig(
+  raw: TypeOf<typeof securityResponseHeadersSchema>
+) {
+  const securityResponseHeaders: Record<string, string | string[]> = {};
+  const { disableEmbedding } = raw;
+
+  if (raw.strictTransportSecurity) {
+    securityResponseHeaders['Strict-Transport-Security'] = raw.strictTransportSecurity;
+  }
+  if (raw.xContentTypeOptions) {
+    securityResponseHeaders['X-Content-Type-Options'] = raw.xContentTypeOptions;
+  }
+  if (raw.referrerPolicy) {
+    securityResponseHeaders['Referrer-Policy'] = raw.referrerPolicy;
+  }
+  if (raw.permissionsPolicy) {
+    securityResponseHeaders['Permissions-Policy'] = raw.permissionsPolicy;
+  }
+  if (disableEmbedding) {
+    securityResponseHeaders['X-Frame-Options'] = 'SAMEORIGIN';
+  }
+
+  return { securityResponseHeaders, disableEmbedding };
+}
diff --git a/src/core/server/http/test_utils.ts b/src/core/server/http/test_utils.ts
index b9b877e193fbd6..c6368a7166bc30 100644
--- a/src/core/server/http/test_utils.ts
+++ b/src/core/server/http/test_utils.ts
@@ -38,6 +38,7 @@ configService.atPath.mockImplementation((path) => {
         disableProtection: true,
         allowlist: [],
       },
+      securityResponseHeaders: {},
       customResponseHeaders: {},
       requestId: {
         allowFromAnyIp: true,
diff --git a/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7.7.2_xpack_100k.test.ts b/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7.7.2_xpack_100k.test.ts
index 7f3ee03f1437d2..0e51c886f7f30d 100644
--- a/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7.7.2_xpack_100k.test.ts
+++ b/src/core/server/saved_objects/migrationsv2/integration_tests/migration_7.7.2_xpack_100k.test.ts
@@ -26,8 +26,7 @@ async function removeLogFile() {
   await asyncUnlink(logFilePath).catch(() => void 0);
 }
 
-// FAILING: https://github.com/elastic/kibana/pull/96788
-describe.skip('migration from 7.7.2-xpack with 100k objects', () => {
+describe('migration from 7.7.2-xpack with 100k objects', () => {
   let esServer: kbnTestServer.TestElasticsearchUtils;
   let root: Root;
   let coreStart: InternalCoreStart;
diff --git a/src/core/server/saved_objects/service/lib/filter_utils.test.ts b/src/core/server/saved_objects/service/lib/filter_utils.test.ts
index 956a60b23809d3..2ef5219ccfff16 100644
--- a/src/core/server/saved_objects/service/lib/filter_utils.test.ts
+++ b/src/core/server/saved_objects/service/lib/filter_utils.test.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { cloneDeep } from 'lodash';
 // @ts-expect-error no ts
 import { esKuery } from '../../es_query';
 
@@ -105,6 +106,22 @@ describe('Filter Utils', () => {
         )
       ).toEqual(esKuery.fromKueryExpression('foo.title: "best"'));
     });
+
+    test('does not mutate the input KueryNode', () => {
+      const input = esKuery.nodeTypes.function.buildNode(
+        'is',
+        `foo.attributes.title`,
+        'best',
+        true
+      );
+
+      const inputCopy = cloneDeep(input);
+
+      validateConvertFilterToKueryNode(['foo'], input, mockMappings);
+
+      expect(input).toEqual(inputCopy);
+    });
+
     test('Validate a simple KQL expression filter', () => {
       expect(
         validateConvertFilterToKueryNode(['foo'], 'foo.attributes.title: "best"', mockMappings)
diff --git a/src/core/server/saved_objects/service/lib/filter_utils.ts b/src/core/server/saved_objects/service/lib/filter_utils.ts
index b3bcef9a62e130..a41a25a27b70dd 100644
--- a/src/core/server/saved_objects/service/lib/filter_utils.ts
+++ b/src/core/server/saved_objects/service/lib/filter_utils.ts
@@ -7,11 +7,12 @@
  */
 
 import { set } from '@elastic/safer-lodash-set';
-import { get } from 'lodash';
+import { get, cloneDeep } from 'lodash';
 import { SavedObjectsErrorHelpers } from './errors';
 import { IndexMapping } from '../../mappings';
 // @ts-expect-error no ts
 import { esKuery } from '../../es_query';
+
 type KueryNode = any;
 
 const astFunctionType = ['is', 'range', 'nested'];
@@ -23,7 +24,7 @@ export const validateConvertFilterToKueryNode = (
 ): KueryNode | undefined => {
   if (filter && indexMapping) {
     const filterKueryNode =
-      typeof filter === 'string' ? esKuery.fromKueryExpression(filter) : filter;
+      typeof filter === 'string' ? esKuery.fromKueryExpression(filter) : cloneDeep(filter);
 
     const validationFilterKuery = validateFilterKueryNode({
       astFilter: filterKueryNode,
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index e8f9dab435754a..e5804b3c9fc580 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -442,6 +442,13 @@ export interface CoreConfigUsageData {
             supportedProtocols: string[];
             clientAuthentication: 'none' | 'optional' | 'required';
         };
+        securityResponseHeaders: {
+            strictTransportSecurity: string;
+            xContentTypeOptions: string;
+            referrerPolicy: string;
+            permissionsPolicyConfigured: boolean;
+            disableEmbedding: boolean;
+        };
     };
     // (undocumented)
     logging: {
@@ -757,6 +764,8 @@ export class CspConfig implements ICspConfig {
     // (undocumented)
     static readonly DEFAULT: CspConfig;
     // (undocumented)
+    readonly disableEmbedding: boolean;
+    // (undocumented)
     readonly header: string;
     // (undocumented)
     readonly rules: string[];
@@ -1113,6 +1122,7 @@ export type IContextProvider<Context extends RequestHandlerContext, ContextName
 
 // @public
 export interface ICspConfig {
+    readonly disableEmbedding: boolean;
     readonly header: string;
     readonly rules: string[];
     readonly strict: boolean;
diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
index c65a3569448a38..c3c8c480f77f2e 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
+++ b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
@@ -116,12 +116,17 @@ kibana_vars=(
     server.compression.referrerWhitelist
     server.cors
     server.cors.origin
-    server.customResponseHeaders
+    server.securityResponseHeaders.strictTransportSecurity
+    server.securityResponseHeaders.xContentTypeOptions
+    server.securityResponseHeaders.referrerPolicy
+    server.securityResponseHeaders.permissionsPolicy
+    server.securityResponseHeaders.disableEmbedding
     server.customResponseHeaders
     server.defaultRoute
     server.host
     server.keepAliveTimeout
     server.maxPayloadBytes
+    server.maxPayload
     server.name
     server.port
     server.rewriteBasePath
@@ -224,6 +229,7 @@ kibana_vars=(
     xpack.maps.enabled
     xpack.maps.showMapVisualizationTypes
     xpack.ml.enabled
+    xpack.observability.unsafe.alertingExperience.enabled
     xpack.reporting.capture.browser.autoDownload
     xpack.reporting.capture.browser.chromium.disableSandbox
     xpack.reporting.capture.browser.chromium.inspect
@@ -268,6 +274,7 @@ kibana_vars=(
     xpack.reporting.queue.timeout
     xpack.reporting.roles.allow
     xpack.rollup.enabled
+    xpack.ruleRegistry.unsafe.write.enabled
     xpack.searchprofiler.enabled
     xpack.security.audit.enabled
     xpack.security.audit.appender.type
diff --git a/src/dev/ci_setup/setup.sh b/src/dev/ci_setup/setup.sh
index dde1cb212c536c..62e1b24d6d559f 100755
--- a/src/dev/ci_setup/setup.sh
+++ b/src/dev/ci_setup/setup.sh
@@ -21,10 +21,6 @@ cp "src/dev/ci_setup/.bazelrc-ci" "$HOME/.bazelrc";
 echo "# Appended by src/dev/ci_setup/setup.sh" >> "$HOME/.bazelrc"
 echo "build --remote_header=x-buildbuddy-api-key=$KIBANA_BUILDBUDDY_CI_API_KEY" >> "$HOME/.bazelrc"
 
-if [[ "$BUILD_TS_REFS_CACHE_ENABLE" != "true" ]]; then
-  export BUILD_TS_REFS_CACHE_ENABLE=false
-fi
-
 ###
 ### install dependencies
 ###
diff --git a/src/dev/typescript/build_ts_refs_cli.ts b/src/dev/typescript/build_ts_refs_cli.ts
index 42b278ce6450c1..00f298887ee17f 100644
--- a/src/dev/typescript/build_ts_refs_cli.ts
+++ b/src/dev/typescript/build_ts_refs_cli.ts
@@ -21,7 +21,7 @@ const CACHE_WORKING_DIR = Path.resolve(REPO_ROOT, 'data/ts_refs_output_cache');
 const TS_ERROR_REF = /\sTS\d{1,6}:\s/;
 
 const isTypeFailure = (error: any) =>
-  error.exitCode === 1 &&
+  error.exitCode > 0 &&
   error.stderr === '' &&
   typeof error.stdout === 'string' &&
   TS_ERROR_REF.test(error.stdout);
diff --git a/src/plugins/console/server/lib/spec_definitions/js/search.ts b/src/plugins/console/server/lib/spec_definitions/js/search.ts
index 686737b96ac839..5a3b37e2e4135b 100644
--- a/src/plugins/console/server/lib/spec_definitions/js/search.ts
+++ b/src/plugins/console/server/lib/spec_definitions/js/search.ts
@@ -16,7 +16,7 @@ export const search = (specService: SpecDefinitionsService) => {
         // populated by a global rule
       },
       profile: {
-        __one_of: ['true', 'false'],
+        __one_of: [true, false],
       },
       aggs: {
         __template: {
@@ -118,6 +118,26 @@ export const search = (specService: SpecDefinitionsService) => {
         },
       },
       docvalue_fields: ['{field}'],
+      fields: {
+        __one_of: [
+          [
+            {
+              __one_of: [
+                '{field}',
+                '*',
+                {
+                  field: '{field}',
+                  include_unmapped: {
+                    __one_of: ['true', 'false'],
+                  },
+                  format: '',
+                },
+              ],
+            },
+          ],
+          '*',
+        ],
+      },
       collapse: {
         __template: {
           field: 'FIELD',
@@ -144,6 +164,19 @@ export const search = (specService: SpecDefinitionsService) => {
           __scope_link: 'GLOBAL.script',
         },
       },
+      runtime_mappings: {
+        __template: {
+          FIELD: {
+            type: '',
+            script: {
+              // populated by a global rule
+            },
+          },
+        },
+        '*': {
+          __scope_link: 'GLOBAL.script',
+        },
+      },
       partial_fields: {
         __template: {
           NAME: {
@@ -160,8 +193,11 @@ export const search = (specService: SpecDefinitionsService) => {
       },
       _source: {
         __one_of: [
-          '{field}',
           ['{field}'],
+          '*',
+          '{field}',
+          true,
+          false,
           {
             includes: {
               __one_of: ['{field}', ['{field}']],
diff --git a/src/plugins/dashboard/kibana.json b/src/plugins/dashboard/kibana.json
index 41335069461fae..54eaf461b73d73 100644
--- a/src/plugins/dashboard/kibana.json
+++ b/src/plugins/dashboard/kibana.json
@@ -11,7 +11,8 @@
     "share",
     "uiActions",
     "urlForwarding",
-    "presentationUtil"
+    "presentationUtil",
+    "visualizations"
   ],
   "optionalPlugins": [
     "home",
diff --git a/src/plugins/dashboard/public/application/_dashboard_app.scss b/src/plugins/dashboard/public/application/_dashboard_app.scss
index 30253afff391fa..f6525377cce70f 100644
--- a/src/plugins/dashboard/public/application/_dashboard_app.scss
+++ b/src/plugins/dashboard/public/application/_dashboard_app.scss
@@ -66,4 +66,17 @@
   .dshUnsavedListingItem__actions {
     flex-direction: column;
   }
-}
\ No newline at end of file
+}
+
+// Temporary fix for two tone icons to make them monochrome
+.dshSolutionToolbar__editorContextMenu--dark {
+  .euiIcon path {
+    fill: $euiColorGhost;
+  }
+}
+
+.dshSolutionToolbar__editorContextMenu--light {
+  .euiIcon path {
+    fill: $euiColorInk;
+  }
+}
diff --git a/src/plugins/dashboard/public/application/dashboard_router.tsx b/src/plugins/dashboard/public/application/dashboard_router.tsx
index e5281a257ee13d..ed68afc5e97b15 100644
--- a/src/plugins/dashboard/public/application/dashboard_router.tsx
+++ b/src/plugins/dashboard/public/application/dashboard_router.tsx
@@ -80,6 +80,7 @@ export async function mountApp({
     embeddable: embeddableStart,
     kibanaLegacy: { dashboardConfig },
     savedObjectsTaggingOss,
+    visualizations,
   } = pluginsStart;
 
   const spacesApi = pluginsStart.spacesOss?.isSpacesAvailable ? pluginsStart.spacesOss : undefined;
@@ -123,6 +124,7 @@ export async function mountApp({
       visualizeCapabilities: { save: Boolean(coreStart.application.capabilities.visualize?.save) },
       storeSearchSession: Boolean(coreStart.application.capabilities.dashboard.storeSearchSession),
     },
+    visualizations,
   };
 
   const getUrlStateStorage = (history: RouteComponentProps['history']) =>
diff --git a/src/plugins/dashboard/public/application/embeddable/dashboard_container_factory.tsx b/src/plugins/dashboard/public/application/embeddable/dashboard_container_factory.tsx
index 9b93f0bbd07119..ff592742488f5d 100644
--- a/src/plugins/dashboard/public/application/embeddable/dashboard_container_factory.tsx
+++ b/src/plugins/dashboard/public/application/embeddable/dashboard_container_factory.tsx
@@ -49,7 +49,7 @@ export class DashboardContainerFactoryDefinition
 
   public readonly getDisplayName = () => {
     return i18n.translate('dashboard.factory.displayName', {
-      defaultMessage: 'dashboard',
+      defaultMessage: 'Dashboard',
     });
   };
 
diff --git a/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap b/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
index 4cd3eb13f36095..138d665866af06 100644
--- a/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
+++ b/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
@@ -287,7 +287,7 @@ exports[`DashboardEmptyScreen renders correctly with edit mode 1`] = `
             <h3
               className="euiTitle euiTitle--xsmall"
             >
-              Add your first panel
+              Add your first visualization
             </h3>
           </EuiTitle>
           <EuiSpacer
diff --git a/src/plugins/dashboard/public/application/listing/dashboard_listing.test.tsx b/src/plugins/dashboard/public/application/listing/dashboard_listing.test.tsx
index c7d5db970db422..022c830b180b67 100644
--- a/src/plugins/dashboard/public/application/listing/dashboard_listing.test.tsx
+++ b/src/plugins/dashboard/public/application/listing/dashboard_listing.test.tsx
@@ -23,6 +23,7 @@ import { createKbnUrlStateStorage } from '../../services/kibana_utils';
 import { savedObjectsPluginMock } from '../../../../saved_objects/public/mocks';
 import { DashboardListing, DashboardListingProps } from './dashboard_listing';
 import { embeddablePluginMock } from '../../../../embeddable/public/mocks';
+import { visualizationsPluginMock } from '../../../../visualizations/public/mocks';
 import { DashboardAppServices, DashboardCapabilities } from '../types';
 import { dataPluginMock } from '../../../../data/public/mocks';
 import { chromeServiceMock, coreMock } from '../../../../../core/public/mocks';
@@ -76,6 +77,7 @@ function makeDefaultServices(): DashboardAppServices {
     dashboardPanelStorage,
     savedDashboards,
     core,
+    visualizations: visualizationsPluginMock.createStartContract(),
   };
 }
 
diff --git a/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx b/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx
index ef0cd376df98b0..e23c249cc7e7aa 100644
--- a/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx
+++ b/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx
@@ -6,26 +6,24 @@
  * Side Public License, v 1.
  */
 
+import { METRIC_TYPE } from '@kbn/analytics';
+import { EuiHorizontalRule } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import angular from 'angular';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 
 import UseUnmount from 'react-use/lib/useUnmount';
+import { BaseVisType, VisTypeAlias } from '../../../../visualizations/public';
 import {
   AddFromLibraryButton,
   PrimaryActionButton,
   QuickButtonGroup,
   SolutionToolbar,
+  QuickButtonProps,
 } from '../../../../presentation_util/public';
 import { useKibana } from '../../services/kibana_react';
 import { IndexPattern, SavedQuery, TimefilterContract } from '../../services/data';
-import {
-  EmbeddableFactoryNotFoundError,
-  EmbeddableInput,
-  isErrorEmbeddable,
-  openAddPanelFlyout,
-  ViewMode,
-} from '../../services/embeddable';
+import { isErrorEmbeddable, openAddPanelFlyout, ViewMode } from '../../services/embeddable';
 import {
   getSavedObjectFinder,
   SavedObjectSaveOpts,
@@ -55,6 +53,7 @@ import { DashboardConstants } from '../../dashboard_constants';
 import { getNewDashboardTitle, unsavedChangesBadge } from '../../dashboard_strings';
 import { DASHBOARD_PANELS_UNSAVED_ID } from '../lib/dashboard_panel_storage';
 import { DashboardContainer } from '..';
+import { EditorMenu } from './editor_menu';
 
 export interface DashboardTopNavState {
   chromeIsVisible: boolean;
@@ -104,12 +103,22 @@ export function DashboardTopNav({
     dashboardCapabilities,
     dashboardPanelStorage,
     allowByValueEmbeddables,
+    visualizations,
+    usageCollection,
   } = useKibana<DashboardAppServices>().services;
 
   const [state, setState] = useState<DashboardTopNavState>({ chromeIsVisible: false });
   const [isSaveInProgress, setIsSaveInProgress] = useState(false);
 
+  const lensAlias = visualizations.getAliases().find(({ name }) => name === 'lens');
+  const quickButtonVisTypes = ['markdown', 'maps'];
   const stateTransferService = embeddable.getStateTransfer();
+  const IS_DARK_THEME = uiSettings.get('theme:darkMode');
+
+  const trackUiMetric = usageCollection?.reportUiCounter.bind(
+    usageCollection,
+    DashboardConstants.DASHBOARDS_ID
+  );
 
   useEffect(() => {
     const visibleSubscription = chrome.getIsVisible$().subscribe((chromeIsVisible) => {
@@ -152,27 +161,36 @@ export function DashboardTopNav({
     uiSettings,
   ]);
 
-  const createNew = useCallback(async () => {
-    const type = 'visualization';
-    const factory = embeddable.getEmbeddableFactory(type);
+  const createNewVisType = useCallback(
+    (visType?: BaseVisType | VisTypeAlias) => () => {
+      let path = '';
+      let appId = '';
 
-    if (!factory) {
-      throw new EmbeddableFactoryNotFoundError(type);
-    }
+      if (visType) {
+        if (trackUiMetric) {
+          trackUiMetric(METRIC_TYPE.CLICK, visType.name);
+        }
 
-    await factory.create({} as EmbeddableInput, dashboardContainer);
-  }, [dashboardContainer, embeddable]);
+        if ('aliasPath' in visType) {
+          appId = visType.aliasApp;
+          path = visType.aliasPath;
+        } else {
+          appId = 'visualize';
+          path = `#/create?type=${encodeURIComponent(visType.name)}`;
+        }
+      } else {
+        appId = 'visualize';
+        path = '#/create?';
+      }
 
-  const createNewVisType = useCallback(
-    (newVisType: string) => async () => {
-      stateTransferService.navigateToEditor('visualize', {
-        path: `#/create?type=${encodeURIComponent(newVisType)}`,
+      stateTransferService.navigateToEditor(appId, {
+        path,
         state: {
           originatingApp: DashboardConstants.DASHBOARDS_ID,
         },
       });
     },
-    [stateTransferService]
+    [trackUiMetric, stateTransferService]
   );
 
   const clearAddPanel = useCallback(() => {
@@ -563,38 +581,57 @@ export function DashboardTopNav({
 
   const { TopNavMenu } = navigation.ui;
 
-  const quickButtons = [
-    {
-      iconType: 'visText',
-      createType: i18n.translate('dashboard.solutionToolbar.markdownQuickButtonLabel', {
-        defaultMessage: 'Markdown',
-      }),
-      onClick: createNewVisType('markdown'),
-      'data-test-subj': 'dashboardMarkdownQuickButton',
-    },
-    {
-      iconType: 'controlsHorizontal',
-      createType: i18n.translate('dashboard.solutionToolbar.inputControlsQuickButtonLabel', {
-        defaultMessage: 'Input control',
-      }),
-      onClick: createNewVisType('input_control_vis'),
-      'data-test-subj': 'dashboardInputControlsQuickButton',
-    },
-  ];
+  const getVisTypeQuickButton = (visTypeName: string) => {
+    const visType =
+      visualizations.get(visTypeName) ||
+      visualizations.getAliases().find(({ name }) => name === visTypeName);
+
+    if (visType) {
+      if ('aliasPath' in visType) {
+        const { name, icon, title } = visType as VisTypeAlias;
+
+        return {
+          iconType: icon,
+          createType: title,
+          onClick: createNewVisType(visType as VisTypeAlias),
+          'data-test-subj': `dashboardQuickButton${name}`,
+          isDarkModeEnabled: IS_DARK_THEME,
+        };
+      } else {
+        const { name, icon, title, titleInWizard } = visType as BaseVisType;
+
+        return {
+          iconType: icon,
+          createType: titleInWizard || title,
+          onClick: createNewVisType(visType as BaseVisType),
+          'data-test-subj': `dashboardQuickButton${name}`,
+          isDarkModeEnabled: IS_DARK_THEME,
+        };
+      }
+    }
+
+    return;
+  };
+
+  const quickButtons = quickButtonVisTypes
+    .map(getVisTypeQuickButton)
+    .filter((button) => button) as QuickButtonProps[];
 
   return (
     <>
       <TopNavMenu {...getNavBarProps()} />
+      <EuiHorizontalRule margin="none" />
       {viewMode !== ViewMode.VIEW ? (
-        <SolutionToolbar>
+        <SolutionToolbar isDarkModeEnabled={IS_DARK_THEME}>
           {{
             primaryActionButton: (
               <PrimaryActionButton
+                isDarkModeEnabled={IS_DARK_THEME}
                 label={i18n.translate('dashboard.solutionToolbar.addPanelButtonLabel', {
-                  defaultMessage: 'Create panel',
+                  defaultMessage: 'Create visualization',
                 })}
-                onClick={createNew}
-                iconType="plusInCircleFilled"
+                onClick={createNewVisType(lensAlias)}
+                iconType="lensApp"
                 data-test-subj="dashboardAddNewPanelButton"
               />
             ),
@@ -605,6 +642,12 @@ export function DashboardTopNav({
                 data-test-subj="dashboardAddPanelButton"
               />
             ),
+            extraButtons: [
+              <EditorMenu
+                createNewVisType={createNewVisType}
+                dashboardContainer={dashboardContainer}
+              />,
+            ],
           }}
         </SolutionToolbar>
       ) : null}
diff --git a/src/plugins/dashboard/public/application/top_nav/editor_menu.tsx b/src/plugins/dashboard/public/application/top_nav/editor_menu.tsx
new file mode 100644
index 00000000000000..5205f5b294c4fc
--- /dev/null
+++ b/src/plugins/dashboard/public/application/top_nav/editor_menu.tsx
@@ -0,0 +1,255 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useCallback } from 'react';
+import {
+  EuiContextMenu,
+  EuiContextMenuPanelItemDescriptor,
+  EuiContextMenuItemIcon,
+} from '@elastic/eui';
+import { METRIC_TYPE } from '@kbn/analytics';
+import { i18n } from '@kbn/i18n';
+import { BaseVisType, VisGroups, VisTypeAlias } from '../../../../visualizations/public';
+import { SolutionToolbarPopover } from '../../../../presentation_util/public';
+import { EmbeddableFactoryDefinition, EmbeddableInput } from '../../services/embeddable';
+import { useKibana } from '../../services/kibana_react';
+import { DashboardAppServices } from '../types';
+import { DashboardContainer } from '..';
+import { DashboardConstants } from '../../dashboard_constants';
+import { dashboardReplacePanelAction } from '../../dashboard_strings';
+
+interface Props {
+  /** Dashboard container */
+  dashboardContainer: DashboardContainer;
+  /** Handler for creating new visualization of a specified type */
+  createNewVisType: (visType: BaseVisType | VisTypeAlias) => () => void;
+}
+
+interface FactoryGroup {
+  id: string;
+  appName: string;
+  icon: EuiContextMenuItemIcon;
+  panelId: number;
+  factories: EmbeddableFactoryDefinition[];
+}
+
+export const EditorMenu = ({ dashboardContainer, createNewVisType }: Props) => {
+  const {
+    core,
+    embeddable,
+    visualizations,
+    usageCollection,
+    uiSettings,
+  } = useKibana<DashboardAppServices>().services;
+
+  const IS_DARK_THEME = uiSettings.get('theme:darkMode');
+
+  const trackUiMetric = usageCollection?.reportUiCounter.bind(
+    usageCollection,
+    DashboardConstants.DASHBOARDS_ID
+  );
+
+  const createNewAggsBasedVis = useCallback(
+    (visType?: BaseVisType) => () =>
+      visualizations.showNewVisModal({
+        originatingApp: DashboardConstants.DASHBOARDS_ID,
+        outsideVisualizeApp: true,
+        showAggsSelection: true,
+        selectedVisType: visType,
+      }),
+    [visualizations]
+  );
+
+  const getVisTypesByGroup = (group: VisGroups) =>
+    visualizations
+      .getByGroup(group)
+      .sort(({ name: a }: BaseVisType | VisTypeAlias, { name: b }: BaseVisType | VisTypeAlias) => {
+        if (a < b) {
+          return -1;
+        }
+        if (a > b) {
+          return 1;
+        }
+        return 0;
+      })
+      .filter(({ hidden }: BaseVisType) => !hidden);
+
+  const promotedVisTypes = getVisTypesByGroup(VisGroups.PROMOTED);
+  const aggsBasedVisTypes = getVisTypesByGroup(VisGroups.AGGBASED);
+  const toolVisTypes = getVisTypesByGroup(VisGroups.TOOLS);
+  const visTypeAliases = visualizations
+    .getAliases()
+    .sort(({ promotion: a = false }: VisTypeAlias, { promotion: b = false }: VisTypeAlias) =>
+      a === b ? 0 : a ? -1 : 1
+    );
+
+  const factories = embeddable
+    ? Array.from(embeddable.getEmbeddableFactories()).filter(
+        ({ type, isEditable, canCreateNew, isContainerType }) =>
+          isEditable() && !isContainerType && canCreateNew() && type !== 'visualization'
+      )
+    : [];
+
+  const factoryGroupMap: Record<string, FactoryGroup> = {};
+  const ungroupedFactories: EmbeddableFactoryDefinition[] = [];
+  const aggBasedPanelID = 1;
+
+  let panelCount = 1 + aggBasedPanelID;
+
+  factories.forEach((factory: EmbeddableFactoryDefinition, index) => {
+    const { grouping } = factory;
+
+    if (grouping) {
+      grouping.forEach((group) => {
+        if (factoryGroupMap[group.id]) {
+          factoryGroupMap[group.id].factories.push(factory);
+        } else {
+          factoryGroupMap[group.id] = {
+            id: group.id,
+            appName: group.getDisplayName ? group.getDisplayName({ embeddable }) : group.id,
+            icon: (group.getIconType
+              ? group.getIconType({ embeddable })
+              : 'empty') as EuiContextMenuItemIcon,
+            factories: [factory],
+            panelId: panelCount,
+          };
+
+          panelCount++;
+        }
+      });
+    } else {
+      ungroupedFactories.push(factory);
+    }
+  });
+
+  const getVisTypeMenuItem = (visType: BaseVisType): EuiContextMenuPanelItemDescriptor => {
+    const { name, title, titleInWizard, description, icon = 'empty', group } = visType;
+    return {
+      name: titleInWizard || title,
+      icon: icon as string,
+      onClick:
+        group === VisGroups.AGGBASED ? createNewAggsBasedVis(visType) : createNewVisType(visType),
+      'data-test-subj': `visType-${name}`,
+      toolTipContent: description,
+    };
+  };
+
+  const getVisTypeAliasMenuItem = (
+    visTypeAlias: VisTypeAlias
+  ): EuiContextMenuPanelItemDescriptor => {
+    const { name, title, description, icon = 'empty' } = visTypeAlias;
+
+    return {
+      name: title,
+      icon,
+      onClick: createNewVisType(visTypeAlias),
+      'data-test-subj': `visType-${name}`,
+      toolTipContent: description,
+    };
+  };
+
+  const getEmbeddableFactoryMenuItem = (
+    factory: EmbeddableFactoryDefinition
+  ): EuiContextMenuPanelItemDescriptor => {
+    const icon = factory?.getIconType ? factory.getIconType() : 'empty';
+
+    const toolTipContent = factory?.getDescription ? factory.getDescription() : undefined;
+
+    return {
+      name: factory.getDisplayName(),
+      icon,
+      toolTipContent,
+      onClick: async () => {
+        if (trackUiMetric) {
+          trackUiMetric(METRIC_TYPE.CLICK, factory.type);
+        }
+        let newEmbeddable;
+        if (factory.getExplicitInput) {
+          const explicitInput = await factory.getExplicitInput();
+          newEmbeddable = await dashboardContainer.addNewEmbeddable(factory.type, explicitInput);
+        } else {
+          newEmbeddable = await factory.create({} as EmbeddableInput, dashboardContainer);
+        }
+
+        if (newEmbeddable) {
+          core.notifications.toasts.addSuccess({
+            title: dashboardReplacePanelAction.getSuccessMessage(
+              `'${newEmbeddable.getInput().title}'` || ''
+            ),
+            'data-test-subj': 'addEmbeddableToDashboardSuccess',
+          });
+        }
+      },
+      'data-test-subj': `createNew-${factory.type}`,
+    };
+  };
+
+  const aggsPanelTitle = i18n.translate('dashboard.editorMenu.aggBasedGroupTitle', {
+    defaultMessage: 'Aggregation based',
+  });
+
+  const editorMenuPanels = [
+    {
+      id: 0,
+      items: [
+        ...visTypeAliases.map(getVisTypeAliasMenuItem),
+        ...Object.values(factoryGroupMap).map(({ id, appName, icon, panelId }) => ({
+          name: appName,
+          icon,
+          panel: panelId,
+          'data-test-subj': `dashboardEditorMenu-${id}Group`,
+        })),
+        ...ungroupedFactories.map(getEmbeddableFactoryMenuItem),
+        ...promotedVisTypes.map(getVisTypeMenuItem),
+        {
+          name: aggsPanelTitle,
+          icon: 'visualizeApp',
+          panel: aggBasedPanelID,
+          'data-test-subj': `dashboardEditorAggBasedMenuItem`,
+        },
+        ...toolVisTypes.map(getVisTypeMenuItem),
+      ],
+    },
+    {
+      id: aggBasedPanelID,
+      title: aggsPanelTitle,
+      items: aggsBasedVisTypes.map(getVisTypeMenuItem),
+    },
+    ...Object.values(factoryGroupMap).map(
+      ({ appName, panelId, factories: groupFactories }: FactoryGroup) => ({
+        id: panelId,
+        title: appName,
+        items: groupFactories.map(getEmbeddableFactoryMenuItem),
+      })
+    ),
+  ];
+
+  return (
+    <SolutionToolbarPopover
+      ownFocus
+      label={i18n.translate('dashboard.solutionToolbar.editorMenuButtonLabel', {
+        defaultMessage: 'All types',
+      })}
+      iconType="arrowDown"
+      iconSide="right"
+      panelPaddingSize="none"
+      data-test-subj="dashboardEditorMenuButton"
+    >
+      <EuiContextMenu
+        initialPanelId={0}
+        panels={editorMenuPanels}
+        className={`dshSolutionToolbar__editorContextMenu ${
+          IS_DARK_THEME
+            ? 'dshSolutionToolbar__editorContextMenu--dark'
+            : 'dshSolutionToolbar__editorContextMenu--light'
+        }`}
+        data-test-subj="dashboardEditorContextMenu"
+      />
+    </SolutionToolbarPopover>
+  );
+};
diff --git a/src/plugins/dashboard/public/application/types.ts b/src/plugins/dashboard/public/application/types.ts
index 6415fdfd73ee8b..dd291291ce9d61 100644
--- a/src/plugins/dashboard/public/application/types.ts
+++ b/src/plugins/dashboard/public/application/types.ts
@@ -25,6 +25,7 @@ import { DataPublicPluginStart, IndexPatternsContract } from '../services/data';
 import { SavedObjectLoader, SavedObjectsStart } from '../services/saved_objects';
 import { DashboardPanelStorage } from './lib';
 import { UrlForwardingStart } from '../../../url_forwarding/public';
+import { VisualizationsStart } from '../../../visualizations/public';
 
 export type DashboardRedirect = (props: RedirectToProps) => void;
 export type RedirectToProps =
@@ -83,4 +84,5 @@ export interface DashboardAppServices {
   savedObjectsClient: SavedObjectsClientContract;
   setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
   savedQueryService: DataPublicPluginStart['query']['savedQueries'];
+  visualizations: VisualizationsStart;
 }
diff --git a/src/plugins/dashboard/public/dashboard_strings.ts b/src/plugins/dashboard/public/dashboard_strings.ts
index 79a59d0cfa6051..531ff815312cfe 100644
--- a/src/plugins/dashboard/public/dashboard_strings.ts
+++ b/src/plugins/dashboard/public/dashboard_strings.ts
@@ -377,7 +377,7 @@ export const emptyScreenStrings = {
     }),
   getEmptyWidgetTitle: () =>
     i18n.translate('dashboard.emptyWidget.addPanelTitle', {
-      defaultMessage: 'Add your first panel',
+      defaultMessage: 'Add your first visualization',
     }),
   getEmptyWidgetDescription: () =>
     i18n.translate('dashboard.emptyWidget.addPanelDescription', {
diff --git a/src/plugins/dashboard/public/plugin.tsx b/src/plugins/dashboard/public/plugin.tsx
index e2f52a47455b31..0fad1c51f433ae 100644
--- a/src/plugins/dashboard/public/plugin.tsx
+++ b/src/plugins/dashboard/public/plugin.tsx
@@ -24,6 +24,7 @@ import {
   PluginInitializerContext,
   SavedObjectsClientContract,
 } from '../../../core/public';
+import { VisualizationsStart } from '../../visualizations/public';
 
 import { createKbnUrlTracker } from './services/kibana_utils';
 import { UsageCollectionSetup } from './services/usage_collection';
@@ -115,6 +116,7 @@ export interface DashboardStartDependencies {
   presentationUtil: PresentationUtilPluginStart;
   savedObjectsTaggingOss?: SavedObjectTaggingOssPluginStart;
   spacesOss?: SpacesOssPluginStart;
+  visualizations: VisualizationsStart;
 }
 
 export type DashboardSetup = void;
diff --git a/src/plugins/dashboard/server/plugin.ts b/src/plugins/dashboard/server/plugin.ts
index 3aeaf31c190bdc..fbed98a882b0ab 100644
--- a/src/plugins/dashboard/server/plugin.ts
+++ b/src/plugins/dashboard/server/plugin.ts
@@ -18,7 +18,7 @@ import { createDashboardSavedObjectType } from './saved_objects';
 import { capabilitiesProvider } from './capabilities_provider';
 
 import { DashboardPluginSetup, DashboardPluginStart } from './types';
-import { EmbeddableSetup, EmbeddableStart } from '../../embeddable/server';
+import { EmbeddableSetup } from '../../embeddable/server';
 import { UsageCollectionSetup } from '../../usage_collection/server';
 import { registerDashboardUsageCollector } from './usage/register_collector';
 import { dashboardPersistableStateServiceFactory } from './embeddable/dashboard_container_embeddable_factory';
@@ -28,19 +28,15 @@ interface SetupDeps {
   usageCollection: UsageCollectionSetup;
 }
 
-interface StartDeps {
-  embeddable: EmbeddableStart;
-}
-
 export class DashboardPlugin
-  implements Plugin<DashboardPluginSetup, DashboardPluginStart, SetupDeps, StartDeps> {
+  implements Plugin<DashboardPluginSetup, DashboardPluginStart, SetupDeps> {
   private readonly logger: Logger;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.logger = initializerContext.logger.get();
   }
 
-  public setup(core: CoreSetup<StartDeps>, plugins: SetupDeps) {
+  public setup(core: CoreSetup, plugins: SetupDeps) {
     this.logger.debug('dashboard: Setup');
 
     core.savedObjects.registerType(
@@ -54,13 +50,9 @@ export class DashboardPlugin
 
     registerDashboardUsageCollector(plugins.usageCollection, plugins.embeddable);
 
-    (async () => {
-      const [, startPlugins] = await core.getStartServices();
-
-      plugins.embeddable.registerEmbeddableFactory(
-        dashboardPersistableStateServiceFactory(startPlugins.embeddable)
-      );
-    })();
+    plugins.embeddable.registerEmbeddableFactory(
+      dashboardPersistableStateServiceFactory(plugins.embeddable)
+    );
 
     return {};
   }
diff --git a/src/plugins/data/common/search/aggs/agg_configs.test.ts b/src/plugins/data/common/search/aggs/agg_configs.test.ts
index 3ce528e6ed8932..28102544ae0553 100644
--- a/src/plugins/data/common/search/aggs/agg_configs.test.ts
+++ b/src/plugins/data/common/search/aggs/agg_configs.test.ts
@@ -342,8 +342,8 @@ describe('AggConfigs', () => {
         { enabled: true, type: 'max', schema: 'metric', params: { field: 'bytes' } },
       ];
 
-      const ac = new AggConfigs(indexPattern, configStates, { typesRegistry });
-      const topLevelDsl = ac.toDsl(true);
+      const ac = new AggConfigs(indexPattern, configStates, { typesRegistry, hierarchical: true });
+      const topLevelDsl = ac.toDsl();
       const buckets = ac.bySchemaName('buckets');
       const metrics = ac.bySchemaName('metrics');
 
@@ -412,8 +412,8 @@ describe('AggConfigs', () => {
         },
       ];
 
-      const ac = new AggConfigs(indexPattern, configStates, { typesRegistry });
-      const topLevelDsl = ac.toDsl(true)['2'];
+      const ac = new AggConfigs(indexPattern, configStates, { typesRegistry, hierarchical: true });
+      const topLevelDsl = ac.toDsl()['2'];
 
       expect(Object.keys(topLevelDsl.aggs)).toContain('1');
       expect(Object.keys(topLevelDsl.aggs)).toContain('1-bucket');
diff --git a/src/plugins/data/common/search/aggs/agg_configs.ts b/src/plugins/data/common/search/aggs/agg_configs.ts
index 4d5d49754387d6..2932ef7325aed8 100644
--- a/src/plugins/data/common/search/aggs/agg_configs.ts
+++ b/src/plugins/data/common/search/aggs/agg_configs.ts
@@ -43,6 +43,7 @@ function parseParentAggs(dslLvlCursor: any, dsl: any) {
 
 export interface AggConfigsOptions {
   typesRegistry: AggTypesRegistryStart;
+  hierarchical?: boolean;
 }
 
 export type CreateAggConfigParams = Assign<AggConfigSerialized, { type: string | IAggType }>;
@@ -65,6 +66,8 @@ export class AggConfigs {
   public indexPattern: IndexPattern;
   public timeRange?: TimeRange;
   public timeFields?: string[];
+  public hierarchical?: boolean = false;
+
   private readonly typesRegistry: AggTypesRegistryStart;
 
   aggs: IAggConfig[];
@@ -80,6 +83,7 @@ export class AggConfigs {
 
     this.aggs = [];
     this.indexPattern = indexPattern;
+    this.hierarchical = opts.hierarchical;
 
     configStates.forEach((params: any) => this.createAggConfig(params));
   }
@@ -174,12 +178,12 @@ export class AggConfigs {
     return true;
   }
 
-  toDsl(hierarchical: boolean = false): Record<string, any> {
+  toDsl(): Record<string, any> {
     const dslTopLvl = {};
     let dslLvlCursor: Record<string, any>;
     let nestedMetrics: Array<{ config: AggConfig; dsl: Record<string, any> }> | [];
 
-    if (hierarchical) {
+    if (this.hierarchical) {
       // collect all metrics, and filter out the ones that we won't be copying
       nestedMetrics = this.aggs
         .filter(function (agg) {
diff --git a/src/plugins/data/common/search/aggs/agg_type.ts b/src/plugins/data/common/search/aggs/agg_type.ts
index 33fdc45a605b71..f0f3912bf64fea 100644
--- a/src/plugins/data/common/search/aggs/agg_type.ts
+++ b/src/plugins/data/common/search/aggs/agg_type.ts
@@ -13,12 +13,23 @@ import { ISearchSource } from 'src/plugins/data/public';
 import { DatatableColumnType, SerializedFieldFormat } from 'src/plugins/expressions/common';
 import type { RequestAdapter } from 'src/plugins/inspector/common';
 
+import { estypes } from '@elastic/elasticsearch';
 import { initParams } from './agg_params';
 import { AggConfig } from './agg_config';
 import { IAggConfigs } from './agg_configs';
 import { BaseParamType } from './param_types/base';
 import { AggParamType } from './param_types/agg';
 
+type PostFlightRequestFn<TAggConfig> = (
+  resp: estypes.SearchResponse<any>,
+  aggConfigs: IAggConfigs,
+  aggConfig: TAggConfig,
+  searchSource: ISearchSource,
+  inspectorRequestAdapter?: RequestAdapter,
+  abortSignal?: AbortSignal,
+  searchSessionId?: string
+) => Promise<estypes.SearchResponse<any>>;
+
 export interface AggTypeConfig<
   TAggConfig extends AggConfig = AggConfig,
   TParam extends AggParamType<TAggConfig> = AggParamType<TAggConfig>
@@ -40,15 +51,7 @@ export interface AggTypeConfig<
   customLabels?: boolean;
   json?: boolean;
   decorateAggConfig?: () => any;
-  postFlightRequest?: (
-    resp: any,
-    aggConfigs: IAggConfigs,
-    aggConfig: TAggConfig,
-    searchSource: ISearchSource,
-    inspectorRequestAdapter?: RequestAdapter,
-    abortSignal?: AbortSignal,
-    searchSessionId?: string
-  ) => Promise<any>;
+  postFlightRequest?: PostFlightRequestFn<TAggConfig>;
   getSerializedFormat?: (agg: TAggConfig) => SerializedFieldFormat;
   getValue?: (agg: TAggConfig, bucket: any) => any;
   getKey?: (bucket: any, key: any, agg: TAggConfig) => any;
@@ -188,15 +191,7 @@ export class AggType<
    * @param searchSessionId - searchSessionId to be used for grouping requests into a single search session
    * @return {Promise}
    */
-  postFlightRequest: (
-    resp: any,
-    aggConfigs: IAggConfigs,
-    aggConfig: TAggConfig,
-    searchSource: ISearchSource,
-    inspectorRequestAdapter?: RequestAdapter,
-    abortSignal?: AbortSignal,
-    searchSessionId?: string
-  ) => Promise<any>;
+  postFlightRequest: PostFlightRequestFn<TAggConfig>;
   /**
    * Get the serialized format for the values produced by this agg type,
    * overridden by several metrics that always output a simple number.
diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
index 56e720d237c455..2aa0d346afe343 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.test.ts
@@ -433,7 +433,7 @@ describe('Terms Agg Other bucket helper', () => {
           aggConfigs.aggs[0] as IBucketAggConfig,
           otherAggConfig()
         );
-        expect(mergedResponse.aggregations['1'].buckets[3].key).toEqual('__other__');
+        expect((mergedResponse!.aggregations!['1'] as any).buckets[3].key).toEqual('__other__');
       }
     });
 
@@ -455,7 +455,7 @@ describe('Terms Agg Other bucket helper', () => {
           otherAggConfig()
         );
 
-        expect(mergedResponse.aggregations['1'].buckets[1]['2'].buckets[3].key).toEqual(
+        expect((mergedResponse!.aggregations!['1'] as any).buckets[1]['2'].buckets[3].key).toEqual(
           '__other__'
         );
       }
@@ -471,7 +471,7 @@ describe('Terms Agg Other bucket helper', () => {
         aggConfigs.aggs[0] as IBucketAggConfig
       );
       expect(
-        updatedResponse.aggregations['1'].buckets.find(
+        (updatedResponse!.aggregations!['1'] as any).buckets.find(
           (bucket: Record<string, any>) => bucket.key === '__missing__'
         )
       ).toBeDefined();
diff --git a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
index 742615bc49d8fa..6230ae897b1702 100644
--- a/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
+++ b/src/plugins/data/common/search/aggs/buckets/_terms_other_bucket_helper.ts
@@ -7,6 +7,7 @@
  */
 
 import { isNumber, keys, values, find, each, cloneDeep, flatten } from 'lodash';
+import { estypes } from '@elastic/elasticsearch';
 import { buildExistsFilter, buildPhrasesFilter, buildQueryFromFilters } from '../../../../common';
 import { AggGroupNames } from '../agg_groups';
 import { IAggConfigs } from '../agg_configs';
@@ -42,7 +43,7 @@ const getNestedAggDSL = (aggNestedDsl: Record<string, any>, startFromAggId: stri
  */
 const getAggResultBuckets = (
   aggConfigs: IAggConfigs,
-  response: any,
+  response: estypes.SearchResponse<any>['aggregations'],
   aggWithOtherBucket: IBucketAggConfig,
   key: string
 ) => {
@@ -72,8 +73,8 @@ const getAggResultBuckets = (
       }
     }
   }
-  if (responseAgg[aggWithOtherBucket.id]) {
-    return responseAgg[aggWithOtherBucket.id].buckets;
+  if (responseAgg?.[aggWithOtherBucket.id]) {
+    return (responseAgg[aggWithOtherBucket.id] as any).buckets;
   }
   return [];
 };
@@ -235,11 +236,11 @@ export const buildOtherBucketAgg = (
 
 export const mergeOtherBucketAggResponse = (
   aggsConfig: IAggConfigs,
-  response: any,
+  response: estypes.SearchResponse<any>,
   otherResponse: any,
   otherAgg: IBucketAggConfig,
   requestAgg: Record<string, any>
-) => {
+): estypes.SearchResponse<any> => {
   const updatedResponse = cloneDeep(response);
   each(otherResponse.aggregations['other-filter'].buckets, (bucket, key) => {
     if (!bucket.doc_count || key === undefined) return;
@@ -276,7 +277,7 @@ export const mergeOtherBucketAggResponse = (
 };
 
 export const updateMissingBucket = (
-  response: any,
+  response: estypes.SearchResponse<any>,
   aggConfigs: IAggConfigs,
   agg: IBucketAggConfig
 ) => {
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts
index e694591c7b33d1..6fbaddb09b2262 100644
--- a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.test.ts
@@ -109,7 +109,7 @@ describe('TimeBuckets', () => {
     }
   });
 
-  test('setInterval/getInterval - intreval is a "auto"', () => {
+  test('setInterval/getInterval - interval is a "auto"', () => {
     const timeBuckets = new TimeBuckets(timeBucketConfig);
     timeBuckets.setInterval(autoInterval);
     const interval = timeBuckets.getInterval();
@@ -120,6 +120,16 @@ describe('TimeBuckets', () => {
     expect(interval.expression).toEqual('0ms');
   });
 
+  test('setInterval/getInterval - interval is a "auto" (useNormalizedEsInterval is false)', () => {
+    const timeBuckets = new TimeBuckets(timeBucketConfig);
+    timeBuckets.setInterval(autoInterval);
+    const interval = timeBuckets.getInterval(false);
+
+    expect(interval.esValue).toEqual(0);
+    expect(interval.esUnit).toEqual('ms');
+    expect(interval.expression).toEqual('0ms');
+  });
+
   test('getScaledDateFormat', () => {
     const timeBuckets = new TimeBuckets(timeBucketConfig);
     timeBuckets.setInterval('20m');
diff --git a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts
index ac58cea60a6ef4..12c6d39ad905aa 100644
--- a/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts
+++ b/src/plugins/data/common/search/aggs/buckets/lib/time_buckets/time_buckets.ts
@@ -267,9 +267,10 @@ export class TimeBuckets {
         originalUnit = splitStringInterval(this._originalInterval!)?.unit;
       }
 
-      const esInterval = useNormalizedEsInterval
-        ? convertDurationToNormalizedEsInterval(interval, originalUnit)
-        : convertIntervalToEsInterval(String(this._originalInterval));
+      const esInterval =
+        useNormalizedEsInterval || !this._originalInterval
+          ? convertDurationToNormalizedEsInterval(interval, originalUnit)
+          : convertIntervalToEsInterval(this._originalInterval);
 
       const prettyUnits = moment.normalizeUnits(esInterval.unit);
 
diff --git a/src/plugins/data/common/search/aggs/buckets/terms.ts b/src/plugins/data/common/search/aggs/buckets/terms.ts
index 77c9c6e391c0a0..03cf14a577a509 100644
--- a/src/plugins/data/common/search/aggs/buckets/terms.ts
+++ b/src/plugins/data/common/search/aggs/buckets/terms.ts
@@ -101,25 +101,21 @@ export const getTermsBucketAgg = () =>
 
         nestedSearchSource.setField('aggs', filterAgg);
 
-        const requestResponder = inspectorRequestAdapter?.start(
-          i18n.translate('data.search.aggs.buckets.terms.otherBucketTitle', {
-            defaultMessage: 'Other bucket',
-          }),
-          {
-            description: i18n.translate('data.search.aggs.buckets.terms.otherBucketDescription', {
-              defaultMessage:
-                'This request counts the number of documents that fall ' +
-                'outside the criterion of the data buckets.',
-            }),
-            searchSessionId,
-          }
-        );
-
         const response = await nestedSearchSource
           .fetch$({
             abortSignal,
             sessionId: searchSessionId,
-            requestResponder,
+            inspector: {
+              adapter: inspectorRequestAdapter,
+              title: i18n.translate('data.search.aggs.buckets.terms.otherBucketTitle', {
+                defaultMessage: 'Other bucket',
+              }),
+              description: i18n.translate('data.search.aggs.buckets.terms.otherBucketDescription', {
+                defaultMessage:
+                  'This request counts the number of documents that fall ' +
+                  'outside the criterion of the data buckets.',
+              }),
+            },
           })
           .toPromise();
 
diff --git a/src/plugins/data/common/search/expressions/esaggs/request_handler.test.ts b/src/plugins/data/common/search/expressions/esaggs/request_handler.test.ts
index c2566535916a8b..b30e5740fa3fb0 100644
--- a/src/plugins/data/common/search/expressions/esaggs/request_handler.test.ts
+++ b/src/plugins/data/common/search/expressions/esaggs/request_handler.test.ts
@@ -9,7 +9,7 @@
 import type { MockedKeys } from '@kbn/utility-types/jest';
 import type { Filter } from '../../../es_query';
 import type { IndexPattern } from '../../../index_patterns';
-import type { IAggConfig, IAggConfigs } from '../../aggs';
+import type { IAggConfigs } from '../../aggs';
 import type { ISearchSource } from '../../search_source';
 import { searchSourceCommonMock } from '../../search_source/mocks';
 
@@ -38,7 +38,6 @@ describe('esaggs expression function - public', () => {
       filters: undefined,
       indexPattern: ({ id: 'logstash-*' } as unknown) as jest.Mocked<IndexPattern>,
       inspectorAdapters: {},
-      metricsAtAllLevels: false,
       partialRows: false,
       query: undefined,
       searchSessionId: 'abc123',
@@ -76,21 +75,7 @@ describe('esaggs expression function - public', () => {
 
     test('setField(aggs)', async () => {
       expect(searchSource.setField).toHaveBeenCalledTimes(5);
-      expect(typeof (searchSource.setField as jest.Mock).mock.calls[2][1]).toBe('function');
-      expect((searchSource.setField as jest.Mock).mock.calls[2][1]()).toEqual(
-        mockParams.aggs.toDsl()
-      );
-      expect(mockParams.aggs.toDsl).toHaveBeenCalledWith(mockParams.metricsAtAllLevels);
-
-      // make sure param is passed through
-      jest.clearAllMocks();
-      await handleRequest({
-        ...mockParams,
-        metricsAtAllLevels: true,
-      });
-      searchSource = await mockParams.searchSourceService.create();
-      (searchSource.setField as jest.Mock).mock.calls[2][1]();
-      expect(mockParams.aggs.toDsl).toHaveBeenCalledWith(true);
+      expect((searchSource.setField as jest.Mock).mock.calls[2][1]).toEqual(mockParams.aggs);
     });
 
     test('setField(filter)', async () => {
@@ -133,36 +118,24 @@ describe('esaggs expression function - public', () => {
   test('calls searchSource.fetch', async () => {
     await handleRequest(mockParams);
     const searchSource = await mockParams.searchSourceService.create();
+
     expect(searchSource.fetch$).toHaveBeenCalledWith({
       abortSignal: mockParams.abortSignal,
       sessionId: mockParams.searchSessionId,
+      inspector: {
+        title: 'Data',
+        description: 'This request queries Elasticsearch to fetch the data for the visualization.',
+        adapter: undefined,
+      },
     });
   });
 
-  test('calls agg.postFlightRequest if it exiests and agg is enabled', async () => {
-    mockParams.aggs.aggs[0].enabled = true;
-    await handleRequest(mockParams);
-    expect(mockParams.aggs.aggs[0].type.postFlightRequest).toHaveBeenCalledTimes(1);
-
-    // ensure it works if the function doesn't exist
-    jest.clearAllMocks();
-    mockParams.aggs.aggs[0] = ({ type: { name: 'count' } } as unknown) as IAggConfig;
-    expect(async () => await handleRequest(mockParams)).not.toThrowError();
-  });
-
-  test('should skip agg.postFlightRequest call if the agg is disabled', async () => {
-    mockParams.aggs.aggs[0].enabled = false;
-    await handleRequest(mockParams);
-    expect(mockParams.aggs.aggs[0].type.postFlightRequest).toHaveBeenCalledTimes(0);
-  });
-
   test('tabifies response data', async () => {
     await handleRequest(mockParams);
     expect(tabifyAggResponse).toHaveBeenCalledWith(
       mockParams.aggs,
       {},
       {
-        metricsAtAllLevels: mockParams.metricsAtAllLevels,
         partialRows: mockParams.partialRows,
         timeRange: mockParams.timeRange,
       }
diff --git a/src/plugins/data/common/search/expressions/esaggs/request_handler.ts b/src/plugins/data/common/search/expressions/esaggs/request_handler.ts
index 5620698a475386..173b2067cad6bc 100644
--- a/src/plugins/data/common/search/expressions/esaggs/request_handler.ts
+++ b/src/plugins/data/common/search/expressions/esaggs/request_handler.ts
@@ -40,28 +40,12 @@ export interface RequestHandlerParams {
   getNow?: () => Date;
 }
 
-function getRequestMainResponder(inspectorAdapters: Adapters, searchSessionId?: string) {
-  return inspectorAdapters.requests?.start(
-    i18n.translate('data.functions.esaggs.inspector.dataRequest.title', {
-      defaultMessage: 'Data',
-    }),
-    {
-      description: i18n.translate('data.functions.esaggs.inspector.dataRequest.description', {
-        defaultMessage:
-          'This request queries Elasticsearch to fetch the data for the visualization.',
-      }),
-      searchSessionId,
-    }
-  );
-}
-
 export const handleRequest = async ({
   abortSignal,
   aggs,
   filters,
   indexPattern,
   inspectorAdapters,
-  metricsAtAllLevels,
   partialRows,
   query,
   searchSessionId,
@@ -100,9 +84,7 @@ export const handleRequest = async ({
     },
   });
 
-  requestSearchSource.setField('aggs', function () {
-    return aggs.toDsl(metricsAtAllLevels);
-  });
+  requestSearchSource.setField('aggs', aggs);
 
   requestSearchSource.onRequestStart((paramSearchSource, options) => {
     return aggs.onSearchRequestStart(paramSearchSource, options);
@@ -128,35 +110,27 @@ export const handleRequest = async ({
   requestSearchSource.setField('query', query);
 
   inspectorAdapters.requests?.reset();
-  const requestResponder = getRequestMainResponder(inspectorAdapters, searchSessionId);
 
-  const response$ = await requestSearchSource.fetch$({
-    abortSignal,
-    sessionId: searchSessionId,
-    requestResponder,
-  });
-
-  // Note that rawResponse is not deeply cloned here, so downstream applications using courier
-  // must take care not to mutate it, or it could have unintended side effects, e.g. displaying
-  // response data incorrectly in the inspector.
-  let response = await response$.toPromise();
-  for (const agg of aggs.aggs) {
-    if (agg.enabled && typeof agg.type.postFlightRequest === 'function') {
-      response = await agg.type.postFlightRequest(
-        response,
-        aggs,
-        agg,
-        requestSearchSource,
-        inspectorAdapters.requests,
-        abortSignal,
-        searchSessionId
-      );
-    }
-  }
+  const response = await requestSearchSource
+    .fetch$({
+      abortSignal,
+      sessionId: searchSessionId,
+      inspector: {
+        adapter: inspectorAdapters.requests,
+        title: i18n.translate('data.functions.esaggs.inspector.dataRequest.title', {
+          defaultMessage: 'Data',
+        }),
+        description: i18n.translate('data.functions.esaggs.inspector.dataRequest.description', {
+          defaultMessage:
+            'This request queries Elasticsearch to fetch the data for the visualization.',
+        }),
+      },
+    })
+    .toPromise();
 
   const parsedTimeRange = timeRange ? calculateBounds(timeRange, { forceNow }) : null;
   const tabifyParams = {
-    metricsAtAllLevels,
+    metricsAtAllLevels: aggs.hierarchical,
     partialRows,
     timeRange: parsedTimeRange
       ? { from: parsedTimeRange.min, to: parsedTimeRange.max, timeFields: allTimeFields }
diff --git a/src/plugins/data/common/search/search_source/inspect/inspector_stats.ts b/src/plugins/data/common/search/search_source/inspect/inspector_stats.ts
index 24507a7e13058e..e5a3acc23eee89 100644
--- a/src/plugins/data/common/search/search_source/inspect/inspector_stats.ts
+++ b/src/plugins/data/common/search/search_source/inspect/inspector_stats.ts
@@ -50,7 +50,7 @@ export function getRequestInspectorStats(searchSource: ISearchSource) {
 
 /** @public */
 export function getResponseInspectorStats(
-  resp: estypes.SearchResponse<unknown>,
+  resp?: estypes.SearchResponse<unknown>,
   searchSource?: ISearchSource
 ) {
   const lastRequest =
diff --git a/src/plugins/data/common/search/search_source/search_source.test.ts b/src/plugins/data/common/search/search_source/search_source.test.ts
index 3726e5d0c33e8c..012fc5257397b5 100644
--- a/src/plugins/data/common/search/search_source/search_source.test.ts
+++ b/src/plugins/data/common/search/search_source/search_source.test.ts
@@ -11,6 +11,10 @@ import { IndexPattern } from '../../index_patterns';
 import { GetConfigFn } from '../../types';
 import { fetchSoon } from './legacy';
 import { SearchSource, SearchSourceDependencies, SortDirection } from './';
+import { AggConfigs, AggTypesRegistryStart } from '../../';
+import { mockAggTypesRegistry } from '../aggs/test_helpers';
+import { RequestResponder } from 'src/plugins/inspector/common';
+import { switchMap } from 'rxjs/operators';
 
 jest.mock('./legacy', () => ({
   fetchSoon: jest.fn().mockResolvedValue({}),
@@ -39,6 +43,21 @@ const indexPattern2 = ({
   getSourceFiltering: () => mockSource2,
 } as unknown) as IndexPattern;
 
+const fields3 = [{ name: 'foo-bar' }, { name: 'field1' }, { name: 'field2' }];
+const indexPattern3 = ({
+  title: 'foo',
+  fields: {
+    getByName: (name: string) => {
+      return fields3.find((field) => field.name === name);
+    },
+    filter: () => {
+      return fields3;
+    },
+  },
+  getComputedFields,
+  getSourceFiltering: () => mockSource,
+} as unknown) as IndexPattern;
+
 const runtimeFieldDef = {
   type: 'keyword',
   script: {
@@ -61,8 +80,8 @@ describe('SearchSource', () => {
       .fn()
       .mockReturnValue(
         of(
-          { rawResponse: { isPartial: true, isRunning: true } },
-          { rawResponse: { isPartial: false, isRunning: false } }
+          { rawResponse: { test: 1 }, isPartial: true, isRunning: true },
+          { rawResponse: { test: 2 }, isPartial: false, isRunning: false }
         )
       );
 
@@ -81,17 +100,19 @@ describe('SearchSource', () => {
 
   describe('#getField()', () => {
     test('gets the value for the property', () => {
-      searchSource.setField('aggs', 5);
-      expect(searchSource.getField('aggs')).toBe(5);
+      searchSource.setField('aggs', { i: 5 });
+      expect(searchSource.getField('aggs')).toStrictEqual({ i: 5 });
     });
   });
 
   describe('#getFields()', () => {
     test('gets the value for the property', () => {
-      searchSource.setField('aggs', 5);
+      searchSource.setField('aggs', { i: 5 });
       expect(searchSource.getFields()).toMatchInlineSnapshot(`
         Object {
-          "aggs": 5,
+          "aggs": Object {
+            "i": 5,
+          },
         }
       `);
     });
@@ -100,7 +121,7 @@ describe('SearchSource', () => {
   describe('#removeField()', () => {
     test('remove property', () => {
       searchSource = new SearchSource({}, searchSourceDependencies);
-      searchSource.setField('aggs', 5);
+      searchSource.setField('aggs', { i: 5 });
       searchSource.removeField('aggs');
       expect(searchSource.getField('aggs')).toBeFalsy();
     });
@@ -108,8 +129,20 @@ describe('SearchSource', () => {
 
   describe('#setField() / #flatten', () => {
     test('sets the value for the property', () => {
-      searchSource.setField('aggs', 5);
-      expect(searchSource.getField('aggs')).toBe(5);
+      searchSource.setField('aggs', { i: 5 });
+      expect(searchSource.getField('aggs')).toStrictEqual({ i: 5 });
+    });
+
+    test('sets the value for the property with AggConfigs', () => {
+      const typesRegistry = mockAggTypesRegistry();
+
+      const ac = new AggConfigs(indexPattern3, [{ type: 'avg', params: { field: 'field1' } }], {
+        typesRegistry,
+      });
+
+      searchSource.setField('aggs', ac);
+      const request = searchSource.getSearchRequestBody();
+      expect(request.aggs).toStrictEqual({ '1': { avg: { field: 'field1' } } });
     });
 
     describe('computed fields handling', () => {
@@ -385,10 +418,16 @@ describe('SearchSource', () => {
             docvalueFields: [],
           }),
         } as unknown) as IndexPattern);
-        searchSource.setField('fields', ['hello', 'foo']);
-
+        searchSource.setField('fields', [
+          'hello',
+          'foo-bar',
+          'foo--bar',
+          'fooo',
+          'somethingfoo',
+          'xxfxxoxxo',
+        ]);
         const request = searchSource.getSearchRequestBody();
-        expect(request.fields).toEqual(['hello']);
+        expect(request.fields).toEqual(['hello', 'fooo', 'somethingfoo', 'xxfxxoxxo']);
       });
 
       test('request all fields from index pattern except the ones specified with source filters', async () => {
@@ -631,7 +670,7 @@ describe('SearchSource', () => {
       const fn = jest.fn();
       searchSource.onRequestStart(fn);
       const options = {};
-      await searchSource.fetch(options);
+      await searchSource.fetch$(options).toPromise();
       expect(fn).toBeCalledWith(searchSource, options);
     });
 
@@ -644,7 +683,7 @@ describe('SearchSource', () => {
       const parentFn = jest.fn();
       parent.onRequestStart(parentFn);
       const options = {};
-      await searchSource.fetch(options);
+      await searchSource.fetch$(options).toPromise();
 
       expect(fn).toBeCalledWith(searchSource, options);
       expect(parentFn).not.toBeCalled();
@@ -664,69 +703,13 @@ describe('SearchSource', () => {
       const parentFn = jest.fn();
       parent.onRequestStart(parentFn);
       const options = {};
-      await searchSource.fetch(options);
+      await searchSource.fetch$(options).toPromise();
 
       expect(fn).toBeCalledWith(searchSource, options);
       expect(parentFn).toBeCalledWith(searchSource, options);
     });
   });
 
-  describe('#legacy fetch()', () => {
-    beforeEach(() => {
-      searchSourceDependencies = {
-        ...searchSourceDependencies,
-        getConfig: jest.fn(() => {
-          return true; // batchSearches = true
-        }) as GetConfigFn,
-      };
-    });
-
-    test('should call msearch', async () => {
-      searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
-      const options = {};
-      await searchSource.fetch(options);
-      expect(fetchSoon).toBeCalledTimes(1);
-    });
-  });
-
-  describe('#search service fetch()', () => {
-    test('should call msearch', async () => {
-      searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
-      const options = {};
-
-      await searchSource.fetch(options);
-      expect(mockSearchMethod).toBeCalledTimes(1);
-    });
-
-    test('should return partial results', (done) => {
-      searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
-      const options = {};
-
-      const next = jest.fn();
-      const complete = () => {
-        expect(next).toBeCalledTimes(2);
-        expect(next.mock.calls[0]).toMatchInlineSnapshot(`
-          Array [
-            Object {
-              "isPartial": true,
-              "isRunning": true,
-            },
-          ]
-        `);
-        expect(next.mock.calls[1]).toMatchInlineSnapshot(`
-          Array [
-            Object {
-              "isPartial": false,
-              "isRunning": false,
-            },
-          ]
-        `);
-        done();
-      };
-      searchSource.fetch$(options).subscribe({ next, complete });
-    });
-  });
-
   describe('#serialize', () => {
     test('should reference index patterns', () => {
       const indexPattern123 = { id: '123' } as IndexPattern;
@@ -884,4 +867,373 @@ describe('SearchSource', () => {
       );
     });
   });
+
+  describe('fetch$', () => {
+    describe('#legacy fetch()', () => {
+      beforeEach(() => {
+        searchSourceDependencies = {
+          ...searchSourceDependencies,
+          getConfig: jest.fn(() => {
+            return true; // batchSearches = true
+          }) as GetConfigFn,
+        };
+      });
+
+      test('should call msearch', async () => {
+        searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
+        const options = {};
+        await searchSource.fetch$(options).toPromise();
+        expect(fetchSoon).toBeCalledTimes(1);
+      });
+    });
+
+    describe('responses', () => {
+      test('should return partial results', async () => {
+        searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
+        const options = {};
+
+        const next = jest.fn();
+        const complete = jest.fn();
+        const res$ = searchSource.fetch$(options);
+        res$.subscribe({ next, complete });
+        await res$.toPromise();
+
+        expect(next).toBeCalledTimes(2);
+        expect(complete).toBeCalledTimes(1);
+        expect(next.mock.calls[0]).toMatchInlineSnapshot(`
+          Array [
+            Object {
+              "test": 1,
+            },
+          ]
+        `);
+        expect(next.mock.calls[1]).toMatchInlineSnapshot(`
+          Array [
+            Object {
+              "test": 2,
+            },
+          ]
+        `);
+      });
+
+      test('shareReplays result', async () => {
+        searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
+        const options = {};
+
+        const next = jest.fn();
+        const complete = jest.fn();
+        const next2 = jest.fn();
+        const complete2 = jest.fn();
+        const res$ = searchSource.fetch$(options);
+        res$.subscribe({ next, complete });
+        res$.subscribe({ next: next2, complete: complete2 });
+        await res$.toPromise();
+
+        expect(next).toBeCalledTimes(2);
+        expect(next2).toBeCalledTimes(2);
+        expect(complete).toBeCalledTimes(1);
+        expect(complete2).toBeCalledTimes(1);
+        expect(searchSourceDependencies.search).toHaveBeenCalledTimes(1);
+      });
+
+      test('should emit error on empty response', async () => {
+        searchSourceDependencies.search = mockSearchMethod = jest
+          .fn()
+          .mockReturnValue(
+            of({ rawResponse: { test: 1 }, isPartial: true, isRunning: true }, undefined)
+          );
+
+        searchSource = new SearchSource({ index: indexPattern }, searchSourceDependencies);
+        const options = {};
+
+        const next = jest.fn();
+        const error = jest.fn();
+        const complete = jest.fn();
+        const res$ = searchSource.fetch$(options);
+        res$.subscribe({ next, error, complete });
+        await res$.toPromise().catch((e) => {});
+
+        expect(next).toBeCalledTimes(1);
+        expect(error).toBeCalledTimes(1);
+        expect(complete).toBeCalledTimes(0);
+        expect(next.mock.calls[0]).toMatchInlineSnapshot(`
+          Array [
+            Object {
+              "test": 1,
+            },
+          ]
+        `);
+        expect(error.mock.calls[0][0]).toBe(undefined);
+      });
+    });
+
+    describe('inspector', () => {
+      let requestResponder: RequestResponder;
+      beforeEach(() => {
+        requestResponder = ({
+          stats: jest.fn(),
+          ok: jest.fn(),
+          error: jest.fn(),
+          json: jest.fn(),
+        } as unknown) as RequestResponder;
+      });
+
+      test('calls inspector if provided', async () => {
+        const options = {
+          inspector: {
+            title: 'a',
+            adapter: {
+              start: jest.fn().mockReturnValue(requestResponder),
+            } as any,
+          },
+        };
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        await searchSource.fetch$(options).toPromise();
+
+        expect(options.inspector.adapter.start).toBeCalledTimes(1);
+        expect(requestResponder.error).not.toBeCalled();
+        expect(requestResponder.json).toBeCalledTimes(1);
+        expect(requestResponder.ok).toBeCalledTimes(1);
+        // First and last
+        expect(requestResponder.stats).toBeCalledTimes(2);
+      });
+
+      test('calls inspector only once, with multiple subs (shareReplay)', async () => {
+        const options = {
+          inspector: {
+            title: 'a',
+            adapter: {
+              start: jest.fn().mockReturnValue(requestResponder),
+            } as any,
+          },
+        };
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        const res$ = searchSource.fetch$(options);
+
+        const complete1 = jest.fn();
+        const complete2 = jest.fn();
+
+        res$.subscribe({
+          complete: complete1,
+        });
+        res$.subscribe({
+          complete: complete2,
+        });
+
+        await res$.toPromise();
+
+        expect(complete1).toBeCalledTimes(1);
+        expect(complete2).toBeCalledTimes(1);
+        expect(options.inspector.adapter.start).toBeCalledTimes(1);
+      });
+
+      test('calls error on inspector', async () => {
+        const options = {
+          inspector: {
+            title: 'a',
+            adapter: {
+              start: jest.fn().mockReturnValue(requestResponder),
+            } as any,
+          },
+        };
+
+        searchSourceDependencies.search = jest.fn().mockReturnValue(of(Promise.reject('aaaaa')));
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        await searchSource
+          .fetch$(options)
+          .toPromise()
+          .catch(() => {});
+
+        expect(options.inspector.adapter.start).toBeCalledTimes(1);
+        expect(requestResponder.json).toBeCalledTimes(1);
+        expect(requestResponder.error).toBeCalledTimes(1);
+        expect(requestResponder.ok).toBeCalledTimes(0);
+        expect(requestResponder.stats).toBeCalledTimes(0);
+      });
+    });
+
+    describe('postFlightRequest', () => {
+      let fetchSub: any;
+
+      function getAggConfigs(typesRegistry: AggTypesRegistryStart, enabled: boolean) {
+        return new AggConfigs(
+          indexPattern3,
+          [
+            {
+              type: 'avg',
+              enabled,
+              params: { field: 'field1' },
+            },
+          ],
+          {
+            typesRegistry,
+          }
+        );
+      }
+
+      beforeEach(() => {
+        fetchSub = {
+          next: jest.fn(),
+          complete: jest.fn(),
+          error: jest.fn(),
+        };
+      });
+
+      test('doesnt call any post flight requests if disabled', async () => {
+        const typesRegistry = mockAggTypesRegistry();
+        typesRegistry.get('avg').postFlightRequest = jest.fn();
+        const ac = getAggConfigs(typesRegistry, false);
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        searchSource.setField('aggs', ac);
+        const fetch$ = searchSource.fetch$({});
+        fetch$.subscribe(fetchSub);
+        await fetch$.toPromise();
+
+        expect(fetchSub.next).toHaveBeenCalledTimes(2);
+        expect(fetchSub.complete).toHaveBeenCalledTimes(1);
+        expect(fetchSub.error).toHaveBeenCalledTimes(0);
+
+        expect(typesRegistry.get('avg').postFlightRequest).toHaveBeenCalledTimes(0);
+      });
+
+      test('doesnt call any post flight if searchsource has error', async () => {
+        const typesRegistry = mockAggTypesRegistry();
+        typesRegistry.get('avg').postFlightRequest = jest.fn();
+        const ac = getAggConfigs(typesRegistry, true);
+
+        searchSourceDependencies.search = jest.fn().mockImplementation(() =>
+          of(1).pipe(
+            switchMap((r) => {
+              throw r;
+            })
+          )
+        );
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        searchSource.setField('aggs', ac);
+        const fetch$ = searchSource.fetch$({});
+        fetch$.subscribe(fetchSub);
+        await fetch$.toPromise().catch((e) => {});
+
+        expect(fetchSub.next).toHaveBeenCalledTimes(0);
+        expect(fetchSub.complete).toHaveBeenCalledTimes(0);
+        expect(fetchSub.error).toHaveBeenNthCalledWith(1, 1);
+
+        expect(typesRegistry.get('avg').postFlightRequest).toHaveBeenCalledTimes(0);
+      });
+
+      test('calls post flight requests, fires 1 extra response, returns last response', async () => {
+        const typesRegistry = mockAggTypesRegistry();
+        typesRegistry.get('avg').postFlightRequest = jest.fn().mockResolvedValue({
+          other: 5,
+        });
+
+        const allac = new AggConfigs(
+          indexPattern3,
+          [
+            {
+              type: 'avg',
+              enabled: true,
+              params: { field: 'field1' },
+            },
+            {
+              type: 'avg',
+              enabled: true,
+              params: { field: 'field2' },
+            },
+            {
+              type: 'avg',
+              enabled: true,
+              params: { field: 'foo-bar' },
+            },
+          ],
+          {
+            typesRegistry,
+          }
+        );
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        searchSource.setField('aggs', allac);
+        const fetch$ = searchSource.fetch$({});
+        fetch$.subscribe(fetchSub);
+
+        const resp = await fetch$.toPromise();
+
+        expect(fetchSub.next).toHaveBeenCalledTimes(3);
+        expect(fetchSub.complete).toHaveBeenCalledTimes(1);
+        expect(fetchSub.error).toHaveBeenCalledTimes(0);
+        expect(resp).toStrictEqual({ other: 5 });
+        expect(typesRegistry.get('avg').postFlightRequest).toHaveBeenCalledTimes(3);
+      });
+
+      test('calls post flight requests only once, with multiple subs (shareReplay)', async () => {
+        const typesRegistry = mockAggTypesRegistry();
+        typesRegistry.get('avg').postFlightRequest = jest.fn().mockResolvedValue({
+          other: 5,
+        });
+
+        const allac = new AggConfigs(
+          indexPattern3,
+          [
+            {
+              type: 'avg',
+              enabled: true,
+              params: { field: 'field1' },
+            },
+          ],
+          {
+            typesRegistry,
+          }
+        );
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        searchSource.setField('aggs', allac);
+        const fetch$ = searchSource.fetch$({});
+        fetch$.subscribe(fetchSub);
+
+        const fetchSub2 = {
+          next: jest.fn(),
+          complete: jest.fn(),
+          error: jest.fn(),
+        };
+        fetch$.subscribe(fetchSub2);
+
+        await fetch$.toPromise();
+
+        expect(fetchSub.next).toHaveBeenCalledTimes(3);
+        expect(fetchSub.complete).toHaveBeenCalledTimes(1);
+        expect(typesRegistry.get('avg').postFlightRequest).toHaveBeenCalledTimes(1);
+      });
+
+      test('calls post flight requests, handles error', async () => {
+        const typesRegistry = mockAggTypesRegistry();
+        typesRegistry.get('avg').postFlightRequest = jest.fn().mockRejectedValue(undefined);
+        const ac = getAggConfigs(typesRegistry, true);
+
+        searchSource = new SearchSource({}, searchSourceDependencies);
+        searchSource.setField('index', indexPattern);
+        searchSource.setField('aggs', ac);
+        const fetch$ = searchSource.fetch$({});
+        fetch$.subscribe(fetchSub);
+
+        await fetch$.toPromise().catch(() => {});
+
+        expect(fetchSub.next).toHaveBeenCalledTimes(2);
+        expect(fetchSub.complete).toHaveBeenCalledTimes(0);
+        expect(fetchSub.error).toHaveBeenCalledTimes(1);
+        expect(typesRegistry.get('avg').postFlightRequest).toHaveBeenCalledTimes(1);
+      });
+    });
+  });
 });
diff --git a/src/plugins/data/common/search/search_source/search_source.ts b/src/plugins/data/common/search/search_source/search_source.ts
index e1e7a8292d6773..6f34d5ce1f29cc 100644
--- a/src/plugins/data/common/search/search_source/search_source.ts
+++ b/src/plugins/data/common/search/search_source/search_source.ts
@@ -60,12 +60,22 @@
 
 import { setWith } from '@elastic/safer-lodash-set';
 import { uniqueId, keyBy, pick, difference, isFunction, isEqual, uniqWith, isObject } from 'lodash';
-import { catchError, finalize, map, switchMap, tap } from 'rxjs/operators';
-import { defer, from } from 'rxjs';
+import {
+  catchError,
+  finalize,
+  first,
+  last,
+  map,
+  shareReplay,
+  switchMap,
+  tap,
+} from 'rxjs/operators';
+import { defer, EMPTY, from, Observable } from 'rxjs';
+import { estypes } from '@elastic/elasticsearch';
 import { normalizeSortRequest } from './normalize_sort_request';
 import { fieldWildcardFilter } from '../../../../kibana_utils/common';
 import { IIndexPattern, IndexPattern, IndexPatternField } from '../../index_patterns';
-import { ISearchGeneric, ISearchOptions } from '../..';
+import { AggConfigs, ISearchGeneric, ISearchOptions } from '../..';
 import type {
   ISearchSource,
   SearchFieldValue,
@@ -75,7 +85,15 @@ import type {
 import { FetchHandlers, RequestFailure, getSearchParamsFromRequest, SearchRequest } from './fetch';
 import { getRequestInspectorStats, getResponseInspectorStats } from './inspect';
 
-import { getEsQueryConfig, buildEsQuery, Filter, UI_SETTINGS } from '../../../common';
+import {
+  getEsQueryConfig,
+  buildEsQuery,
+  Filter,
+  UI_SETTINGS,
+  isErrorResponse,
+  isPartialResponse,
+  IKibanaSearchResponse,
+} from '../../../common';
 import { getHighlightRequest } from '../../../common/field_formats';
 import { fetchSoon } from './legacy';
 import { extractReferences } from './extract_references';
@@ -256,10 +274,8 @@ export class SearchSource {
    */
   fetch$(options: ISearchOptions = {}) {
     const { getConfig } = this.dependencies;
-    return defer(() => this.requestIsStarting(options)).pipe(
-      tap(() => {
-        options.requestResponder?.stats(getRequestInspectorStats(this));
-      }),
+
+    const s$ = defer(() => this.requestIsStarting(options)).pipe(
       switchMap(() => {
         const searchRequest = this.flatten();
         this.history = [searchRequest];
@@ -273,21 +289,14 @@ export class SearchSource {
       }),
       tap((response) => {
         // TODO: Remove casting when https://github.com/elastic/elasticsearch-js/issues/1287 is resolved
-        if ((response as any).error) {
+        if (!response || (response as any).error) {
           throw new RequestFailure(null, response);
-        } else {
-          options.requestResponder?.stats(getResponseInspectorStats(response, this));
-          options.requestResponder?.ok({ json: response });
         }
       }),
-      catchError((e) => {
-        options.requestResponder?.error({ json: e });
-        throw e;
-      }),
-      finalize(() => {
-        options.requestResponder?.json(this.getSearchRequestBody());
-      })
+      shareReplay()
     );
+
+    return this.inspectSearch(s$, options);
   }
 
   /**
@@ -328,9 +337,96 @@ export class SearchSource {
    * PRIVATE APIS
    ******/
 
+  private inspectSearch(s$: Observable<estypes.SearchResponse<any>>, options: ISearchOptions) {
+    const { id, title, description, adapter } = options.inspector || { title: '' };
+
+    const requestResponder = adapter?.start(title, {
+      id,
+      description,
+      searchSessionId: options.sessionId,
+    });
+
+    const trackRequestBody = () => {
+      try {
+        requestResponder?.json(this.getSearchRequestBody());
+      } catch (e) {} // eslint-disable-line no-empty
+    };
+
+    // Track request stats on first emit, swallow errors
+    const first$ = s$
+      .pipe(
+        first(undefined, null),
+        tap(() => {
+          requestResponder?.stats(getRequestInspectorStats(this));
+          trackRequestBody();
+        }),
+        catchError(() => {
+          trackRequestBody();
+          return EMPTY;
+        }),
+        finalize(() => {
+          first$.unsubscribe();
+        })
+      )
+      .subscribe();
+
+    // Track response stats on last emit, as well as errors
+    const last$ = s$
+      .pipe(
+        catchError((e) => {
+          requestResponder?.error({ json: e });
+          return EMPTY;
+        }),
+        last(undefined, null),
+        tap((finalResponse) => {
+          if (finalResponse) {
+            requestResponder?.stats(getResponseInspectorStats(finalResponse, this));
+            requestResponder?.ok({ json: finalResponse });
+          }
+        }),
+        finalize(() => {
+          last$.unsubscribe();
+        })
+      )
+      .subscribe();
+
+    return s$;
+  }
+
+  private hasPostFlightRequests() {
+    const aggs = this.getField('aggs');
+    if (aggs instanceof AggConfigs) {
+      return aggs.aggs.some(
+        (agg) => agg.enabled && typeof agg.type.postFlightRequest === 'function'
+      );
+    } else {
+      return false;
+    }
+  }
+
+  private async fetchOthers(response: estypes.SearchResponse<any>, options: ISearchOptions) {
+    const aggs = this.getField('aggs');
+    if (aggs instanceof AggConfigs) {
+      for (const agg of aggs.aggs) {
+        if (agg.enabled && typeof agg.type.postFlightRequest === 'function') {
+          response = await agg.type.postFlightRequest(
+            response,
+            aggs,
+            agg,
+            this,
+            options.inspector?.adapter,
+            options.abortSignal,
+            options.sessionId
+          );
+        }
+      }
+      return response;
+    }
+  }
+
   /**
    * Run a search using the search service
-   * @return {Promise<SearchResponse<unknown>>}
+   * @return {Observable<SearchResponse<any>>}
    */
   private fetchSearch$(searchRequest: SearchRequest, options: ISearchOptions) {
     const { search, getConfig, onResponse } = this.dependencies;
@@ -340,6 +436,43 @@ export class SearchSource {
     });
 
     return search({ params, indexType: searchRequest.indexType }, options).pipe(
+      switchMap((response) => {
+        return new Observable<IKibanaSearchResponse<any>>((obs) => {
+          if (isErrorResponse(response)) {
+            obs.error(response);
+          } else if (isPartialResponse(response)) {
+            obs.next(response);
+          } else {
+            if (!this.hasPostFlightRequests()) {
+              obs.next(response);
+              obs.complete();
+            } else {
+              // Treat the complete response as partial, then run the postFlightRequests.
+              obs.next({
+                ...response,
+                isPartial: true,
+                isRunning: true,
+              });
+              const sub = from(this.fetchOthers(response.rawResponse, options)).subscribe({
+                next: (responseWithOther) => {
+                  obs.next({
+                    ...response,
+                    rawResponse: responseWithOther,
+                  });
+                },
+                error: (e) => {
+                  obs.error(e);
+                  sub.unsubscribe();
+                },
+                complete: () => {
+                  obs.complete();
+                  sub.unsubscribe();
+                },
+              });
+            }
+          }
+        });
+      }),
       map(({ rawResponse }) => onResponse(searchRequest, rawResponse))
     );
   }
@@ -452,6 +585,12 @@ export class SearchSource {
           getConfig(UI_SETTINGS.SORT_OPTIONS)
         );
         return addToBody(key, sort);
+      case 'aggs':
+        if ((val as any) instanceof AggConfigs) {
+          return addToBody('aggs', val.toDsl());
+        } else {
+          return addToBody('aggs', val);
+        }
       default:
         return addToBody(key, val);
     }
@@ -496,18 +635,15 @@ export class SearchSource {
     if (!sourceFilters || sourceFilters.excludes?.length === 0 || bodyFields.length === 0) {
       return bodyFields;
     }
-    const metaFields = this.dependencies.getConfig(UI_SETTINGS.META_FIELDS);
     const sourceFiltersValues = sourceFilters.excludes;
     const wildcardField = bodyFields.find(
       (el: SearchFieldValue) => el === '*' || (el as Record<string, string>).field === '*'
     );
-    const filterSourceFields = (fieldName: string) => {
-      return (
-        fieldName &&
-        !sourceFiltersValues.some((sourceFilter) => fieldName.match(sourceFilter)) &&
-        !metaFields.includes(fieldName)
-      );
-    };
+    const filter = fieldWildcardFilter(
+      sourceFiltersValues,
+      this.dependencies.getConfig(UI_SETTINGS.META_FIELDS)
+    );
+    const filterSourceFields = (fieldName: string) => fieldName && filter(fieldName);
     if (!wildcardField) {
       // we already have an explicit list of fields, so we just remove source filters from that list
       return bodyFields.filter((fld: SearchFieldValue) =>
diff --git a/src/plugins/data/common/search/search_source/types.ts b/src/plugins/data/common/search/search_source/types.ts
index a178b38693d92e..507fda0dc9e474 100644
--- a/src/plugins/data/common/search/search_source/types.ts
+++ b/src/plugins/data/common/search/search_source/types.ts
@@ -7,6 +7,7 @@
  */
 
 import { NameList } from 'elasticsearch';
+import { IAggConfigs } from 'src/plugins/data/public';
 import { Query } from '../..';
 import { Filter } from '../../es_query';
 import { IndexPattern } from '../../index_patterns';
@@ -41,12 +42,20 @@ export enum SortDirection {
   desc = 'desc',
 }
 
+export interface SortDirectionFormat {
+  order: SortDirection;
+  format?: string;
+}
+
 export interface SortDirectionNumeric {
   order: SortDirection;
   numeric_type?: 'double' | 'long' | 'date' | 'date_nanos';
 }
 
-export type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric>;
+export type EsQuerySortValue = Record<
+  string,
+  SortDirection | SortDirectionNumeric | SortDirectionFormat
+>;
 
 interface SearchField {
   [key: string]: SearchFieldValue;
@@ -78,7 +87,7 @@ export interface SearchSourceFields {
   /**
    * {@link AggConfigs}
    */
-  aggs?: any;
+  aggs?: object | IAggConfigs | (() => object);
   from?: number;
   size?: number;
   source?: NameList;
diff --git a/src/plugins/data/common/search/tabify/index.ts b/src/plugins/data/common/search/tabify/index.ts
index 168d4cf9d4c370..74fbc7ba4cfa4a 100644
--- a/src/plugins/data/common/search/tabify/index.ts
+++ b/src/plugins/data/common/search/tabify/index.ts
@@ -6,27 +6,6 @@
  * Side Public License, v 1.
  */
 
-import { SearchResponse } from 'elasticsearch';
-import { SearchSource } from '../search_source';
-import { tabifyAggResponse } from './tabify';
-import { tabifyDocs, TabifyDocsOptions } from './tabify_docs';
-import { TabbedResponseWriterOptions } from './types';
-
-export const tabify = (
-  searchSource: SearchSource,
-  esResponse: SearchResponse<unknown>,
-  opts: Partial<TabbedResponseWriterOptions> | TabifyDocsOptions
-) => {
-  return !esResponse.aggregations
-    ? tabifyDocs(esResponse, searchSource.getField('index'), opts as TabifyDocsOptions)
-    : tabifyAggResponse(
-        searchSource.getField('aggs'),
-        esResponse,
-        opts as Partial<TabbedResponseWriterOptions>
-      );
-};
-
-export { tabifyDocs };
-
+export { tabifyDocs } from './tabify_docs';
 export { tabifyAggResponse } from './tabify';
 export { tabifyGetColumns } from './get_columns';
diff --git a/src/plugins/data/common/search/types.ts b/src/plugins/data/common/search/types.ts
index 37de8dc49d3c6a..e3ec499a0020db 100644
--- a/src/plugins/data/common/search/types.ts
+++ b/src/plugins/data/common/search/types.ts
@@ -9,7 +9,7 @@
 import { Observable } from 'rxjs';
 import { IEsSearchRequest, IEsSearchResponse } from './es_search';
 import { IndexPattern } from '..';
-import type { RequestResponder } from '../../../inspector/common';
+import type { RequestAdapter } from '../../../inspector/common';
 
 export type ISearchGeneric = <
   SearchStrategyRequest extends IKibanaSearchRequest = IEsSearchRequest,
@@ -81,6 +81,13 @@ export interface IKibanaSearchRequest<Params = any> {
   params?: Params;
 }
 
+export interface IInspectorInfo {
+  adapter?: RequestAdapter;
+  title: string;
+  id?: string;
+  description?: string;
+}
+
 export interface ISearchOptions {
   /**
    * An `AbortSignal` that allows the caller of `search` to abort a search request.
@@ -117,10 +124,12 @@ export interface ISearchOptions {
   /**
    * Index pattern reference is used for better error messages
    */
-
   indexPattern?: IndexPattern;
 
-  requestResponder?: RequestResponder;
+  /**
+   * Inspector integration options
+   */
+  inspector?: IInspectorInfo;
 }
 
 /**
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 35f13fc855e998..dc138b7347d04c 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -46,6 +46,7 @@ import { FormatFactory as FormatFactory_2 } from 'src/plugins/data/common/field_
 import { History } from 'history';
 import { Href } from 'history';
 import { HttpSetup } from 'kibana/public';
+import { IAggConfigs as IAggConfigs_2 } from 'src/plugins/data/public';
 import { IconType } from '@elastic/eui';
 import { IncomingHttpHeaders } from 'http';
 import { InjectedIntl } from '@kbn/i18n/react';
@@ -254,6 +255,8 @@ export class AggConfigs {
     getResponseAggById(id: string): AggConfig | undefined;
     getResponseAggs(): AggConfig[];
     // (undocumented)
+    hierarchical?: boolean;
+    // (undocumented)
     indexPattern: IndexPattern;
     jsonDataEquals(aggConfigs: AggConfig[]): boolean;
     // (undocumented)
@@ -267,7 +270,7 @@ export class AggConfigs {
     // (undocumented)
     timeRange?: TimeRange;
     // (undocumented)
-    toDsl(hierarchical?: boolean): Record<string, any>;
+    toDsl(): Record<string, any>;
     }
 
 // @internal (undocumented)
@@ -829,10 +832,11 @@ export interface EsQueryConfig {
 }
 
 // Warning: (ae-forgotten-export) The symbol "SortDirectionNumeric" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "SortDirectionFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "EsQuerySortValue" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric>;
+export type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric | SortDirectionFormat>;
 
 // Warning: (ae-forgotten-export) The symbol "ExpressionTypeDefinition" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "name" needs to be exported by the entry point index.d.ts
@@ -1672,13 +1676,11 @@ export type ISearchGeneric = <SearchStrategyRequest extends IKibanaSearchRequest
 export interface ISearchOptions {
     abortSignal?: AbortSignal;
     indexPattern?: IndexPattern;
+    // Warning: (ae-forgotten-export) The symbol "IInspectorInfo" needs to be exported by the entry point index.d.ts
+    inspector?: IInspectorInfo;
     isRestore?: boolean;
     isStored?: boolean;
     legacyHitsTotal?: boolean;
-    // Warning: (ae-forgotten-export) The symbol "RequestResponder" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    requestResponder?: RequestResponder;
     sessionId?: string;
     strategy?: string;
 }
@@ -2430,9 +2432,9 @@ export class SearchSource {
     createChild(options?: {}): SearchSource;
     createCopy(): SearchSource;
     destroy(): void;
-    fetch$(options?: ISearchOptions): import("rxjs").Observable<import("@elastic/elasticsearch/api/types").SearchResponse<any>>;
+    fetch$(options?: ISearchOptions): Observable<estypes.SearchResponse<any>>;
     // @deprecated
-    fetch(options?: ISearchOptions): Promise<import("@elastic/elasticsearch/api/types").SearchResponse<any>>;
+    fetch(options?: ISearchOptions): Promise<estypes.SearchResponse<any>>;
     getField<K extends keyof SearchSourceFields>(field: K, recurse?: boolean): SearchSourceFields[K];
     getFields(): SearchSourceFields;
     getId(): string;
@@ -2462,7 +2464,7 @@ export class SearchSource {
 // @public
 export interface SearchSourceFields {
     // (undocumented)
-    aggs?: any;
+    aggs?: object | IAggConfigs_2 | (() => object);
     // Warning: (ae-forgotten-export) The symbol "SearchFieldValue" needs to be exported by the entry point index.d.ts
     fields?: SearchFieldValue[];
     // @deprecated
diff --git a/src/plugins/data/public/search/expressions/esaggs.test.ts b/src/plugins/data/public/search/expressions/esaggs.test.ts
index d7a6446781c437..e75bd7be219de9 100644
--- a/src/plugins/data/public/search/expressions/esaggs.test.ts
+++ b/src/plugins/data/public/search/expressions/esaggs.test.ts
@@ -100,17 +100,20 @@ describe('esaggs expression function - public', () => {
 
     expect(handleEsaggsRequest).toHaveBeenCalledWith({
       abortSignal: mockHandlers.abortSignal,
-      aggs: { foo: 'bar' },
+      aggs: {
+        foo: 'bar',
+        hierarchical: true,
+      },
       filters: undefined,
       indexPattern: {},
       inspectorAdapters: mockHandlers.inspectorAdapters,
-      metricsAtAllLevels: args.metricsAtAllLevels,
       partialRows: args.partialRows,
       query: undefined,
       searchSessionId: 'abc123',
       searchSourceService: startDependencies.searchSource,
       timeFields: args.timeFields,
       timeRange: undefined,
+      getNow: undefined,
     });
   });
 
diff --git a/src/plugins/data/public/search/expressions/esaggs.ts b/src/plugins/data/public/search/expressions/esaggs.ts
index 45d24af3a6ebb5..1e3d56c71e423b 100644
--- a/src/plugins/data/public/search/expressions/esaggs.ts
+++ b/src/plugins/data/public/search/expressions/esaggs.ts
@@ -8,7 +8,6 @@
 
 import { get } from 'lodash';
 import { StartServicesAccessor } from 'src/core/public';
-import { Adapters } from 'src/plugins/inspector/common';
 import {
   EsaggsExpressionFunctionDefinition,
   EsaggsStartDependencies,
@@ -44,14 +43,14 @@ export function getFunctionDefinition({
         indexPattern,
         args.aggs!.map((agg) => agg.value)
       );
+      aggConfigs.hierarchical = args.metricsAtAllLevels;
 
       return await handleEsaggsRequest({
-        abortSignal: (abortSignal as unknown) as AbortSignal,
+        abortSignal,
         aggs: aggConfigs,
         filters: get(input, 'filters', undefined),
         indexPattern,
-        inspectorAdapters: inspectorAdapters as Adapters,
-        metricsAtAllLevels: args.metricsAtAllLevels,
+        inspectorAdapters,
         partialRows: args.partialRows,
         query: get(input, 'query', undefined) as any,
         searchSessionId: getSearchSessionId(),
diff --git a/src/plugins/data/server/search/expressions/esaggs.test.ts b/src/plugins/data/server/search/expressions/esaggs.test.ts
index 124a171de63782..15287e9d8cf5bd 100644
--- a/src/plugins/data/server/search/expressions/esaggs.test.ts
+++ b/src/plugins/data/server/search/expressions/esaggs.test.ts
@@ -108,11 +108,13 @@ describe('esaggs expression function - server', () => {
 
     expect(handleEsaggsRequest).toHaveBeenCalledWith({
       abortSignal: mockHandlers.abortSignal,
-      aggs: { foo: 'bar' },
+      aggs: {
+        foo: 'bar',
+        hierarchical: args.metricsAtAllLevels,
+      },
       filters: undefined,
       indexPattern: {},
       inspectorAdapters: mockHandlers.inspectorAdapters,
-      metricsAtAllLevels: args.metricsAtAllLevels,
       partialRows: args.partialRows,
       query: undefined,
       searchSessionId: 'abc123',
diff --git a/src/plugins/data/server/search/expressions/esaggs.ts b/src/plugins/data/server/search/expressions/esaggs.ts
index 61fd320d89b951..bb22a491b157e9 100644
--- a/src/plugins/data/server/search/expressions/esaggs.ts
+++ b/src/plugins/data/server/search/expressions/esaggs.ts
@@ -9,7 +9,6 @@
 import { get } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { KibanaRequest, StartServicesAccessor } from 'src/core/server';
-import { Adapters } from 'src/plugins/inspector/common';
 import {
   EsaggsExpressionFunctionDefinition,
   EsaggsStartDependencies,
@@ -61,13 +60,14 @@ export function getFunctionDefinition({
         args.aggs!.map((agg) => agg.value)
       );
 
+      aggConfigs.hierarchical = args.metricsAtAllLevels;
+
       return await handleEsaggsRequest({
-        abortSignal: (abortSignal as unknown) as AbortSignal,
+        abortSignal,
         aggs: aggConfigs,
         filters: get(input, 'filters', undefined),
         indexPattern,
-        inspectorAdapters: inspectorAdapters as Adapters,
-        metricsAtAllLevels: args.metricsAtAllLevels,
+        inspectorAdapters,
         partialRows: args.partialRows,
         query: get(input, 'query', undefined) as any,
         searchSessionId: getSearchSessionId(),
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index 622356c4441ac3..3316e8102e50ac 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -26,12 +26,14 @@ import { Ensure } from '@kbn/utility-types';
 import { EnvironmentMode } from '@kbn/config';
 import { ErrorToastOptions } from 'src/core/public/notifications';
 import { estypes } from '@elastic/elasticsearch';
+import { EventEmitter } from 'events';
 import { ExecutionContext } from 'src/plugins/expressions/common';
 import { ExpressionAstExpression } from 'src/plugins/expressions/common';
 import { ExpressionFunctionDefinition } from 'src/plugins/expressions/common';
 import { ExpressionsServerSetup } from 'src/plugins/expressions/server';
 import { ExpressionValueBoxed } from 'src/plugins/expressions/common';
 import { FormatFactory as FormatFactory_2 } from 'src/plugins/data/common/field_formats/utils';
+import { IAggConfigs as IAggConfigs_2 } from 'src/plugins/data/public';
 import { ISavedObjectsRepository } from 'src/core/server';
 import { IScopedClusterClient } from 'src/core/server';
 import { ISearchOptions as ISearchOptions_2 } from 'src/plugins/data/public';
@@ -999,13 +1001,11 @@ export interface IScopedSearchClient extends ISearchClient {
 export interface ISearchOptions {
     abortSignal?: AbortSignal;
     indexPattern?: IndexPattern;
+    // Warning: (ae-forgotten-export) The symbol "IInspectorInfo" needs to be exported by the entry point index.d.ts
+    inspector?: IInspectorInfo;
     isRestore?: boolean;
     isStored?: boolean;
     legacyHitsTotal?: boolean;
-    // Warning: (ae-forgotten-export) The symbol "RequestResponder" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    requestResponder?: RequestResponder;
     sessionId?: string;
     strategy?: string;
 }
diff --git a/src/plugins/dev_tools/public/dev_tool.ts b/src/plugins/dev_tools/public/dev_tool.ts
index 197e93f20a539f..8adfd4c76482d8 100644
--- a/src/plugins/dev_tools/public/dev_tool.ts
+++ b/src/plugins/dev_tools/public/dev_tool.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { ReactNode } from 'react';
 import { AppMount } from 'src/core/public';
 
 /**
@@ -26,8 +27,9 @@ export class DevToolApp {
   /**
    * The human readable name of the dev tool. Should be internationalized.
    * This will be used as a label in the tab above the actual tool.
+   * May also be a ReactNode.
    */
-  public readonly title: string;
+  public readonly title: ReactNode;
   public readonly mount: AppMount;
 
   /**
@@ -55,7 +57,7 @@ export class DevToolApp {
 
   constructor(
     id: string,
-    title: string,
+    title: ReactNode,
     mount: AppMount,
     enableRouting: boolean,
     order: number,
diff --git a/src/plugins/dev_tools/public/plugin.ts b/src/plugins/dev_tools/public/plugin.ts
index 6cf3c57d19ac87..e9f5d206de9180 100644
--- a/src/plugins/dev_tools/public/plugin.ts
+++ b/src/plugins/dev_tools/public/plugin.ts
@@ -7,7 +7,7 @@
  */
 
 import { BehaviorSubject } from 'rxjs';
-import { Plugin, CoreSetup, AppMountParameters } from 'src/core/public';
+import { Plugin, CoreSetup, AppMountParameters, AppSearchDeepLink } from 'src/core/public';
 import { AppUpdater } from 'kibana/public';
 import { i18n } from '@kbn/i18n';
 import { sortBy } from 'lodash';
@@ -84,6 +84,20 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, void> {
   public start() {
     if (this.getSortedDevTools().length === 0) {
       this.appStateUpdater.next(() => ({ navLinkStatus: AppNavLinkStatus.hidden }));
+    } else {
+      this.appStateUpdater.next(() => {
+        const deepLinks: AppSearchDeepLink[] = [...this.devTools.values()]
+          .filter(
+            // Some tools do not use a string title, so we filter those out
+            (tool) => !tool.enableRouting && !tool.isDisabled() && typeof tool.title === 'string'
+          )
+          .map((tool) => ({
+            id: tool.id,
+            title: tool.title as string,
+            path: `#/${tool.id}`,
+          }));
+        return { meta: { searchDeepLinks: deepLinks } };
+      });
     }
   }
 
diff --git a/src/plugins/discover/public/application/angular/context/api/_stubs.js b/src/plugins/discover/public/application/angular/context/api/_stubs.js
index 3baa7424e35d71..6930e96a0d4112 100644
--- a/src/plugins/discover/public/application/angular/context/api/_stubs.js
+++ b/src/plugins/discover/public/application/angular/context/api/_stubs.js
@@ -66,7 +66,7 @@ export function createContextSearchSourceStub(hits, timeField = '@timestamp') {
     const lastQuery = searchSourceStub.setField.withArgs('query').lastCall.args[1];
     const timeRange = lastQuery.query.bool.must.constant_score.filter.range[timeField];
     const lastSort = searchSourceStub.setField.withArgs('sort').lastCall.args[1];
-    const sortDirection = lastSort[0][timeField];
+    const sortDirection = lastSort[0][timeField].order;
     const sortFunction =
       sortDirection === 'asc'
         ? (first, second) => first[timeField] - second[timeField]
diff --git a/src/plugins/discover/public/application/angular/context/api/context.predecessors.test.js b/src/plugins/discover/public/application/angular/context/api/context.predecessors.test.js
index ab47111f70e92b..9f5e62da398d20 100644
--- a/src/plugins/discover/public/application/angular/context/api/context.predecessors.test.js
+++ b/src/plugins/discover/public/application/angular/context/api/context.predecessors.test.js
@@ -211,7 +211,10 @@ describe('context app', function () {
         []
       ).then(() => {
         expect(
-          mockSearchSource.setField.calledWith('sort', [{ '@timestamp': 'asc' }, { _doc: 'asc' }])
+          mockSearchSource.setField.calledWith('sort', [
+            { '@timestamp': { order: 'asc', format: 'strict_date_optional_time' } },
+            { _doc: 'asc' },
+          ])
         ).toBe(true);
       });
     });
diff --git a/src/plugins/discover/public/application/angular/context/api/context.successors.test.js b/src/plugins/discover/public/application/angular/context/api/context.successors.test.js
index d4f3754f3d0a51..4936c937aa2fad 100644
--- a/src/plugins/discover/public/application/angular/context/api/context.successors.test.js
+++ b/src/plugins/discover/public/application/angular/context/api/context.successors.test.js
@@ -215,7 +215,10 @@ describe('context app', function () {
         []
       ).then(() => {
         expect(
-          mockSearchSource.setField.calledWith('sort', [{ '@timestamp': 'desc' }, { _doc: 'desc' }])
+          mockSearchSource.setField.calledWith('sort', [
+            { '@timestamp': { order: 'desc', format: 'strict_date_optional_time' } },
+            { _doc: 'desc' },
+          ])
         ).toBe(true);
       });
     });
diff --git a/src/plugins/discover/public/application/angular/context/api/context.ts b/src/plugins/discover/public/application/angular/context/api/context.ts
index 43f6e83d286b36..820e37d754ef2a 100644
--- a/src/plugins/discover/public/application/angular/context/api/context.ts
+++ b/src/plugins/discover/public/application/angular/context/api/context.ts
@@ -87,7 +87,7 @@ function fetchContextProvider(indexPatterns: IndexPatternsContract, useNewFields
         useNewFieldsApi
       );
 
-      const sort = getEsQuerySort(timeField, tieBreakerField, sortDirToApply);
+      const sort = getEsQuerySort(timeField, tieBreakerField, sortDirToApply, nanos);
 
       const hits = await fetchHitsInInterval(
         searchSource,
diff --git a/src/plugins/discover/public/application/angular/context/api/utils/get_es_query_sort.ts b/src/plugins/discover/public/application/angular/context/api/utils/get_es_query_sort.ts
index a560315dc04a4e..2144d2f1cd7fd4 100644
--- a/src/plugins/discover/public/application/angular/context/api/utils/get_es_query_sort.ts
+++ b/src/plugins/discover/public/application/angular/context/api/utils/get_es_query_sort.ts
@@ -14,11 +14,21 @@ import { EsQuerySortValue, SortDirection } from '../../../../../kibana_services'
  * @param timeField
  * @param tieBreakerField
  * @param sortDir
+ * @param nanos
  */
 export function getEsQuerySort(
   timeField: string,
   tieBreakerField: string,
-  sortDir: SortDirection
+  sortDir: SortDirection,
+  nanos?: string
 ): [EsQuerySortValue, EsQuerySortValue] {
-  return [{ [timeField]: sortDir }, { [tieBreakerField]: sortDir }];
+  return [
+    {
+      [timeField]: {
+        order: sortDir,
+        format: nanos ? 'strict_date_optional_time_nanos' : 'strict_date_optional_time',
+      },
+    },
+    { [tieBreakerField]: sortDir },
+  ];
 }
diff --git a/src/plugins/discover/public/application/angular/discover.js b/src/plugins/discover/public/application/angular/discover.js
index 35a89eb45f35ee..4099d5e8ef7e29 100644
--- a/src/plugins/discover/public/application/angular/discover.js
+++ b/src/plugins/discover/public/application/angular/discover.js
@@ -415,11 +415,20 @@ function discoverController($route, $scope) {
     $scope.fetchStatus = fetchStatuses.LOADING;
     $scope.resultState = getResultState($scope.fetchStatus, $scope.rows);
 
+    inspectorAdapters.requests.reset();
     return $scope.volatileSearchSource
       .fetch$({
         abortSignal: abortController.signal,
         sessionId: searchSessionId,
-        requestResponder: getRequestResponder({ searchSessionId }),
+        inspector: {
+          adapter: inspectorAdapters.requests,
+          title: i18n.translate('discover.inspectorRequestDataTitle', {
+            defaultMessage: 'data',
+          }),
+          description: i18n.translate('discover.inspectorRequestDescription', {
+            defaultMessage: 'This request queries Elasticsearch to fetch the data for the search.',
+          }),
+        },
       })
       .toPromise()
       .then(onResults)
@@ -465,17 +474,6 @@ function discoverController($route, $scope) {
     await refetch$.next();
   };
 
-  function getRequestResponder({ searchSessionId = null } = { searchSessionId: null }) {
-    inspectorAdapters.requests.reset();
-    const title = i18n.translate('discover.inspectorRequestDataTitle', {
-      defaultMessage: 'data',
-    });
-    const description = i18n.translate('discover.inspectorRequestDescription', {
-      defaultMessage: 'This request queries Elasticsearch to fetch the data for the search.',
-    });
-    return inspectorAdapters.requests.start(title, { description, searchSessionId });
-  }
-
   $scope.resetQuery = function () {
     history.push(
       $route.current.params.id ? `/view/${encodeURIComponent($route.current.params.id)}` : '/'
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx
index f31399793c0da2..3894127891041c 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid_flyout.tsx
@@ -178,15 +178,29 @@ export function DiscoverGridFlyout({
             indexPattern={indexPattern}
             filter={(mapping, value, mode) => {
               onFilter(mapping, value, mode);
-              onClose();
+              services.toastNotifications.addSuccess(
+                i18n.translate('discover.grid.flyout.toastFilterAdded', {
+                  defaultMessage: `Filter was added`,
+                })
+              );
             }}
             onRemoveColumn={(columnName: string) => {
               onRemoveColumn(columnName);
-              onClose();
+              services.toastNotifications.addSuccess(
+                i18n.translate('discover.grid.flyout.toastColumnRemoved', {
+                  defaultMessage: `Column '{columnName}' was removed`,
+                  values: { columnName },
+                })
+              );
             }}
             onAddColumn={(columnName: string) => {
               onAddColumn(columnName);
-              onClose();
+              services.toastNotifications.addSuccess(
+                i18n.translate('discover.grid.flyout.toastColumnAdded', {
+                  defaultMessage: `Column '{columnName}' was added`,
+                  values: { columnName },
+                })
+              );
             }}
           />
         </EuiFlyoutBody>
diff --git a/src/plugins/discover/public/application/components/discover_topnav.test.tsx b/src/plugins/discover/public/application/components/discover_topnav.test.tsx
index 891dc63c92c7c6..d30e5bda1abe7e 100644
--- a/src/plugins/discover/public/application/components/discover_topnav.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_topnav.test.tsx
@@ -33,6 +33,9 @@ function getProps(): DiscoverTopNavProps {
       discover: {
         save: true,
       },
+      advancedSettings: {
+        save: true,
+      },
     },
     uiSettings: mockUiSettings,
   } as unknown) as DiscoverServices;
diff --git a/src/plugins/discover/public/application/components/table/table.test.tsx b/src/plugins/discover/public/application/components/table/table.test.tsx
index 8997c1d13a4747..7539f29c1ec9db 100644
--- a/src/plugins/discover/public/application/components/table/table.test.tsx
+++ b/src/plugins/discover/public/application/components/table/table.test.tsx
@@ -155,7 +155,7 @@ describe('DocViewTable at Discover', () => {
       const elementExist = check[element];
 
       if (typeof elementExist === 'boolean') {
-        const btn = findTestSubject(rowComponent, element);
+        const btn = findTestSubject(rowComponent, element, '^=');
 
         it(`renders ${element} for '${check._property}' correctly`, () => {
           const disabled = btn.length ? btn.props().disabled : true;
diff --git a/src/plugins/discover/public/application/components/table/table_row.tsx b/src/plugins/discover/public/application/components/table/table_row.tsx
index 5c6ae49770bc70..e8977fda8576a8 100644
--- a/src/plugins/discover/public/application/components/table/table_row.tsx
+++ b/src/plugins/discover/public/application/components/table/table_row.tsx
@@ -65,7 +65,11 @@ export function DocViewTableRow({
             onClick={() => onFilter(fieldMapping, valueRaw, '-')}
           />
           {typeof onToggleColumn === 'function' && (
-            <DocViewTableRowBtnToggleColumn active={isColumnActive} onClick={onToggleColumn} />
+            <DocViewTableRowBtnToggleColumn
+              active={isColumnActive}
+              onClick={onToggleColumn}
+              fieldname={String(key)}
+            />
           )}
           <DocViewTableRowBtnFilterExists
             disabled={!fieldMapping || !fieldMapping.filterable}
diff --git a/src/plugins/discover/public/application/components/table/table_row_btn_toggle_column.tsx b/src/plugins/discover/public/application/components/table/table_row_btn_toggle_column.tsx
index 042a9970d3a8cb..cd5f73d47b1a13 100644
--- a/src/plugins/discover/public/application/components/table/table_row_btn_toggle_column.tsx
+++ b/src/plugins/discover/public/application/components/table/table_row_btn_toggle_column.tsx
@@ -15,9 +15,15 @@ export interface Props {
   active: boolean;
   disabled?: boolean;
   onClick: () => void;
+  fieldname: string;
 }
 
-export function DocViewTableRowBtnToggleColumn({ onClick, active, disabled = false }: Props) {
+export function DocViewTableRowBtnToggleColumn({
+  onClick,
+  active,
+  disabled = false,
+  fieldname = '',
+}: Props) {
   if (disabled) {
     return (
       <EuiButtonIcon
@@ -48,7 +54,7 @@ export function DocViewTableRowBtnToggleColumn({ onClick, active, disabled = fal
         aria-pressed={active}
         onClick={onClick}
         className="kbnDocViewer__actionButton"
-        data-test-subj="toggleColumnButton"
+        data-test-subj={`toggleColumnButton_${fieldname}`}
         iconType={'listAdd'}
         iconSize={'s'}
       />
diff --git a/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.test.ts b/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.test.ts
index f6e9e70b337bae..2c50ce61c8afb7 100644
--- a/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.test.ts
+++ b/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.test.ts
@@ -18,6 +18,9 @@ const services = ({
     discover: {
       save: true,
     },
+    advancedSettings: {
+      save: true,
+    },
   },
 } as unknown) as DiscoverServices;
 
@@ -36,6 +39,13 @@ test('getTopNavLinks result', () => {
   });
   expect(topNavLinks).toMatchInlineSnapshot(`
     Array [
+      Object {
+        "description": "Options",
+        "id": "options",
+        "label": "Options",
+        "run": [Function],
+        "testId": "discoverOptionsButton",
+      },
       Object {
         "description": "New Search",
         "id": "new",
diff --git a/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.ts b/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.ts
index 635684177e1e36..9a12cb51eac0ca 100644
--- a/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.ts
+++ b/src/plugins/discover/public/application/components/top_nav/get_top_nav_links.ts
@@ -15,6 +15,7 @@ import { SavedSearch } from '../../../saved_searches';
 import { onSaveSearch } from './on_save_search';
 import { GetStateReturn } from '../../angular/discover_state';
 import { IndexPattern, ISearchSource } from '../../../kibana_services';
+import { openOptionsPopover } from './open_options_popover';
 
 /**
  * Helper function to build the top nav links
@@ -38,6 +39,22 @@ export const getTopNavLinks = ({
   onOpenInspector: () => void;
   searchSource: ISearchSource;
 }) => {
+  const options = {
+    id: 'options',
+    label: i18n.translate('discover.localMenu.localMenu.optionsTitle', {
+      defaultMessage: 'Options',
+    }),
+    description: i18n.translate('discover.localMenu.optionsDescription', {
+      defaultMessage: 'Options',
+    }),
+    run: (anchorElement: HTMLElement) =>
+      openOptionsPopover({
+        I18nContext: services.core.i18n.Context,
+        anchorElement,
+      }),
+    testId: 'discoverOptionsButton',
+  };
+
   const newSearch = {
     id: 'new',
     label: i18n.translate('discover.localMenu.localMenu.newSearchTitle', {
@@ -128,6 +145,7 @@ export const getTopNavLinks = ({
   };
 
   return [
+    ...(services.capabilities.advancedSettings.save ? [options] : []),
     newSearch,
     ...(services.capabilities.discover.save ? [saveSearch] : []),
     openSearch,
diff --git a/src/plugins/discover/public/application/components/top_nav/open_options_popover.scss b/src/plugins/discover/public/application/components/top_nav/open_options_popover.scss
new file mode 100644
index 00000000000000..f68b2bfe74a9d3
--- /dev/null
+++ b/src/plugins/discover/public/application/components/top_nav/open_options_popover.scss
@@ -0,0 +1,5 @@
+$dscOptionsPopoverWidth: $euiSizeL * 12;
+
+.dscOptionsPopover {
+  width: $dscOptionsPopoverWidth;
+}
\ No newline at end of file
diff --git a/src/plugins/discover/public/application/components/top_nav/open_options_popover.test.tsx b/src/plugins/discover/public/application/components/top_nav/open_options_popover.test.tsx
new file mode 100644
index 00000000000000..406d2eb8eac4b4
--- /dev/null
+++ b/src/plugins/discover/public/application/components/top_nav/open_options_popover.test.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { mountWithIntl } from '@kbn/test/jest';
+import { findTestSubject } from '@elastic/eui/lib/test';
+import { getServices } from '../../../kibana_services';
+
+jest.mock('../../../kibana_services', () => {
+  const mockUiSettings = new Map();
+  return {
+    getServices: () => ({
+      core: {
+        uiSettings: {
+          get: (key: string) => {
+            return mockUiSettings.get(key);
+          },
+          set: (key: string, value: boolean) => {
+            mockUiSettings.set(key, value);
+          },
+        },
+      },
+      addBasePath: (path: string) => path,
+    }),
+  };
+});
+
+import { OptionsPopover } from './open_options_popover';
+
+test('should display the correct text if datagrid is selected', () => {
+  const element = document.createElement('div');
+  const component = mountWithIntl(<OptionsPopover onClose={jest.fn()} anchorElement={element} />);
+  expect(findTestSubject(component, 'docTableMode').text()).toBe('Data grid');
+});
+
+test('should display the correct text if legacy table is selected', () => {
+  const {
+    core: { uiSettings },
+  } = getServices();
+  uiSettings.set('doc_table:legacy', true);
+  const element = document.createElement('div');
+  const component = mountWithIntl(<OptionsPopover onClose={jest.fn()} anchorElement={element} />);
+  expect(findTestSubject(component, 'docTableMode').text()).toBe('Legacy table');
+});
diff --git a/src/plugins/discover/public/application/components/top_nav/open_options_popover.tsx b/src/plugins/discover/public/application/components/top_nav/open_options_popover.tsx
new file mode 100644
index 00000000000000..6eb7fccd3aaa82
--- /dev/null
+++ b/src/plugins/discover/public/application/components/top_nav/open_options_popover.tsx
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import ReactDOM from 'react-dom';
+import { I18nStart } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiSpacer, EuiButton, EuiText, EuiWrappingPopover, EuiCode } from '@elastic/eui';
+import { getServices } from '../../../kibana_services';
+import './open_options_popover.scss';
+
+let isOpen = false;
+
+interface OptionsPopoverProps {
+  onClose: () => void;
+  anchorElement: HTMLElement;
+}
+
+export function OptionsPopover(props: OptionsPopoverProps) {
+  const {
+    core: { uiSettings },
+    addBasePath,
+  } = getServices();
+  const isLegacy = uiSettings.get('doc_table:legacy');
+
+  const mode = isLegacy
+    ? i18n.translate('discover.openOptionsPopover.legacyTableText', {
+        defaultMessage: 'Legacy table',
+      })
+    : i18n.translate('discover.openOptionsPopover.dataGridText', {
+        defaultMessage: 'Data grid',
+      });
+
+  return (
+    <EuiWrappingPopover ownFocus button={props.anchorElement} closePopover={props.onClose} isOpen>
+      <div className="dscOptionsPopover">
+        <EuiText color="subdued" size="s">
+          <p>
+            <strong>Current view mode:</strong>{' '}
+            <EuiCode data-test-subj="docTableMode">{mode}</EuiCode>
+          </p>
+        </EuiText>
+        <EuiSpacer size="s" />
+        <EuiText color="subdued" size="s">
+          <FormattedMessage
+            id="discover.topNav.openOptionsPopover.description"
+            defaultMessage="The new data grid layout includes enhanced data sorting, drag-and-drop columns, multi-document selection, and a full screen view. Toggle 'Use legacy table' in Advanced Settings to switch modes."
+          />
+        </EuiText>
+        <EuiSpacer />
+        <EuiButton
+          iconType="tableDensityNormal"
+          fullWidth
+          href={addBasePath('/app/management/kibana/settings?query=Use legacy table')}
+        >
+          {i18n.translate('discover.openOptionsPopover.goToAdvancedSettings', {
+            defaultMessage: 'Go to Advanced Settings',
+          })}
+        </EuiButton>
+      </div>
+    </EuiWrappingPopover>
+  );
+}
+
+export function openOptionsPopover({
+  I18nContext,
+  anchorElement,
+}: {
+  I18nContext: I18nStart['Context'];
+  anchorElement: HTMLElement;
+}) {
+  if (isOpen) {
+    return;
+  }
+
+  isOpen = true;
+  const container = document.createElement('div');
+  const onClose = () => {
+    ReactDOM.unmountComponentAtNode(container);
+    document.body.removeChild(container);
+    isOpen = false;
+  };
+
+  document.body.appendChild(container);
+
+  const element = (
+    <I18nContext>
+      <OptionsPopover onClose={onClose} anchorElement={anchorElement} />
+    </I18nContext>
+  );
+  ReactDOM.render(element, container);
+}
diff --git a/src/plugins/discover/public/application/embeddable/search_embeddable.ts b/src/plugins/discover/public/application/embeddable/search_embeddable.ts
index 237da72ae3a523..dbaf07fed18c29 100644
--- a/src/plugins/discover/public/application/embeddable/search_embeddable.ts
+++ b/src/plugins/discover/public/application/embeddable/search_embeddable.ts
@@ -317,17 +317,6 @@ export class SearchEmbeddable
 
     // Log request to inspector
     this.inspectorAdapters.requests!.reset();
-    const title = i18n.translate('discover.embeddable.inspectorRequestDataTitle', {
-      defaultMessage: 'Data',
-    });
-    const description = i18n.translate('discover.embeddable.inspectorRequestDescription', {
-      defaultMessage: 'This request queries Elasticsearch to fetch the data for the search.',
-    });
-
-    const requestResponder = this.inspectorAdapters.requests!.start(title, {
-      description,
-      searchSessionId,
-    });
 
     this.searchScope.$apply(() => {
       this.searchScope!.isLoading = true;
@@ -340,7 +329,16 @@ export class SearchEmbeddable
         .fetch$({
           abortSignal: this.abortController.signal,
           sessionId: searchSessionId,
-          requestResponder,
+          inspector: {
+            adapter: this.inspectorAdapters.requests,
+            title: i18n.translate('discover.embeddable.inspectorRequestDataTitle', {
+              defaultMessage: 'Data',
+            }),
+            description: i18n.translate('discover.embeddable.inspectorRequestDescription', {
+              defaultMessage:
+                'This request queries Elasticsearch to fetch the data for the search.',
+            }),
+          },
         })
         .toPromise();
       this.updateOutput({ loading: false, error: undefined });
diff --git a/src/plugins/discover/server/ui_settings.ts b/src/plugins/discover/server/ui_settings.ts
index d3fdb6e72c6510..103a06965835ea 100644
--- a/src/plugins/discover/server/ui_settings.ts
+++ b/src/plugins/discover/server/ui_settings.ts
@@ -157,7 +157,7 @@ export const uiSettings: Record<string, UiSettingsParams> = {
     name: i18n.translate('discover.advancedSettings.docTableVersionName', {
       defaultMessage: 'Use legacy table',
     }),
-    value: true,
+    value: false,
     description: i18n.translate('discover.advancedSettings.docTableVersionDescription', {
       defaultMessage:
         'Discover uses a new table layout that includes better data sorting, drag-and-drop columns, and a full screen ' +
diff --git a/src/plugins/embeddable/public/lib/containers/container.ts b/src/plugins/embeddable/public/lib/containers/container.ts
index 24af29d0cee566..fabe3cd32f34bf 100644
--- a/src/plugins/embeddable/public/lib/containers/container.ts
+++ b/src/plugins/embeddable/public/lib/containers/container.ts
@@ -32,7 +32,7 @@ export abstract class Container<
   extends Embeddable<TContainerInput, TContainerOutput>
   implements IContainer<TChildInput, TContainerInput, TContainerOutput> {
   public readonly isContainer: boolean = true;
-  protected readonly children: {
+  public readonly children: {
     [key: string]: IEmbeddable<any, any> | ErrorEmbeddable;
   } = {};
 
diff --git a/src/plugins/embeddable/public/lib/embeddables/default_embeddable_factory_provider.ts b/src/plugins/embeddable/public/lib/embeddables/default_embeddable_factory_provider.ts
index 27164b3cddbc22..b260c594591fa4 100644
--- a/src/plugins/embeddable/public/lib/embeddables/default_embeddable_factory_provider.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/default_embeddable_factory_provider.ts
@@ -37,11 +37,14 @@ export const defaultEmbeddableFactoryProvider = <
     type: def.type,
     isEditable: def.isEditable.bind(def),
     getDisplayName: def.getDisplayName.bind(def),
+    getDescription: def.getDescription ? def.getDescription.bind(def) : () => '',
+    getIconType: def.getIconType ? def.getIconType.bind(def) : () => 'empty',
     savedObjectMetaData: def.savedObjectMetaData,
     telemetry: def.telemetry || (() => ({})),
     inject: def.inject || ((state: EmbeddableStateWithType) => state),
     extract: def.extract || ((state: EmbeddableStateWithType) => ({ state, references: [] })),
     migrations: def.migrations || {},
+    grouping: def.grouping,
   };
   return factory;
 };
diff --git a/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts b/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts
index 7f3277130f90fd..6ec035f442dd2c 100644
--- a/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts
@@ -14,6 +14,7 @@ import { IContainer } from '../containers/i_container';
 import { PropertySpec } from '../types';
 import { PersistableState } from '../../../../kibana_utils/common';
 import { EmbeddableStateWithType } from '../../../common/types';
+import { UiActionsPresentableGrouping } from '../../../../ui_actions/public';
 
 export interface EmbeddableInstanceConfiguration {
   id: string;
@@ -48,6 +49,12 @@ export interface EmbeddableFactory<
 
   readonly savedObjectMetaData?: SavedObjectMetaData<TSavedObjectAttributes>;
 
+  /**
+   * Indicates the grouping this factory should appear in a sub-menu. Example, this is used for grouping
+   * options in the editors menu in Dashboard for creating new embeddables
+   */
+  readonly grouping?: UiActionsPresentableGrouping;
+
   /**
    * True if is this factory create embeddables that are Containers. Used in the add panel to
    * conditionally show whether these can be added to another container. It's just not
@@ -62,6 +69,16 @@ export interface EmbeddableFactory<
    */
   getDisplayName(): string;
 
+  /**
+   * Returns an EUI Icon type to be displayed in a menu.
+   */
+  getIconType(): string;
+
+  /**
+   * Returns a description about the embeddable.
+   */
+  getDescription(): string;
+
   /**
    * If false, this type of embeddable can't be created with the "createNew" functionality. Instead,
    * use createFromSavedObject, where an existing saved object must first exist.
diff --git a/src/plugins/embeddable/public/lib/embeddables/embeddable_factory_definition.ts b/src/plugins/embeddable/public/lib/embeddables/embeddable_factory_definition.ts
index a64aa32c6e7c4a..f2819f2a2e6640 100644
--- a/src/plugins/embeddable/public/lib/embeddables/embeddable_factory_definition.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/embeddable_factory_definition.ts
@@ -33,5 +33,8 @@ export type EmbeddableFactoryDefinition<
         | 'extract'
         | 'inject'
         | 'migrations'
+        | 'grouping'
+        | 'getIconType'
+        | 'getDescription'
       >
     >;
diff --git a/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss b/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss
index d21911f10f82e9..f7ee1f3c741c49 100644
--- a/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss
+++ b/src/plugins/embeddable/public/lib/panel/_embeddable_panel.scss
@@ -162,12 +162,5 @@
 .embPanel__label {
   position: absolute;
   padding-left: $euiSizeS;
-}
-
-.embPanel__content[data-error],
-.embPanel__content[data-loading] {
-  pointer-events: none;
-  filter: grayscale(100%);
-  /* stylelint-disable-next-line color-named */
-  filter: gray;
+  z-index: $euiZLevel1;
 }
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.test.tsx b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.test.tsx
index 432897763aa049..1c96945f014c8b 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.test.tsx
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.test.tsx
@@ -61,6 +61,7 @@ test('createNewEmbeddable() add embeddable to container', async () => {
       getAllFactories={start.getEmbeddableFactories}
       notifications={core.notifications}
       SavedObjectFinder={() => null}
+      showCreateNewMenu
     />
   ) as ReactWrapper<unknown, unknown, AddPanelFlyout>;
 
@@ -112,6 +113,7 @@ test('selecting embeddable in "Create new ..." list calls createNewEmbeddable()'
       getAllFactories={start.getEmbeddableFactories}
       notifications={core.notifications}
       SavedObjectFinder={(props) => <DummySavedObjectFinder {...props} />}
+      showCreateNewMenu
     />
   ) as ReactWrapper<any, {}, AddPanelFlyout>;
 
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.tsx b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.tsx
index 8caec4a4428c3f..6d6a68d7e5e2aa 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.tsx
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_flyout.tsx
@@ -26,6 +26,7 @@ interface Props {
   getAllFactories: EmbeddableStart['getEmbeddableFactories'];
   notifications: CoreSetup['notifications'];
   SavedObjectFinder: React.ComponentType<any>;
+  showCreateNewMenu?: boolean;
 }
 
 interface State {
@@ -134,7 +135,9 @@ export class AddPanelFlyout extends React.Component<Props, State> {
           defaultMessage: 'No matching objects found.',
         })}
       >
-        <SavedObjectFinderCreateNew menuItems={this.getCreateMenuItems()} />
+        {this.props.showCreateNewMenu ? (
+          <SavedObjectFinderCreateNew menuItems={this.getCreateMenuItems()} />
+        ) : null}
       </SavedObjectFinder>
     );
 
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/open_add_panel_flyout.tsx b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/open_add_panel_flyout.tsx
index bed97c82095c79..f0c6e81644b3d0 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/open_add_panel_flyout.tsx
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/open_add_panel_flyout.tsx
@@ -20,6 +20,7 @@ export function openAddPanelFlyout(options: {
   overlays: OverlayStart;
   notifications: NotificationsStart;
   SavedObjectFinder: React.ComponentType<any>;
+  showCreateNewMenu?: boolean;
 }): OverlayRef {
   const {
     embeddable,
@@ -28,6 +29,7 @@ export function openAddPanelFlyout(options: {
     overlays,
     notifications,
     SavedObjectFinder,
+    showCreateNewMenu,
   } = options;
   const flyoutSession = overlays.openFlyout(
     toMountPoint(
@@ -42,6 +44,7 @@ export function openAddPanelFlyout(options: {
         getAllFactories={getAllFactories}
         notifications={notifications}
         SavedObjectFinder={SavedObjectFinder}
+        showCreateNewMenu={showCreateNewMenu}
       />
     ),
     {
diff --git a/src/plugins/embeddable/public/public.api.md b/src/plugins/embeddable/public/public.api.md
index 220039de2f34ee..2a577e6167be5f 100644
--- a/src/plugins/embeddable/public/public.api.md
+++ b/src/plugins/embeddable/public/public.api.md
@@ -160,7 +160,7 @@ export abstract class Container<TChildInput extends Partial<EmbeddableInput> = {
     // (undocumented)
     addNewEmbeddable<EEI extends EmbeddableInput = EmbeddableInput, EEO extends EmbeddableOutput = EmbeddableOutput, E extends IEmbeddable<EEI, EEO> = IEmbeddable<EEI, EEO>>(type: string, explicitInput: Partial<EEI>): Promise<E | ErrorEmbeddable>;
     // (undocumented)
-    protected readonly children: {
+    readonly children: {
         [key: string]: IEmbeddable<any, any> | ErrorEmbeddable;
     };
     // (undocumented)
@@ -378,8 +378,12 @@ export interface EmbeddableFactory<TEmbeddableInput extends EmbeddableInput = Em
     create(initialInput: TEmbeddableInput, parent?: IContainer): Promise<TEmbeddable | ErrorEmbeddable | undefined>;
     createFromSavedObject(savedObjectId: string, input: Partial<TEmbeddableInput>, parent?: IContainer): Promise<TEmbeddable | ErrorEmbeddable>;
     getDefaultInput(partial: Partial<TEmbeddableInput>): Partial<TEmbeddableInput>;
+    getDescription(): string;
     getDisplayName(): string;
     getExplicitInput(): Promise<Partial<TEmbeddableInput>>;
+    getIconType(): string;
+    // Warning: (ae-forgotten-export) The symbol "PresentableGrouping" needs to be exported by the entry point index.d.ts
+    readonly grouping?: PresentableGrouping;
     readonly isContainerType: boolean;
     readonly isEditable: () => Promise<boolean>;
     // Warning: (ae-forgotten-export) The symbol "SavedObjectMetaData" needs to be exported by the entry point index.d.ts
@@ -393,7 +397,7 @@ export interface EmbeddableFactory<TEmbeddableInput extends EmbeddableInput = Em
 // Warning: (ae-missing-release-tag) "EmbeddableFactoryDefinition" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export type EmbeddableFactoryDefinition<I extends EmbeddableInput = EmbeddableInput, O extends EmbeddableOutput = EmbeddableOutput, E extends IEmbeddable<I, O> = IEmbeddable<I, O>, T extends SavedObjectAttributes = SavedObjectAttributes> = Pick<EmbeddableFactory<I, O, E, T>, 'create' | 'type' | 'isEditable' | 'getDisplayName'> & Partial<Pick<EmbeddableFactory<I, O, E, T>, 'createFromSavedObject' | 'isContainerType' | 'getExplicitInput' | 'savedObjectMetaData' | 'canCreateNew' | 'getDefaultInput' | 'telemetry' | 'extract' | 'inject' | 'migrations'>>;
+export type EmbeddableFactoryDefinition<I extends EmbeddableInput = EmbeddableInput, O extends EmbeddableOutput = EmbeddableOutput, E extends IEmbeddable<I, O> = IEmbeddable<I, O>, T extends SavedObjectAttributes = SavedObjectAttributes> = Pick<EmbeddableFactory<I, O, E, T>, 'create' | 'type' | 'isEditable' | 'getDisplayName'> & Partial<Pick<EmbeddableFactory<I, O, E, T>, 'createFromSavedObject' | 'isContainerType' | 'getExplicitInput' | 'savedObjectMetaData' | 'canCreateNew' | 'getDefaultInput' | 'telemetry' | 'extract' | 'inject' | 'migrations' | 'grouping' | 'getIconType' | 'getDescription'>>;
 
 // Warning: (ae-missing-release-tag) "EmbeddableFactoryNotFoundError" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -724,6 +728,7 @@ export function openAddPanelFlyout(options: {
     overlays: OverlayStart_2;
     notifications: NotificationsStart_2;
     SavedObjectFinder: React.ComponentType<any>;
+    showCreateNewMenu?: boolean;
 }): OverlayRef_2;
 
 // Warning: (ae-missing-release-tag) "OutputSpec" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
diff --git a/src/plugins/home/server/services/sample_data/routes/install.ts b/src/plugins/home/server/services/sample_data/routes/install.ts
index a20c3e350222f3..e5ff33d5c199dd 100644
--- a/src/plugins/home/server/services/sample_data/routes/install.ts
+++ b/src/plugins/home/server/services/sample_data/routes/install.ts
@@ -7,7 +7,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { IRouter, Logger, RequestHandlerContext } from 'src/core/server';
+import { IRouter, Logger, IScopedClusterClient } from 'src/core/server';
 import { SampleDatasetSchema } from '../lib/sample_dataset_registry_types';
 import { createIndexName } from '../lib/create_index_name';
 import {
@@ -22,7 +22,7 @@ const insertDataIntoIndex = (
   dataIndexConfig: any,
   index: string,
   nowReference: string,
-  context: RequestHandlerContext,
+  esClient: IScopedClusterClient,
   logger: Logger
 ) => {
   function updateTimestamps(doc: any) {
@@ -51,9 +51,11 @@ const insertDataIntoIndex = (
       bulk.push(insertCmd);
       bulk.push(updateTimestamps(doc));
     });
-    const resp = await context.core.elasticsearch.legacy.client.callAsCurrentUser('bulk', {
+
+    const { body: resp } = await esClient.asCurrentUser.bulk({
       body: bulk,
     });
+
     if (resp.errors) {
       const errMsg = `sample_data install errors while bulk inserting. Elasticsearch response: ${JSON.stringify(
         resp,
@@ -100,7 +102,7 @@ export function createInstallRoute(
 
         // clean up any old installation of dataset
         try {
-          await context.core.elasticsearch.legacy.client.callAsCurrentUser('indices.delete', {
+          await context.core.elasticsearch.client.asCurrentUser.indices.delete({
             index,
           });
         } catch (err) {
@@ -108,17 +110,13 @@ export function createInstallRoute(
         }
 
         try {
-          const createIndexParams = {
+          await context.core.elasticsearch.client.asCurrentUser.indices.create({
             index,
             body: {
               settings: { index: { number_of_shards: 1, auto_expand_replicas: '0-1' } },
               mappings: { properties: dataIndexConfig.fields },
             },
-          };
-          await context.core.elasticsearch.legacy.client.callAsCurrentUser(
-            'indices.create',
-            createIndexParams
-          );
+          });
         } catch (err) {
           const errMsg = `Unable to create sample data index "${index}", error: ${err.message}`;
           logger.warn(errMsg);
@@ -130,7 +128,7 @@ export function createInstallRoute(
             dataIndexConfig,
             index,
             nowReference,
-            context,
+            context.core.elasticsearch.client,
             logger
           );
           (counts as any)[index] = count;
diff --git a/src/plugins/home/server/services/sample_data/routes/list.ts b/src/plugins/home/server/services/sample_data/routes/list.ts
index 86e286644f9368..72d8c31cbafd74 100644
--- a/src/plugins/home/server/services/sample_data/routes/list.ts
+++ b/src/plugins/home/server/services/sample_data/routes/list.ts
@@ -36,22 +36,20 @@ export const createListRoute = (router: IRouter, sampleDatasets: SampleDatasetSc
         const dataIndexConfig = sampleDataset.dataIndices[i];
         const index = createIndexName(sampleDataset.id, dataIndexConfig.id);
         try {
-          const indexExists = await context.core.elasticsearch.legacy.client.callAsCurrentUser(
-            'indices.exists',
-            { index }
-          );
+          const {
+            body: indexExists,
+          } = await context.core.elasticsearch.client.asCurrentUser.indices.exists({
+            index,
+          });
           if (!indexExists) {
             sampleDataset.status = NOT_INSTALLED;
             return;
           }
 
-          const { count } = await context.core.elasticsearch.legacy.client.callAsCurrentUser(
-            'count',
-            {
-              index,
-            }
-          );
-          if (count === 0) {
+          const { body: count } = await context.core.elasticsearch.client.asCurrentUser.count({
+            index,
+          });
+          if (count.count === 0) {
             sampleDataset.status = NOT_INSTALLED;
             return;
           }
diff --git a/src/plugins/home/server/services/sample_data/routes/uninstall.ts b/src/plugins/home/server/services/sample_data/routes/uninstall.ts
index aa8ed67cf840a2..3108c06492dd80 100644
--- a/src/plugins/home/server/services/sample_data/routes/uninstall.ts
+++ b/src/plugins/home/server/services/sample_data/routes/uninstall.ts
@@ -28,11 +28,7 @@ export function createUninstallRoute(
     async (
       {
         core: {
-          elasticsearch: {
-            legacy: {
-              client: { callAsCurrentUser },
-            },
-          },
+          elasticsearch: { client: esClient },
           savedObjects: { getClient: getSavedObjectsClient, typeRegistry },
         },
       },
@@ -50,7 +46,9 @@ export function createUninstallRoute(
         const index = createIndexName(sampleDataset.id, dataIndexConfig.id);
 
         try {
-          await callAsCurrentUser('indices.delete', { index });
+          await esClient.asCurrentUser.indices.delete({
+            index,
+          });
         } catch (err) {
           return response.customError({
             statusCode: err.status,
diff --git a/src/plugins/home/server/services/sample_data/usage/collector.ts b/src/plugins/home/server/services/sample_data/usage/collector.ts
index 81958a2e3c8784..df7d485c1f6fa1 100644
--- a/src/plugins/home/server/services/sample_data/usage/collector.ts
+++ b/src/plugins/home/server/services/sample_data/usage/collector.ts
@@ -6,22 +6,17 @@
  * Side Public License, v 1.
  */
 
-import { PluginInitializerContext } from 'kibana/server';
-import { first } from 'rxjs/operators';
+import type { PluginInitializerContext } from 'kibana/server';
+import type { UsageCollectionSetup } from '../../../../../usage_collection/server';
 import { fetchProvider, TelemetryResponse } from './collector_fetch';
-import { UsageCollectionSetup } from '../../../../../usage_collection/server';
 
-export async function makeSampleDataUsageCollector(
+export function makeSampleDataUsageCollector(
   usageCollection: UsageCollectionSetup,
   context: PluginInitializerContext
 ) {
-  let index: string;
-  try {
-    const config = await context.config.legacy.globalConfig$.pipe(first()).toPromise();
-    index = config.kibana.index;
-  } catch (err) {
-    return; // kibana plugin is not enabled (test environment)
-  }
+  const config = context.config.legacy.get();
+  const index = config.kibana.index;
+
   const collector = usageCollection.makeUsageCollector<TelemetryResponse>({
     type: 'sample-data',
     fetch: fetchProvider(index),
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap
index 70b638d5d0b8d4..21248ac9d1dc0b 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap
@@ -22,6 +22,7 @@ exports[`CreateIndexPatternWizard renders index pattern step when there are indi
           "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
           "links": Object {
             "indexPatterns": Object {},
+            "runtimeFields": Object {},
             "scriptedFields": Object {},
           },
         }
@@ -72,6 +73,7 @@ exports[`CreateIndexPatternWizard renders the empty state when there are no indi
           "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
           "links": Object {
             "indexPatterns": Object {},
+            "runtimeFields": Object {},
             "scriptedFields": Object {},
           },
         }
@@ -116,6 +118,7 @@ exports[`CreateIndexPatternWizard renders time field step when step is set to 2
           "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
           "links": Object {
             "indexPatterns": Object {},
+            "runtimeFields": Object {},
             "scriptedFields": Object {},
           },
         }
@@ -160,6 +163,7 @@ exports[`CreateIndexPatternWizard renders when there are no indices but there ar
           "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
           "links": Object {
             "indexPatterns": Object {},
+            "runtimeFields": Object {},
             "scriptedFields": Object {},
           },
         }
@@ -204,6 +208,7 @@ exports[`CreateIndexPatternWizard shows system indices even if there are no othe
           "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
           "links": Object {
             "indexPatterns": Object {},
+            "runtimeFields": Object {},
             "scriptedFields": Object {},
           },
         }
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/__snapshots__/header.test.tsx.snap b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/__snapshots__/header.test.tsx.snap
index 5218ebd1b4ad44..e9bf6cf9002a92 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/__snapshots__/header.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/__snapshots__/header.test.tsx.snap
@@ -1,49 +1,205 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`Header should render normally 1`] = `
-<div
-  class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+<Component
+  history={
+    Object {
+      "action": "PUSH",
+      "block": [MockFunction],
+      "createHref": [MockFunction] {
+        "calls": Array [
+          Array [
+            Object {
+              "hash": "",
+              "pathname": "patterns/test/create-field/",
+              "search": "",
+            },
+          ],
+        ],
+        "results": Array [
+          Object {
+            "type": "return",
+            "value": undefined,
+          },
+        ],
+      },
+      "createSubHistory": [MockFunction],
+      "go": [MockFunction],
+      "goBack": [MockFunction],
+      "goForward": [MockFunction],
+      "length": 1,
+      "listen": [MockFunction],
+      "location": Object {
+        "hash": "",
+        "key": undefined,
+        "pathname": "/",
+        "search": "",
+        "state": undefined,
+      },
+      "push": [MockFunction],
+      "replace": [MockFunction],
+    }
+  }
+  indexPatternId="test"
+  location={Object {}}
+  match={Object {}}
 >
-  <div
-    class="euiFlexItem"
+  <EuiFlexGroup
+    alignItems="center"
   >
-    <h3
-      class="euiTitle euiTitle--small"
-    >
-      <span>
-        Scripted fields
-      </span>
-    </h3>
     <div
-      class="euiText euiText--medium"
-    >
-      <p>
-        <span>
-          You can use scripted fields in visualizations and display them in your documents. However, you cannot search scripted fields.
-        </span>
-      </p>
-    </div>
-  </div>
-  <div
-    class="euiFlexItem euiFlexItem--flexGrowZero"
-  >
-    <button
-      class="euiButton euiButton--primary"
-      data-test-subj="addScriptedFieldLink"
-      type="button"
+      className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
     >
-      <span
-        class="euiButtonContent euiButton__content"
+      <EuiFlexItem>
+        <div
+          className="euiFlexItem"
+        >
+          <EuiText
+            size="s"
+          >
+            <div
+              className="euiText euiText--small"
+            >
+              <p>
+                <FormattedMessage
+                  defaultMessage="Scripted fields can be used in visualizations and displayed in documents. However, they cannot be searched."
+                  id="indexPatternManagement.editIndexPattern.scriptedLabel"
+                  values={Object {}}
+                >
+                  <span>
+                    Scripted fields can be used in visualizations and displayed in documents. However, they cannot be searched.
+                  </span>
+                </FormattedMessage>
+                <br />
+                <EuiIcon
+                  color="warning"
+                  style={
+                    Object {
+                      "marginRight": "4px",
+                    }
+                  }
+                  type="alert"
+                >
+                  <span
+                    color="warning"
+                    data-euiicon-type="alert"
+                    style={
+                      Object {
+                        "marginRight": "4px",
+                      }
+                    }
+                  />
+                </EuiIcon>
+                <FormattedMessage
+                  defaultMessage="Scripted fields are deprecated, {runtimeDocs}."
+                  id="indexPatternManagement.editIndexPattern.deprecation"
+                  values={
+                    Object {
+                      "runtimeDocs": <EuiLink
+                        target="_blank"
+                      >
+                        <FormattedMessage
+                          defaultMessage="use runtime fields instead"
+                          id="indexPatternManagement.header.runtimeLink"
+                          values={Object {}}
+                        />
+                      </EuiLink>,
+                    }
+                  }
+                >
+                  <span>
+                    Scripted fields are deprecated, 
+                    <EuiLink
+                      target="_blank"
+                    >
+                      <button
+                        className="euiLink euiLink--primary"
+                        disabled={false}
+                        type="button"
+                      >
+                        <FormattedMessage
+                          defaultMessage="use runtime fields instead"
+                          id="indexPatternManagement.header.runtimeLink"
+                          values={Object {}}
+                        >
+                          <span>
+                            use runtime fields instead
+                          </span>
+                        </FormattedMessage>
+                      </button>
+                    </EuiLink>
+                    .
+                  </span>
+                </FormattedMessage>
+              </p>
+            </div>
+          </EuiText>
+        </div>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
       >
-        <span
-          class="euiButton__text"
+        <div
+          className="euiFlexItem euiFlexItem--flexGrowZero"
         >
-          <span>
-            Add scripted field
-          </span>
-        </span>
-      </span>
-    </button>
-  </div>
-</div>
+          <EuiButton
+            data-test-subj="addScriptedFieldLink"
+            onClick={[Function]}
+          >
+            <EuiButtonDisplay
+              baseClassName="euiButton"
+              data-test-subj="addScriptedFieldLink"
+              disabled={false}
+              element="button"
+              isDisabled={false}
+              onClick={[Function]}
+              type="button"
+            >
+              <button
+                className="euiButton euiButton--primary"
+                data-test-subj="addScriptedFieldLink"
+                disabled={false}
+                onClick={[Function]}
+                style={
+                  Object {
+                    "minWidth": undefined,
+                  }
+                }
+                type="button"
+              >
+                <EuiButtonContent
+                  className="euiButton__content"
+                  iconSide="left"
+                  textProps={
+                    Object {
+                      "className": "euiButton__text",
+                    }
+                  }
+                >
+                  <span
+                    className="euiButtonContent euiButton__content"
+                  >
+                    <span
+                      className="euiButton__text"
+                    >
+                      <FormattedMessage
+                        defaultMessage="Add scripted field"
+                        id="indexPatternManagement.editIndexPattern.scripted.addFieldButton"
+                        values={Object {}}
+                      >
+                        <span>
+                          Add scripted field
+                        </span>
+                      </FormattedMessage>
+                    </span>
+                  </span>
+                </EuiButtonContent>
+              </button>
+            </EuiButtonDisplay>
+          </EuiButton>
+        </div>
+      </EuiFlexItem>
+    </div>
+  </EuiFlexGroup>
+</Component>
 `;
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.test.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.test.tsx
index 3e2da10cb14735..609769690dbaea 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.test.tsx
@@ -7,22 +7,31 @@
  */
 
 import React from 'react';
-import { render } from 'enzyme';
+import { mount } from 'enzyme';
 import { RouteComponentProps } from 'react-router-dom';
 import { ScopedHistory } from 'kibana/public';
 import { scopedHistoryMock } from '../../../../../../../../core/public/mocks';
+import { KibanaContextProvider } from 'src/plugins/kibana_react/public';
+import { mockManagementPlugin } from '../../../../../mocks';
 
 import { Header } from './header';
 
 describe('Header', () => {
+  const mockedContext = mockManagementPlugin.createIndexPatternManagmentContext();
   test('should render normally', () => {
-    const component = render(
+    const component = mount(
       <Header.WrappedComponent
         indexPatternId="test"
         history={(scopedHistoryMock.create() as unknown) as ScopedHistory}
         location={({} as unknown) as RouteComponentProps['location']}
         match={({} as unknown) as RouteComponentProps['match']}
-      />
+      />,
+      {
+        wrappingComponent: KibanaContextProvider,
+        wrappingComponentProps: {
+          services: mockedContext,
+        },
+      }
     );
 
     expect(component).toMatchSnapshot();
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.tsx
index 607f9ff804e7d2..96445b985e34c3 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/scripted_fields_table/components/header/header.tsx
@@ -8,50 +8,61 @@
 
 import React from 'react';
 import { withRouter, RouteComponentProps } from 'react-router-dom';
-import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiText, EuiTitle } from '@elastic/eui';
+import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiText, EuiLink, EuiIcon } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n/react';
 import { ScopedHistory } from 'kibana/public';
 
-import { reactRouterNavigate } from '../../../../../../../kibana_react/public';
+import { reactRouterNavigate, useKibana } from '../../../../../../../kibana_react/public';
+import { IndexPatternManagmentContext } from '../../../../../types';
 
 interface HeaderProps extends RouteComponentProps {
   indexPatternId: string;
   history: ScopedHistory;
 }
 
-export const Header = withRouter(({ indexPatternId, history }: HeaderProps) => (
-  <EuiFlexGroup alignItems="center">
-    <EuiFlexItem>
-      <EuiTitle size="s">
-        <h3>
-          <FormattedMessage
-            id="indexPatternManagement.editIndexPattern.scriptedHeader"
-            defaultMessage="Scripted fields"
-          />
-        </h3>
-      </EuiTitle>
-      <EuiText>
-        <p>
+export const Header = withRouter(({ indexPatternId, history }: HeaderProps) => {
+  const docLinks = useKibana<IndexPatternManagmentContext>().services.docLinks?.links;
+  return (
+    <EuiFlexGroup alignItems="center">
+      <EuiFlexItem>
+        <EuiText size="s">
+          <p>
+            <FormattedMessage
+              id="indexPatternManagement.editIndexPattern.scriptedLabel"
+              defaultMessage="Scripted fields can be used in visualizations and displayed in documents. However, they cannot be searched."
+            />
+            <br />
+            <EuiIcon type="alert" color="warning" style={{ marginRight: '4px' }} />
+            <FormattedMessage
+              id="indexPatternManagement.editIndexPattern.deprecation"
+              defaultMessage="Scripted fields are deprecated, {runtimeDocs}."
+              values={{
+                runtimeDocs: (
+                  <EuiLink target="_blank" href={docLinks.runtimeFields.overview}>
+                    <FormattedMessage
+                      id="indexPatternManagement.header.runtimeLink"
+                      defaultMessage="use runtime fields instead"
+                    />
+                  </EuiLink>
+                ),
+              }}
+            />
+          </p>
+        </EuiText>
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        <EuiButton
+          data-test-subj="addScriptedFieldLink"
+          {...reactRouterNavigate(history, `patterns/${indexPatternId}/create-field/`)}
+        >
           <FormattedMessage
-            id="indexPatternManagement.editIndexPattern.scriptedLabel"
-            defaultMessage="You can use scripted fields in visualizations and display them in your documents. However, you cannot search
-            scripted fields."
+            id="indexPatternManagement.editIndexPattern.scripted.addFieldButton"
+            defaultMessage="Add scripted field"
           />
-        </p>
-      </EuiText>
-    </EuiFlexItem>
-
-    <EuiFlexItem grow={false}>
-      <EuiButton
-        data-test-subj="addScriptedFieldLink"
-        {...reactRouterNavigate(history, `patterns/${indexPatternId}/create-field/`)}
-      >
-        <FormattedMessage
-          id="indexPatternManagement.editIndexPattern.scripted.addFieldButton"
-          defaultMessage="Add scripted field"
-        />
-      </EuiButton>
-    </EuiFlexItem>
-  </EuiFlexGroup>
-));
+        </EuiButton>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+});
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/__snapshots__/header.test.tsx.snap b/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/__snapshots__/header.test.tsx.snap
index daa8e4a1c70638..1f56e3caeaf6b6 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/__snapshots__/header.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/__snapshots__/header.test.tsx.snap
@@ -2,18 +2,9 @@
 
 exports[`Header should render normally 1`] = `
 <Fragment>
-  <EuiTitle
+  <EuiText
     size="s"
   >
-    <h3>
-      <FormattedMessage
-        defaultMessage="Field filters"
-        id="indexPatternManagement.editIndexPattern.sourceHeader"
-        values={Object {}}
-      />
-    </h3>
-  </EuiTitle>
-  <EuiText>
     <p>
       <FormattedMessage
         defaultMessage="Field filters can be used to exclude one or more fields when fetching a document. This happens when viewing a document in the Discover app, or with a table displaying results from a saved search in the Dashboard app. If you have documents with large or unimportant fields you may benefit from filtering those out at this lower level."
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/header.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/header.tsx
index 53671d4072d2e8..626be02bfb7ba1 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/header.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/source_filters_table/components/header/header.tsx
@@ -8,20 +8,12 @@
 
 import React from 'react';
 
-import { EuiTitle, EuiText, EuiSpacer } from '@elastic/eui';
+import { EuiText, EuiSpacer } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 export const Header = () => (
   <>
-    <EuiTitle size="s">
-      <h3>
-        <FormattedMessage
-          id="indexPatternManagement.editIndexPattern.sourceHeader"
-          defaultMessage="Field filters"
-        />
-      </h3>
-    </EuiTitle>
-    <EuiText>
+    <EuiText size="s">
       <p>
         <FormattedMessage
           id="indexPatternManagement.editIndexPattern.sourceLabel"
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap
index 4786ff58cb86da..b29d2dd120fed2 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap
@@ -4,13 +4,101 @@ exports[`ScriptingWarningCallOut should render normally 1`] = `
 <ScriptingWarningCallOut
   isVisible={true}
 >
+  <EuiText
+    size="s"
+  >
+    <div
+      className="euiText euiText--small"
+    >
+      <p>
+        <FormattedMessage
+          defaultMessage="Please familiarize yourself with {scripFields} and {scriptsInAggregation} before using this feature. Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow and, if done incorrectly, can cause Kibana to become unusable."
+          id="indexPatternManagement.warningCallOutLabel.callOutDetail"
+          values={
+            Object {
+              "scripFields": <EuiLink
+                target="_blank"
+              >
+                <FormattedMessage
+                  defaultMessage="scripted fields"
+                  id="indexPatternManagement.warningCallOutLabel.scripFieldsLink"
+                  values={Object {}}
+                />
+              </EuiLink>,
+              "scriptsInAggregation": <EuiLink
+                target="_blank"
+              >
+                <FormattedMessage
+                  defaultMessage="scripts in aggregations"
+                  id="indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink"
+                  values={Object {}}
+                />
+              </EuiLink>,
+            }
+          }
+        >
+          <span>
+            Please familiarize yourself with 
+            <EuiLink
+              target="_blank"
+            >
+              <button
+                className="euiLink euiLink--primary"
+                disabled={false}
+                type="button"
+              >
+                <FormattedMessage
+                  defaultMessage="scripted fields"
+                  id="indexPatternManagement.warningCallOutLabel.scripFieldsLink"
+                  values={Object {}}
+                >
+                  <span>
+                    scripted fields
+                  </span>
+                </FormattedMessage>
+              </button>
+            </EuiLink>
+             and 
+            <EuiLink
+              target="_blank"
+            >
+              <button
+                className="euiLink euiLink--primary"
+                disabled={false}
+                type="button"
+              >
+                <FormattedMessage
+                  defaultMessage="scripts in aggregations"
+                  id="indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink"
+                  values={Object {}}
+                >
+                  <span>
+                    scripts in aggregations
+                  </span>
+                </FormattedMessage>
+              </button>
+            </EuiLink>
+             before using this feature. Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow and, if done incorrectly, can cause Kibana to become unusable.
+          </span>
+        </FormattedMessage>
+      </p>
+    </div>
+  </EuiText>
+  <EuiSpacer
+    size="m"
+  >
+    <div
+      className="euiSpacer euiSpacer--m"
+    />
+  </EuiSpacer>
   <EuiCallOut
     color="warning"
     iconType="alert"
     title={
       <FormattedMessage
-        defaultMessage="Proceed with caution"
-        id="indexPatternManagement.warningCallOutHeader"
+        defaultMessage="Scripted fields are deprecated."
+        description="Deprecation warning title within scripted field editor"
+        id="indexPatternManagement.scriptedFieldsDeprecatedTitle"
         values={Object {}}
       />
     }
@@ -38,12 +126,13 @@ exports[`ScriptingWarningCallOut should render normally 1`] = `
           className="euiCallOutHeader__title"
         >
           <FormattedMessage
-            defaultMessage="Proceed with caution"
-            id="indexPatternManagement.warningCallOutHeader"
+            defaultMessage="Scripted fields are deprecated."
+            description="Deprecation warning title within scripted field editor"
+            id="indexPatternManagement.scriptedFieldsDeprecatedTitle"
             values={Object {}}
           >
             <span>
-              Proceed with caution
+              Scripted fields are deprecated.
             </span>
           </FormattedMessage>
         </span>
@@ -54,113 +143,57 @@ exports[`ScriptingWarningCallOut should render normally 1`] = `
         <div
           className="euiText euiText--small"
         >
-          <p>
-            <FormattedMessage
-              defaultMessage="Please familiarize yourself with {scripFields} and with {scriptsInAggregation} before using scripted fields."
-              id="indexPatternManagement.warningCallOutLabel.callOutDetail"
-              values={
-                Object {
-                  "scripFields": <EuiLink
-                    target="_blank"
-                  >
-                    <FormattedMessage
-                      defaultMessage="script fields"
-                      id="indexPatternManagement.warningCallOutLabel.scripFieldsLink"
-                      values={Object {}}
-                    />
-                     
-                    <EuiIcon
-                      type="link"
-                    />
-                  </EuiLink>,
-                  "scriptsInAggregation": <EuiLink
-                    target="_blank"
-                  >
-                    <FormattedMessage
-                      defaultMessage="scripts in aggregations"
-                      id="indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink"
-                      values={Object {}}
-                    />
-                     
-                    <EuiIcon
-                      type="link"
-                    />
-                  </EuiLink>,
-                }
-              }
+          <EuiText
+            size="s"
+          >
+            <div
+              className="euiText euiText--small"
             >
-              <span>
-                Please familiarize yourself with 
-                <EuiLink
-                  target="_blank"
+              <p>
+                <FormattedMessage
+                  defaultMessage="For greater flexibility and Painless script support, {runtimeDocs}."
+                  id="indexPatternManagement.scriptedFieldsDeprecatedBody"
+                  values={
+                    Object {
+                      "runtimeDocs": <EuiLink
+                        target="_blank"
+                      >
+                        <FormattedMessage
+                          defaultMessage="use runtime fields"
+                          id="indexPatternManagement.warningCallOutLabel.runtimeLink"
+                          values={Object {}}
+                        />
+                      </EuiLink>,
+                    }
+                  }
                 >
-                  <button
-                    className="euiLink euiLink--primary"
-                    disabled={false}
-                    type="button"
-                  >
-                    <FormattedMessage
-                      defaultMessage="script fields"
-                      id="indexPatternManagement.warningCallOutLabel.scripFieldsLink"
-                      values={Object {}}
+                  <span>
+                    For greater flexibility and Painless script support, 
+                    <EuiLink
+                      target="_blank"
                     >
-                      <span>
-                        script fields
-                      </span>
-                    </FormattedMessage>
-                     
-                    <EuiIcon
-                      type="link"
-                    >
-                      <span
-                        data-euiicon-type="link"
-                      />
-                    </EuiIcon>
-                  </button>
-                </EuiLink>
-                 and with 
-                <EuiLink
-                  target="_blank"
-                >
-                  <button
-                    className="euiLink euiLink--primary"
-                    disabled={false}
-                    type="button"
-                  >
-                    <FormattedMessage
-                      defaultMessage="scripts in aggregations"
-                      id="indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink"
-                      values={Object {}}
-                    >
-                      <span>
-                        scripts in aggregations
-                      </span>
-                    </FormattedMessage>
-                     
-                    <EuiIcon
-                      type="link"
-                    >
-                      <span
-                        data-euiicon-type="link"
-                      />
-                    </EuiIcon>
-                  </button>
-                </EuiLink>
-                 before using scripted fields.
-              </span>
-            </FormattedMessage>
-          </p>
-          <p>
-            <FormattedMessage
-              defaultMessage="Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow, and if done incorrectly, can cause Kibana to be unusable. There's no safety net here. If you make a typo, unexpected exceptions will be thrown all over the place!"
-              id="indexPatternManagement.warningCallOut.descriptionLabel"
-              values={Object {}}
-            >
-              <span>
-                Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow, and if done incorrectly, can cause Kibana to be unusable. There's no safety net here. If you make a typo, unexpected exceptions will be thrown all over the place!
-              </span>
-            </FormattedMessage>
-          </p>
+                      <button
+                        className="euiLink euiLink--primary"
+                        disabled={false}
+                        type="button"
+                      >
+                        <FormattedMessage
+                          defaultMessage="use runtime fields"
+                          id="indexPatternManagement.warningCallOutLabel.runtimeLink"
+                          values={Object {}}
+                        >
+                          <span>
+                            use runtime fields
+                          </span>
+                        </FormattedMessage>
+                      </button>
+                    </EuiLink>
+                    .
+                  </span>
+                </FormattedMessage>
+              </p>
+            </div>
+          </EuiText>
         </div>
       </EuiText>
     </div>
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/warning_call_out.tsx b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/warning_call_out.tsx
index e52136476dd03a..dc4409d35b3780 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/warning_call_out.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/warning_call_out.tsx
@@ -8,7 +8,7 @@
 
 import React, { Fragment } from 'react';
 
-import { EuiCallOut, EuiIcon, EuiLink, EuiSpacer } from '@elastic/eui';
+import { EuiCallOut, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n/react';
 
@@ -20,56 +20,67 @@ export interface ScriptingWarningCallOutProps {
 }
 
 export const ScriptingWarningCallOut = ({ isVisible = false }: ScriptingWarningCallOutProps) => {
-  const docLinksScriptedFields = useKibana<IndexPatternManagmentContext>().services.docLinks?.links
-    .scriptedFields;
+  const docLinks = useKibana<IndexPatternManagmentContext>().services.docLinks?.links;
   return isVisible ? (
     <Fragment>
-      <EuiCallOut
-        title={
-          <FormattedMessage
-            id="indexPatternManagement.warningCallOutHeader"
-            defaultMessage="Proceed with caution"
-          />
-        }
-        color="warning"
-        iconType="alert"
-      >
+      <EuiText size="s">
         <p>
           <FormattedMessage
             id="indexPatternManagement.warningCallOutLabel.callOutDetail"
-            defaultMessage="Please familiarize yourself with {scripFields} and with {scriptsInAggregation} before using scripted fields."
+            defaultMessage="Please familiarize yourself with {scripFields} and {scriptsInAggregation} before using this feature.
+            Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow and,
+            if done incorrectly, can cause Kibana to become unusable."
             values={{
               scripFields: (
-                <EuiLink target="_blank" href={docLinksScriptedFields.scriptFields}>
+                <EuiLink target="_blank" href={docLinks.scriptedFields.scriptFields}>
                   <FormattedMessage
                     id="indexPatternManagement.warningCallOutLabel.scripFieldsLink"
-                    defaultMessage="script fields"
+                    defaultMessage="scripted fields"
                   />
-                  &nbsp;
-                  <EuiIcon type="link" />
                 </EuiLink>
               ),
               scriptsInAggregation: (
-                <EuiLink target="_blank" href={docLinksScriptedFields.scriptAggs}>
+                <EuiLink target="_blank" href={docLinks.scriptedFields.scriptAggs}>
                   <FormattedMessage
                     id="indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink"
                     defaultMessage="scripts in aggregations"
                   />
-                  &nbsp;
-                  <EuiIcon type="link" />
                 </EuiLink>
               ),
             }}
           />
         </p>
-        <p>
+      </EuiText>
+      <EuiSpacer size="m" />
+      <EuiCallOut
+        color="warning"
+        iconType="alert"
+        title={
           <FormattedMessage
-            id="indexPatternManagement.warningCallOut.descriptionLabel"
-            defaultMessage="Scripted fields can be used to display and aggregate calculated values. As such, they can be very slow, and
-            if done incorrectly, can cause Kibana to be unusable. There's no safety net here. If you make a typo, unexpected exceptions
-            will be thrown all over the place!"
+            id="indexPatternManagement.scriptedFieldsDeprecatedTitle"
+            defaultMessage="Scripted fields are deprecated."
+            description="Deprecation warning title within scripted field editor"
           />
-        </p>
+        }
+      >
+        <EuiText size="s">
+          <p>
+            <FormattedMessage
+              id="indexPatternManagement.scriptedFieldsDeprecatedBody"
+              defaultMessage="For greater flexibility and Painless script support, {runtimeDocs}."
+              values={{
+                runtimeDocs: (
+                  <EuiLink target="_blank" href={docLinks.runtimeFields.overview}>
+                    <FormattedMessage
+                      id="indexPatternManagement.warningCallOutLabel.runtimeLink"
+                      defaultMessage="use runtime fields"
+                    />
+                  </EuiLink>
+                ),
+              }}
+            />
+          </p>
+        </EuiText>
       </EuiCallOut>
       <EuiSpacer size="m" />
     </Fragment>
diff --git a/src/plugins/index_pattern_management/public/mocks.ts b/src/plugins/index_pattern_management/public/mocks.ts
index 606f9edafbca97..3462131e50463b 100644
--- a/src/plugins/index_pattern_management/public/mocks.ts
+++ b/src/plugins/index_pattern_management/public/mocks.ts
@@ -69,6 +69,7 @@ const docLinks = {
   links: {
     indexPatterns: {},
     scriptedFields: {},
+    runtimeFields: {},
   } as any,
 };
 
diff --git a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss b/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss
index f290b3c7c5f892..8a4545672de3c0 100644
--- a/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss
+++ b/src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss
@@ -2,8 +2,13 @@
   line-height: $euiButtonHeight; // Keeps alignment of text and chart icon
   background-color: $euiColorEmptyShade;
 
+  // todo: once issue https://github.com/elastic/eui/issues/4730 is merged, this code might be safe to remove
   // Some toolbar buttons are just icons, but EuiButton comes with margin and min-width that need to be removed
   min-width: 0;
+  @include kbnThemeStyle('v8') {
+    border-width: $euiBorderWidthThin;
+    border-style: solid;
+  }
 
   &[class*='--text'] {
     // Lighten the border color for all states
diff --git a/src/plugins/kibana_usage_collection/server/collectors/application_usage/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/application_usage/schema.ts
index 693e9132fe5364..e033da875080f4 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/application_usage/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/application_usage/schema.ts
@@ -148,6 +148,7 @@ export const applicationUsageSchema = {
   ml: commonSchema,
   monitoring: commonSchema,
   'observability-overview': commonSchema,
+  osquery: commonSchema,
   security_account: commonSchema,
   security_access_agreement: commonSchema,
   security_capture_url: commonSchema, // It's a forward app so we'll likely never report it
diff --git a/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts b/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts
index 5192e2300e3df0..3f39b5563ebc00 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/core/core_usage_collector.ts
@@ -238,6 +238,38 @@ export function getCoreUsageCollector(
               },
             },
           },
+          securityResponseHeaders: {
+            strictTransportSecurity: {
+              type: 'keyword',
+              _meta: {
+                description: 'The strictTransportSecurity response header, "NULL" if disabled.',
+              },
+            },
+            xContentTypeOptions: {
+              type: 'keyword',
+              _meta: {
+                description: 'The xContentTypeOptions response header, "NULL" if disabled.',
+              },
+            },
+            referrerPolicy: {
+              type: 'keyword',
+              _meta: { description: 'The referrerPolicy response header, "NULL" if disabled.' },
+            },
+            permissionsPolicyConfigured: {
+              type: 'boolean',
+              _meta: {
+                description:
+                  'Indicates if the permissionsPolicy response header has been configured.',
+              },
+            },
+            disableEmbedding: {
+              type: 'boolean',
+              _meta: {
+                description:
+                  'Indicates if security headers to disable embedding have been configured.',
+              },
+            },
+          },
         },
 
         logging: {
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
index 142bcef521c15f..dfe31b1da36436 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
@@ -432,10 +432,6 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'text',
     _meta: { description: 'Non-default value of setting.' },
   },
-  'observability:enableAlertingExperience': {
-    type: 'boolean',
-    _meta: { description: 'Non-default value of setting.' },
-  },
   'labs:presentation:unifiedToolbar': {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
index b457adecc1a79a..b8bc06d8a6a297 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
@@ -32,7 +32,6 @@ export interface UsageStats {
   'securitySolution:rulesTableRefresh': string;
   'apm:enableSignificantTerms': boolean;
   'apm:enableServiceOverview': boolean;
-  'observability:enableAlertingExperience': boolean;
   'observability:enableInspectEsQueries': boolean;
   'visualize:enableLabs': boolean;
   'visualization:heatmap:maxBuckets': number;
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss b/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss
index 79c3d4cca7ace1..b8022201acf596 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/button.scss
@@ -1,4 +1,3 @@
-
 .solutionToolbarButton {
   line-height: $euiButtonHeight; // Keeps alignment of text and chart icon
   background-color: $euiColorEmptyShade;
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/button.tsx b/src/plugins/presentation_util/public/components/solution_toolbar/items/button.tsx
index 5de8e24ef5f0de..ee1bbd64b5f871 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/button.tsx
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/button.tsx
@@ -12,17 +12,19 @@ import { EuiButtonPropsForButton } from '@elastic/eui/src/components/button/butt
 
 import './button.scss';
 
-export interface Props extends Pick<EuiButtonPropsForButton, 'onClick' | 'iconType'> {
+export interface Props
+  extends Pick<EuiButtonPropsForButton, 'onClick' | 'iconType' | 'iconSide' | 'className'> {
   label: string;
   primary?: boolean;
+  isDarkModeEnabled?: boolean;
 }
 
-export const SolutionToolbarButton = ({ label, primary, ...rest }: Props) => (
+export const SolutionToolbarButton = ({ label, primary, className, ...rest }: Props) => (
   <EuiButton
     {...rest}
-    size="s"
+    size="m"
     color={primary ? 'primary' : 'text'}
-    className="solutionToolbarButton"
+    className={`solutionToolbarButton ${className}`}
     fill={primary}
   >
     {label}
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/popover.tsx b/src/plugins/presentation_util/public/components/solution_toolbar/items/popover.tsx
index fbb34e165190d5..33850005b498be 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/popover.tsx
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/popover.tsx
@@ -20,14 +20,20 @@ type AllowedPopoverProps = Omit<
 
 export type Props = AllowedButtonProps & AllowedPopoverProps;
 
-export const SolutionToolbarPopover = ({ label, iconType, primary, ...popover }: Props) => {
+export const SolutionToolbarPopover = ({
+  label,
+  iconType,
+  primary,
+  iconSide,
+  ...popover
+}: Props) => {
   const [isOpen, setIsOpen] = useState(false);
 
   const onButtonClick = () => setIsOpen((status) => !status);
   const closePopover = () => setIsOpen(false);
 
   const button = (
-    <SolutionToolbarButton {...{ label, iconType, primary }} onClick={onButtonClick} />
+    <SolutionToolbarButton {...{ label, iconType, primary, iconSide }} onClick={onButtonClick} />
   );
 
   return (
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.scss b/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.scss
new file mode 100644
index 00000000000000..c3d89f430d70c4
--- /dev/null
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.scss
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+// Temporary fix for lensApp icon not support ghost color
+.solutionToolbar__primaryButton--dark {
+  .euiIcon path {
+    fill: $euiColorInk;
+  }
+}
+
+.solutionToolbar__primaryButton--light {
+  .euiIcon path {
+    fill: $euiColorGhost;
+  }
+}
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.tsx b/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.tsx
index e2ef75e45a4049..dcf16228ac63b7 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.tsx
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/primary_button.tsx
@@ -10,6 +10,20 @@ import React from 'react';
 
 import { SolutionToolbarButton, Props as SolutionToolbarButtonProps } from './button';
 
-export const PrimaryActionButton = (props: Omit<SolutionToolbarButtonProps, 'primary'>) => (
-  <SolutionToolbarButton primary={true} {...props} />
+import './primary_button.scss';
+
+export interface Props extends Omit<SolutionToolbarButtonProps, 'primary'> {
+  isDarkModeEnabled?: boolean;
+}
+
+export const PrimaryActionButton = ({ isDarkModeEnabled, ...props }: Props) => (
+  <SolutionToolbarButton
+    primary={true}
+    className={`solutionToolbar__primaryButton ${
+      isDarkModeEnabled
+        ? 'solutionToolbar__primaryButton--dark'
+        : 'solutionToolbar__primaryButton--light'
+    }`}
+    {...props}
+  />
 );
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss b/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss
index 639ff5bf2a117a..870a9a945ed5d3 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.scss
@@ -2,4 +2,17 @@
   .quickButtonGroup__button {
     background-color: $euiColorEmptyShade;
   }
+
+  // Temporary fix for two tone icons to make them monochrome
+  .quickButtonGroup__button--dark {
+    .euiIcon path {
+      fill: $euiColorGhost;
+    }
+  }
+  // Temporary fix for two tone icons to make them monochrome
+  .quickButtonGroup__button--light {
+    .euiIcon path {
+      fill: $euiColorInk;
+    }
+  }
 }
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.tsx b/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.tsx
index 58f8bd803b636a..eb0a395548cd90 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.tsx
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/quick_group.tsx
@@ -17,23 +17,27 @@ import './quick_group.scss';
 export interface QuickButtonProps extends Pick<EuiButtonGroupOptionProps, 'iconType'> {
   createType: string;
   onClick: () => void;
+  isDarkModeEnabled?: boolean;
 }
 
 export interface Props {
   buttons: QuickButtonProps[];
 }
 
-type Option = EuiButtonGroupOptionProps & Omit<QuickButtonProps, 'createType'>;
+type Option = EuiButtonGroupOptionProps &
+  Omit<QuickButtonProps, 'createType' | 'isDarkModeEnabled'>;
 
 export const QuickButtonGroup = ({ buttons }: Props) => {
   const buttonGroupOptions: Option[] = buttons.map((button: QuickButtonProps, index) => {
-    const { createType: label, ...rest } = button;
+    const { createType: label, isDarkModeEnabled, ...rest } = button;
     const title = strings.getAriaButtonLabel(label);
 
     return {
       ...rest,
       'aria-label': title,
-      className: 'quickButtonGroup__button',
+      className: `quickButtonGroup__button ${
+        isDarkModeEnabled ? 'quickButtonGroup__button--dark' : 'quickButtonGroup__button--light'
+      }`,
       id: `${htmlIdGenerator()()}${index}`,
       label,
       title,
@@ -46,7 +50,7 @@ export const QuickButtonGroup = ({ buttons }: Props) => {
 
   return (
     <EuiButtonGroup
-      buttonSize="s"
+      buttonSize="m"
       className="quickButtonGroup"
       legend={strings.getLegend()}
       options={buttonGroupOptions}
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.scss b/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.scss
index 18160acf191e44..5b180c7097e4f7 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.scss
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.scss
@@ -1,4 +1,17 @@
 .solutionToolbar {
-  padding: 0 $euiSizeS $euiSizeS;
+  padding: $euiSize $euiSizeS;
   flex-grow: 0;
+
+  // Temporary fix for two tone icons to make them monochrome
+  .solutionToolbar--dark {
+    .euiIcon path {
+      fill: $euiColorInk;
+    }
+  }
+
+  .solutionToolbar--light {
+    .euiIcon path {
+      fill: $euiColorGhost;
+    }
+  }
 }
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.tsx b/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.tsx
index bb8b04e8b8f09c..15edd85d6754ab 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.tsx
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/solution_toolbar.tsx
@@ -28,10 +28,11 @@ interface NamedSlots {
 }
 
 export interface Props {
+  isDarkModeEnabled?: boolean;
   children: NamedSlots;
 }
 
-export const SolutionToolbar = ({ children }: Props) => {
+export const SolutionToolbar = ({ isDarkModeEnabled, children }: Props) => {
   const {
     primaryActionButton,
     quickButtonGroup,
@@ -49,8 +50,10 @@ export const SolutionToolbar = ({ children }: Props) => {
 
   return (
     <EuiFlexGroup
-      className="solutionToolbar"
-      id="kbnPresentationToolbar__solutionToolbar"
+      className={`solutionToolbar ${
+        isDarkModeEnabled ? 'solutionToolbar--dark' : 'solutionToolbar--light'
+      }`}
+      id={`kbnPresentationToolbar__solutionToolbar`}
       gutterSize="s"
     >
       <EuiFlexItem grow={false}>{primaryActionButton}</EuiFlexItem>
diff --git a/src/plugins/presentation_util/public/index.ts b/src/plugins/presentation_util/public/index.ts
index 9c5f65de409555..fd3ae894192977 100644
--- a/src/plugins/presentation_util/public/index.ts
+++ b/src/plugins/presentation_util/public/index.ts
@@ -19,6 +19,7 @@ export {
   LazySavedObjectSaveModalDashboard,
   withSuspense,
 } from './components';
+
 export {
   AddFromLibraryButton,
   PrimaryActionButton,
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
index 2659fffa0bd9d3..dc653062931c2d 100644
--- a/src/plugins/telemetry/schema/oss_plugins.json
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -3954,6 +3954,137 @@
             }
           }
         },
+        "osquery": {
+          "properties": {
+            "appId": {
+              "type": "keyword",
+              "_meta": {
+                "description": "The application being tracked"
+              }
+            },
+            "viewId": {
+              "type": "keyword",
+              "_meta": {
+                "description": "Always `main`"
+              }
+            },
+            "clicks_total": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application since we started counting them"
+              }
+            },
+            "clicks_7_days": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application over the last 7 days"
+              }
+            },
+            "clicks_30_days": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application over the last 30 days"
+              }
+            },
+            "clicks_90_days": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application over the last 90 days"
+              }
+            },
+            "minutes_on_screen_total": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen since we started counting them."
+              }
+            },
+            "minutes_on_screen_7_days": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen over the last 7 days"
+              }
+            },
+            "minutes_on_screen_30_days": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen over the last 30 days"
+              }
+            },
+            "minutes_on_screen_90_days": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen over the last 90 days"
+              }
+            },
+            "views": {
+              "type": "array",
+              "items": {
+                "properties": {
+                  "appId": {
+                    "type": "keyword",
+                    "_meta": {
+                      "description": "The application being tracked"
+                    }
+                  },
+                  "viewId": {
+                    "type": "keyword",
+                    "_meta": {
+                      "description": "The application view being tracked"
+                    }
+                  },
+                  "clicks_total": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the application sub view since we started counting them"
+                    }
+                  },
+                  "clicks_7_days": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the active application sub view over the last 7 days"
+                    }
+                  },
+                  "clicks_30_days": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the active application sub view over the last 30 days"
+                    }
+                  },
+                  "clicks_90_days": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the active application sub view over the last 90 days"
+                    }
+                  },
+                  "minutes_on_screen_total": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application sub view is active and on-screen since we started counting them."
+                    }
+                  },
+                  "minutes_on_screen_7_days": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application is active and on-screen active application sub view over the last 7 days"
+                    }
+                  },
+                  "minutes_on_screen_30_days": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application is active and on-screen active application sub view over the last 30 days"
+                    }
+                  },
+                  "minutes_on_screen_90_days": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application is active and on-screen active application sub view over the last 90 days"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },        
         "security_account": {
           "properties": {
             "appId": {
@@ -6742,6 +6873,40 @@
                       }
                     }
                   }
+                },
+                "securityResponseHeaders": {
+                  "properties": {
+                    "strictTransportSecurity": {
+                      "type": "keyword",
+                      "_meta": {
+                        "description": "The strictTransportSecurity response header, \"NULL\" if disabled."
+                      }
+                    },
+                    "xContentTypeOptions": {
+                      "type": "keyword",
+                      "_meta": {
+                        "description": "The xContentTypeOptions response header, \"NULL\" if disabled."
+                      }
+                    },
+                    "referrerPolicy": {
+                      "type": "keyword",
+                      "_meta": {
+                        "description": "The referrerPolicy response header, \"NULL\" if disabled."
+                      }
+                    },
+                    "permissionsPolicyConfigured": {
+                      "type": "boolean",
+                      "_meta": {
+                        "description": "Indicates if the permissionsPolicy response header has been configured."
+                      }
+                    },
+                    "disableEmbedding": {
+                      "type": "boolean",
+                      "_meta": {
+                        "description": "Indicates if security headers to disable embedding have been configured."
+                      }
+                    }
+                  }
                 }
               }
             },
@@ -8166,12 +8331,6 @@
             "description": "Non-default value of setting."
           }
         },
-        "observability:enableAlertingExperience": {
-          "type": "boolean",
-          "_meta": {
-            "description": "Non-default value of setting."
-          }
-        },
         "labs:presentation:unifiedToolbar": {
           "type": "boolean",
           "_meta": {
diff --git a/src/plugins/ui_actions/public/public.api.md b/src/plugins/ui_actions/public/public.api.md
index 44d911d336b194..f8c473a3e2c0a0 100644
--- a/src/plugins/ui_actions/public/public.api.md
+++ b/src/plugins/ui_actions/public/public.api.md
@@ -138,7 +138,7 @@ export interface UiActionsActionDefinition<Context extends object = object> exte
 // @public
 export interface UiActionsPresentable<Context = unknown> {
     getDisplayName(context: Context): string;
-    getDisplayNameTooltip(context: Context): string;
+    getDisplayNameTooltip?(context: Context): string;
     getHref?(context: Context): Promise<string | undefined>;
     getIconType(context: Context): string | undefined;
     readonly grouping?: UiActionsPresentableGrouping<Context>;
diff --git a/src/plugins/ui_actions/public/util/presentable.ts b/src/plugins/ui_actions/public/util/presentable.ts
index 319a271ceb726b..9e690b9ef3c08a 100644
--- a/src/plugins/ui_actions/public/util/presentable.ts
+++ b/src/plugins/ui_actions/public/util/presentable.ts
@@ -43,7 +43,7 @@ export interface Presentable<Context = unknown> {
    * Returns tooltip text which should be displayed when user hovers this object.
    * Should return empty string if tooltip should not be displayed.
    */
-  getDisplayNameTooltip(context: Context): string;
+  getDisplayNameTooltip?(context: Context): string;
 
   /**
    * This method should return a link if this item can be clicked on. The link
diff --git a/src/plugins/vis_type_table/public/components/table_visualization.scss b/src/plugins/vis_type_table/public/components/table_visualization.scss
index 28dbf17b18739a..21c235adf6db2c 100644
--- a/src/plugins/vis_type_table/public/components/table_visualization.scss
+++ b/src/plugins/vis_type_table/public/components/table_visualization.scss
@@ -12,6 +12,15 @@
   overflow: auto;
 
   @include euiScrollBar;
+
+  // Sticky footer doesn't correct work with inline-flex in Firefox.
+  // As footer the last element I don't see any reason to use inline-flex for this element.
+  // Display: flex fixes jumping on hover in Firefox.
+  // Created issue on EUI (https://github.com/elastic/eui/issues/4729).
+  // Once addressed, we can remove this local fix.
+  .euiDataGrid--stickyFooter .euiDataGridFooter {
+    display: flex;
+  }
 }
 
 .tbvChart__split {
diff --git a/src/plugins/vis_type_timelion/common/types.ts b/src/plugins/vis_type_timelion/common/types.ts
index f3f2a74a711a91..8ce4bd8b45f0d7 100644
--- a/src/plugins/vis_type_timelion/common/types.ts
+++ b/src/plugins/vis_type_timelion/common/types.ts
@@ -16,6 +16,7 @@ export interface TimelionFunctionArgsSuggestion {
 export interface TimelionFunctionArgs {
   name: string;
   help?: string;
+  insertText?: string;
   multi?: boolean;
   types: TimelionFunctionArgsTypes[];
   suggestions?: TimelionFunctionArgsSuggestion[];
diff --git a/src/plugins/vis_type_timelion/public/components/timelion_expression_input_helpers.ts b/src/plugins/vis_type_timelion/public/components/timelion_expression_input_helpers.ts
index 7c24eaa5902b47..6c3cd8058627af 100644
--- a/src/plugins/vis_type_timelion/public/components/timelion_expression_input_helpers.ts
+++ b/src/plugins/vis_type_timelion/public/components/timelion_expression_input_helpers.ts
@@ -244,10 +244,9 @@ export function getSuggestion(
 
       break;
     case SUGGESTION_TYPE.ARGUMENT_VALUE:
-      const param = suggestion.name.split(':');
-
-      if (param.length === 1 || param[1]) {
-        insertText = `${param.length === 1 ? insertText : param[1]},`;
+      const defaultText = (suggestion as TimelionFunctionArgs).insertText;
+      if (defaultText) {
+        insertText = `${defaultText},`;
       }
 
       command = {
diff --git a/src/plugins/vis_type_timelion/public/helpers/arg_value_suggestions.ts b/src/plugins/vis_type_timelion/public/helpers/arg_value_suggestions.ts
index 0a989858706dfa..d8ec46eba004fb 100644
--- a/src/plugins/vis_type_timelion/public/helpers/arg_value_suggestions.ts
+++ b/src/plugins/vis_type_timelion/public/helpers/arg_value_suggestions.ts
@@ -51,6 +51,7 @@ export function getArgValueSuggestions() {
 
         return (await indexPatterns.find(search, size)).map(({ title }) => ({
           name: title,
+          insertText: title,
         }));
       },
       async metric(partial: string, functionArgs: TimelionExpressionFunction[]) {
@@ -81,7 +82,14 @@ export function getArgValueSuggestions() {
               containsFieldName(valueSplit[1], field) &&
               !indexPatternsUtils.isNestedField(field)
           )
-          .map((field) => ({ name: `${valueSplit[0]}:${field.name}`, help: field.type }));
+          .map((field) => {
+            const suggestionValue = field.name.replaceAll(':', '\\:');
+            return {
+              name: `${valueSplit[0]}:${suggestionValue}`,
+              help: field.type,
+              insertText: suggestionValue,
+            };
+          });
       },
       async split(partial: string, functionArgs: TimelionExpressionFunction[]) {
         const indexPattern = await getIndexPattern(functionArgs);
@@ -105,7 +113,7 @@ export function getArgValueSuggestions() {
               containsFieldName(partial, field) &&
               !indexPatternsUtils.isNestedField(field)
           )
-          .map((field) => ({ name: field.name, help: field.type }));
+          .map((field) => ({ name: field.name, help: field.type, insertText: field.name }));
       },
       async timefield(partial: string, functionArgs: TimelionExpressionFunction[]) {
         const indexPattern = await getIndexPattern(functionArgs);
@@ -121,7 +129,7 @@ export function getArgValueSuggestions() {
               containsFieldName(partial, field) &&
               !indexPatternsUtils.isNestedField(field)
           )
-          .map((field) => ({ name: field.name }));
+          .map((field) => ({ name: field.name, insertText: field.name }));
       },
     },
   };
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js b/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
index 566001ce441824..3ace7456046600 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
@@ -123,13 +123,35 @@ describe('es', () => {
       const emptyScriptedFields = [];
 
       test('adds a metric agg for each metric', () => {
-        config.metric = ['sum:beer', 'avg:bytes', 'percentiles:bytes'];
+        config.metric = [
+          'sum:beer',
+          'avg:bytes',
+          'percentiles:bytes',
+          'cardinality:\\:sample',
+          'sum:\\:beer',
+          'percentiles:\\:\\:bytes:1.2,1.3,2.7',
+          'percentiles:\\:bytes\\:123:20.0,50.0,100.0',
+          'percentiles:a:2',
+        ];
         agg = createDateAgg(config, tlConfig, emptyScriptedFields);
         expect(agg.time_buckets.aggs['sum(beer)']).toEqual({ sum: { field: 'beer' } });
         expect(agg.time_buckets.aggs['avg(bytes)']).toEqual({ avg: { field: 'bytes' } });
         expect(agg.time_buckets.aggs['percentiles(bytes)']).toEqual({
           percentiles: { field: 'bytes' },
         });
+        expect(agg.time_buckets.aggs['cardinality(:sample)']).toEqual({
+          cardinality: { field: ':sample' },
+        });
+        expect(agg.time_buckets.aggs['sum(:beer)']).toEqual({ sum: { field: ':beer' } });
+        expect(agg.time_buckets.aggs['percentiles(::bytes)']).toEqual({
+          percentiles: { field: '::bytes', percents: [1.2, 1.3, 2.7] },
+        });
+        expect(agg.time_buckets.aggs['percentiles(:bytes:123)']).toEqual({
+          percentiles: { field: ':bytes:123', percents: [20.0, 50.0, 100.0] },
+        });
+        expect(agg.time_buckets.aggs['percentiles(a)']).toEqual({
+          percentiles: { field: 'a', percents: [2] },
+        });
       });
 
       test('adds a scripted metric agg for each scripted metric', () => {
@@ -158,6 +180,13 @@ describe('es', () => {
         expect(typeof agg.time_buckets.aggs.count.bucket_script).toBe('object');
         expect(agg.time_buckets.aggs.count.bucket_script.buckets_path).toEqual('_count');
       });
+
+      test('has a special `count` metric with redundant field which use a script', () => {
+        config.metric = ['count:beer'];
+        agg = createDateAgg(config, tlConfig, emptyScriptedFields);
+        expect(typeof agg.time_buckets.aggs.count.bucket_script).toBe('object');
+        expect(agg.time_buckets.aggs.count.bucket_script.buckets_path).toEqual('_count');
+      });
     });
   });
 
@@ -305,10 +334,10 @@ describe('es', () => {
 
     describe('config.split', () => {
       test('adds terms aggs, in order, under the filters agg', () => {
-        config.split = ['beer:5', 'wine:10'];
+        config.split = ['beer:5', 'wine:10', ':lemo:nade::15', ':jui:ce:723::45'];
         const request = fn(config, tlConfig, emptyScriptedFields);
 
-        const aggs = request.params.body.aggs.q.aggs;
+        let aggs = request.params.body.aggs.q.aggs;
 
         expect(aggs.beer.meta.type).toEqual('split');
         expect(aggs.beer.terms.field).toEqual('beer');
@@ -317,6 +346,18 @@ describe('es', () => {
         expect(aggs.beer.aggs.wine.meta.type).toEqual('split');
         expect(aggs.beer.aggs.wine.terms.field).toEqual('wine');
         expect(aggs.beer.aggs.wine.terms.size).toEqual(10);
+
+        aggs = aggs.beer.aggs.wine.aggs;
+        expect(aggs).toHaveProperty(':lemo:nade:');
+        expect(aggs[':lemo:nade:'].meta.type).toEqual('split');
+        expect(aggs[':lemo:nade:'].terms.field).toEqual(':lemo:nade:');
+        expect(aggs[':lemo:nade:'].terms.size).toEqual(15);
+
+        aggs = aggs[':lemo:nade:'].aggs;
+        expect(aggs).toHaveProperty(':jui:ce:723:');
+        expect(aggs[':jui:ce:723:'].meta.type).toEqual('split');
+        expect(aggs[':jui:ce:723:'].terms.field).toEqual(':jui:ce:723:');
+        expect(aggs[':jui:ce:723:'].terms.size).toEqual(45);
       });
 
       test('adds scripted terms aggs, in order, under the filters agg', () => {
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js b/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js
index a4aa4f73547e4e..a30b197e460671 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js
@@ -48,17 +48,17 @@ export default function buildRequest(config, tlConfig, scriptedFields, timeout)
 
   let aggCursor = aggs.q.aggs;
 
-  _.each(config.split, function (clause) {
-    clause = clause.split(':');
-    if (clause[0] && clause[1]) {
-      const termsAgg = buildAggBody(clause[0], scriptedFields);
-      termsAgg.size = parseInt(clause[1], 10);
-      aggCursor[clause[0]] = {
+  (config.split || []).forEach((clause) => {
+    const [field, arg] = clause.split(/:(\d+$)/);
+    if (field && arg) {
+      const termsAgg = buildAggBody(field, scriptedFields);
+      termsAgg.size = parseInt(arg, 10);
+      aggCursor[field] = {
         meta: { type: 'split' },
         terms: termsAgg,
         aggs: {},
       };
-      aggCursor = aggCursor[clause[0]].aggs;
+      aggCursor = aggCursor[field].aggs;
     } else {
       throw new Error('`split` requires field:limit');
     }
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js b/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js
index 09ae4d8ef3467f..55538fbff4e79a 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js
@@ -6,9 +6,9 @@
  * Side Public License, v 1.
  */
 
-import _ from 'lodash';
 import { buildAggBody } from './agg_body';
-import { search } from '../../../../../../plugins/data/server';
+import { search, METRIC_TYPES } from '../../../../../data/server';
+
 const { dateHistogramInterval } = search.aggs;
 
 export default function createDateAgg(config, tlConfig, scriptedFields) {
@@ -29,29 +29,39 @@ export default function createDateAgg(config, tlConfig, scriptedFields) {
   };
 
   dateAgg.time_buckets.aggs = {};
-  _.each(config.metric, function (metric) {
-    metric = metric.split(':');
-    if (metric[0] === 'count') {
+  (config.metric || []).forEach((metric) => {
+    const metricBody = {};
+    const [metricName, metricArgs] = metric.split(/:(.+)/);
+    if (metricName === METRIC_TYPES.COUNT) {
       // This is pretty lame, but its how the "doc_count" metric has to be implemented at the moment
       // It simplifies the aggregation tree walking code considerably
-      dateAgg.time_buckets.aggs[metric] = {
+      metricBody[metricName] = {
         bucket_script: {
           buckets_path: '_count',
           script: { source: '_value', lang: 'expression' },
         },
       };
-    } else if (metric[0] && metric[1]) {
-      const metricName = metric[0] + '(' + metric[1] + ')';
-      dateAgg.time_buckets.aggs[metricName] = {};
-      dateAgg.time_buckets.aggs[metricName][metric[0]] = buildAggBody(metric[1], scriptedFields);
-      if (metric[0] === 'percentiles' && metric[2]) {
-        let percentList = metric[2].split(',');
+    } else if (metricName && metricArgs) {
+      const splittedArgs = metricArgs.split(/(.*[^\\]):/).filter(Boolean);
+      const field = splittedArgs[0].replace(/\\:/g, ':');
+      const percentArgs = splittedArgs[1];
+      const metricKey = metricName + '(' + field + ')';
+
+      metricBody[metricKey] = { [metricName]: buildAggBody(field, scriptedFields) };
+
+      if (metricName === METRIC_TYPES.PERCENTILES && percentArgs) {
+        let percentList = percentArgs.split(',');
         percentList = percentList.map((x) => parseFloat(x));
-        dateAgg.time_buckets.aggs[metricName][metric[0]].percents = percentList;
+        metricBody[metricKey][metricName].percents = percentList;
       }
     } else {
       throw new Error('`metric` requires metric:field or simply count');
     }
+
+    dateAgg.time_buckets.aggs = {
+      ...dateAgg.time_buckets.aggs,
+      ...metricBody,
+    };
   });
 
   return dateAgg;
diff --git a/src/plugins/vis_type_timeseries/public/application/components/index_pattern.js b/src/plugins/vis_type_timeseries/public/application/components/index_pattern.js
index e7a34c6e6596de..c5b3d86f61b5d4 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/index_pattern.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/index_pattern.js
@@ -18,7 +18,6 @@ import {
   EuiComboBox,
   EuiRange,
   EuiIconTip,
-  EuiText,
   EuiFormLabel,
 } from '@elastic/eui';
 import { FieldSelect } from './aggs/field_select';
@@ -126,6 +125,9 @@ export const IndexPattern = ({
     ({ value }) => model[TIME_RANGE_MODE_KEY] === value
   );
   const isTimeSeries = model.type === PANEL_TYPES.TIMESERIES;
+  const isDataTimerangeModeInvalid =
+    selectedTimeRangeOption &&
+    !isTimerangeModeEnabled(selectedTimeRangeOption.value, uiRestrictions);
 
   useEffect(() => {
     updateControlValidity(intervalName, intervalValidation.isValid);
@@ -143,13 +145,38 @@ export const IndexPattern = ({
           <EuiFlexItem>
             <EuiFormRow
               id={htmlId('timeRange')}
-              label={i18n.translate('visTypeTimeseries.indexPattern.timeRange.label', {
-                defaultMessage: 'Data timerange mode',
+              label={
+                <>
+                  <FormattedMessage
+                    id="visTypeTimeseries.indexPattern.timeRange.label"
+                    defaultMessage="Data timerange mode"
+                  />{' '}
+                  <EuiIconTip
+                    position="right"
+                    content={
+                      <FormattedMessage
+                        id="visTypeTimeseries.indexPattern.timeRange.hint"
+                        defaultMessage='This setting controls the timespan used for matching documents.
+                        "Entire timerange" will match all the documents selected in the timepicker.
+                        "Last value" will match only the documents for the specified interval from the end of the timerange.'
+                      />
+                    }
+                    type="questionInCircle"
+                  />
+                </>
+              }
+              isInvalid={isDataTimerangeModeInvalid}
+              error={i18n.translate('visTypeTimeseries.indexPattern.timeRange.error', {
+                defaultMessage: 'You cannot use "{mode}" with the current index type.',
+                values: {
+                  mode: selectedTimeRangeOption?.label,
+                },
               })}
             >
               <EuiComboBox
                 data-test-subj="dataTimeRangeMode"
                 isClearable={false}
+                isInvalid={isDataTimerangeModeInvalid}
                 placeholder={i18n.translate(
                   'visTypeTimeseries.indexPattern.timeRange.selectTimeRange',
                   {
@@ -157,6 +184,9 @@ export const IndexPattern = ({
                   }
                 )}
                 options={timeRangeOptions}
+                error={i18n.translate('visTypeTimeseries.indexPattern.timeRange.entireTimeRange', {
+                  defaultMessage: 'Entire time range',
+                })}
                 selectedOptions={selectedTimeRangeOption ? [selectedTimeRangeOption] : []}
                 onChange={handleSelectChange(TIME_RANGE_MODE_KEY)}
                 singleSelection={{ asPlainText: true }}
@@ -171,13 +201,6 @@ export const IndexPattern = ({
                 })}
               />
             </EuiFormRow>
-            <EuiText size="xs" style={{ margin: 0 }}>
-              {i18n.translate('visTypeTimeseries.indexPattern.timeRange.hint', {
-                defaultMessage: `This setting controls the timespan used for matching documents.
-                "Entire timerange" will match all the documents selected in the timepicker.
-                "Last value" will match only the documents for the specified interval from the end of the timerange.`,
-              })}
-            </EuiText>
           </EuiFlexItem>
         </EuiFlexGroup>
       )}
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.ts b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.ts
index 6d165d3343eaac..1d910dab5a786a 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.ts
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_series_data.ts
@@ -105,5 +105,6 @@ export async function getSeriesData(
         ...handleErrorResponse(panel)(err),
       };
     }
+    return meta;
   }
 }
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.ts b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.ts
index 00d23ee45e6dac..075e90762f151a 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.ts
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/get_table_data.ts
@@ -115,5 +115,6 @@ export async function getTableData(
         ...handleErrorResponse(panel)(err),
       };
     }
+    return meta;
   }
 }
diff --git a/src/plugins/vis_type_vega/public/vega_view/vega_base_view.d.ts b/src/plugins/vis_type_vega/public/vega_view/vega_base_view.d.ts
index b0ccdbba021edc..8f5770500253fb 100644
--- a/src/plugins/vis_type_vega/public/vega_view/vega_base_view.d.ts
+++ b/src/plugins/vis_type_vega/public/vega_view/vega_base_view.d.ts
@@ -34,6 +34,7 @@ export class VegaBaseView {
   destroy(): Promise<void>;
 
   _$container: any;
+  _$controls: any;
   _parser: any;
   _vegaViewConfig: any;
   _serviceSettings: VegaViewParams['serviceSettings'];
diff --git a/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.test.ts b/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.test.ts
index da4c14c77bc98a..53337388dc1906 100644
--- a/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.test.ts
+++ b/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.test.ts
@@ -36,6 +36,7 @@ describe('vega_map_view/tms_raster_layer', () => {
       vegaView: ({
         initialize: jest.fn(),
       } as unknown) as View,
+      vegaControls: 'element',
       updateVegaView: jest.fn(),
     };
   });
diff --git a/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.ts b/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.ts
index a3efba804b4548..8972b80cb99c59 100644
--- a/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.ts
+++ b/src/plugins/vis_type_vega/public/vega_view/vega_map_view/layers/vega_layer.ts
@@ -13,12 +13,13 @@ import type { LayerParameters } from './types';
 export interface VegaLayerContext {
   vegaView: View;
   updateVegaView: (map: Map, view: View) => void;
+  vegaControls: any;
 }
 
 export function initVegaLayer({
   id,
   map: mapInstance,
-  context: { vegaView, updateVegaView },
+  context: { vegaView, vegaControls, updateVegaView },
 }: LayerParameters<VegaLayerContext>) {
   const vegaLayer: CustomLayerInterface = {
     id,
@@ -34,7 +35,7 @@ export function initVegaLayer({
       vegaContainer.style.height = mapCanvas.style.height;
 
       mapContainer.appendChild(vegaContainer);
-      vegaView.initialize(vegaContainer);
+      vegaView.initialize(vegaContainer, vegaControls);
     },
     render() {
       updateVegaView(mapInstance, vegaView);
diff --git a/src/plugins/vis_type_vega/public/vega_view/vega_map_view/view.ts b/src/plugins/vis_type_vega/public/vega_view/vega_map_view/view.ts
index b1ec79e6b8310e..61ae1ce4e5d783 100644
--- a/src/plugins/vis_type_vega/public/vega_view/vega_map_view/view.ts
+++ b/src/plugins/vis_type_vega/public/vega_view/vega_map_view/view.ts
@@ -175,6 +175,7 @@ export class VegaMapView extends VegaBaseView {
       map: mapBoxInstance,
       context: {
         vegaView,
+        vegaControls: this._$controls.get(0),
         updateVegaView,
       },
     });
diff --git a/src/plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx b/src/plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx
index 2b5a611cd946e8..48bff8d203ebd7 100644
--- a/src/plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx
+++ b/src/plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx
@@ -113,7 +113,7 @@ export class VisualizeEmbeddableFactory
 
   public getDisplayName() {
     return i18n.translate('visualizations.displayName', {
-      defaultMessage: 'visualization',
+      defaultMessage: 'Visualization',
     });
   }
 
diff --git a/src/plugins/visualizations/public/index.ts b/src/plugins/visualizations/public/index.ts
index e5b1ba73d9d1c0..dbcbb864d2316b 100644
--- a/src/plugins/visualizations/public/index.ts
+++ b/src/plugins/visualizations/public/index.ts
@@ -25,7 +25,7 @@ export { getVisSchemas } from './vis_schemas';
 /** @public types */
 export { VisualizationsSetup, VisualizationsStart };
 export { VisGroups } from './vis_types';
-export type { VisTypeAlias, VisTypeDefinition, Schema, ISchemas } from './vis_types';
+export type { BaseVisType, VisTypeAlias, VisTypeDefinition, Schema, ISchemas } from './vis_types';
 export { SerializedVis, SerializedVisData, VisData } from './vis';
 export type VisualizeEmbeddableFactoryContract = PublicContract<VisualizeEmbeddableFactory>;
 export type VisualizeEmbeddableContract = PublicContract<VisualizeEmbeddable>;
diff --git a/src/plugins/visualizations/public/wizard/dialog_navigation.tsx b/src/plugins/visualizations/public/wizard/dialog_navigation.tsx
index 1de177e12f40da..c92514d54166fc 100644
--- a/src/plugins/visualizations/public/wizard/dialog_navigation.tsx
+++ b/src/plugins/visualizations/public/wizard/dialog_navigation.tsx
@@ -24,7 +24,7 @@ function DialogNavigation(props: DialogNavigationProps) {
           </EuiFlexItem>
           <EuiFlexItem>
             {i18n.translate('visualizations.newVisWizard.goBackLink', {
-              defaultMessage: 'Go back',
+              defaultMessage: 'Select a different visualization',
             })}
           </EuiFlexItem>
         </EuiFlexGroup>
diff --git a/src/plugins/visualizations/public/wizard/new_vis_modal.tsx b/src/plugins/visualizations/public/wizard/new_vis_modal.tsx
index d36b734f75be2e..317f9d1bb363db 100644
--- a/src/plugins/visualizations/public/wizard/new_vis_modal.tsx
+++ b/src/plugins/visualizations/public/wizard/new_vis_modal.tsx
@@ -41,6 +41,8 @@ interface TypeSelectionProps {
   outsideVisualizeApp?: boolean;
   stateTransfer?: EmbeddableStateTransfer;
   originatingApp?: string;
+  showAggsSelection?: boolean;
+  selectedVisType?: BaseVisType;
 }
 
 interface TypeSelectionState {
@@ -69,8 +71,9 @@ class NewVisModal extends React.Component<TypeSelectionProps, TypeSelectionState
     this.isLabsEnabled = props.uiSettings.get(VISUALIZE_ENABLE_LABS_SETTING);
 
     this.state = {
-      showSearchVisModal: false,
-      showGroups: true,
+      showSearchVisModal: Boolean(this.props.selectedVisType),
+      showGroups: !this.props.showAggsSelection,
+      visType: this.props.selectedVisType,
     };
 
     this.trackUiMetric = this.props.usageCollection?.reportUiCounter.bind(
diff --git a/src/plugins/visualizations/public/wizard/show_new_vis.tsx b/src/plugins/visualizations/public/wizard/show_new_vis.tsx
index e8d61cdd2cc070..76fabdedae48d1 100644
--- a/src/plugins/visualizations/public/wizard/show_new_vis.tsx
+++ b/src/plugins/visualizations/public/wizard/show_new_vis.tsx
@@ -20,6 +20,7 @@ import {
   getEmbeddable,
   getDocLinks,
 } from '../services';
+import type { BaseVisType } from '../vis_types';
 
 const NewVisModal = lazy(() => import('./new_vis_modal'));
 
@@ -29,6 +30,8 @@ export interface ShowNewVisModalParams {
   originatingApp?: string;
   outsideVisualizeApp?: boolean;
   createByValue?: boolean;
+  showAggsSelection?: boolean;
+  selectedVisType?: BaseVisType;
 }
 
 /**
@@ -41,6 +44,8 @@ export function showNewVisModal({
   onClose,
   originatingApp,
   outsideVisualizeApp,
+  showAggsSelection,
+  selectedVisType,
 }: ShowNewVisModalParams = {}) {
   const container = document.createElement('div');
   let isClosed = false;
@@ -78,6 +83,8 @@ export function showNewVisModal({
           usageCollection={getUsageCollector()}
           application={getApplication()}
           docLinks={getDocLinks()}
+          showAggsSelection={showAggsSelection}
+          selectedVisType={selectedVisType}
         />
       </Suspense>
     </I18nProvider>
diff --git a/test/accessibility/apps/discover.ts b/test/accessibility/apps/discover.ts
index a46a27a5bdf9c7..67abe15ea537a7 100644
--- a/test/accessibility/apps/discover.ts
+++ b/test/accessibility/apps/discover.ts
@@ -23,6 +23,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await esArchiver.loadIfNeeded('logstash_functional');
       await kibanaServer.uiSettings.update({
         defaultIndex: 'logstash-*',
+        'doc_table:legacy': true,
       });
       await PageObjects.common.navigateToApp('discover');
       await PageObjects.timePicker.setDefaultAbsoluteRange();
diff --git a/test/common/config.js b/test/common/config.js
index 46cd07b2ec3704..84848347f94cda 100644
--- a/test/common/config.js
+++ b/test/common/config.js
@@ -50,7 +50,7 @@ export default function () {
         // These are *very* important to have them pointing to staging
         '--telemetry.url=https://telemetry-staging.elastic.co/xpack/v2/send',
         '--telemetry.optInStatusUrl=https://telemetry-staging.elastic.co/opt_in_status/v2/send',
-        `--server.maxPayloadBytes=1679958`,
+        `--server.maxPayload=1679958`,
         // newsfeed mock service
         `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'newsfeed')}`,
         `--newsfeed.service.urlRoot=${servers.kibana.protocol}://${servers.kibana.hostname}:${servers.kibana.port}`,
diff --git a/test/examples/embeddables/adding_children.ts b/test/examples/embeddables/adding_children.ts
index 8b59012bf98253..ee06622a33f511 100644
--- a/test/examples/embeddables/adding_children.ts
+++ b/test/examples/embeddables/adding_children.ts
@@ -13,31 +13,12 @@ import { PluginFunctionalProviderContext } from 'test/plugin_functional/services
 export default function ({ getService }: PluginFunctionalProviderContext) {
   const testSubjects = getService('testSubjects');
   const flyout = getService('flyout');
-  const retry = getService('retry');
 
-  describe('creating and adding children', () => {
+  describe('adding children', () => {
     before(async () => {
       await testSubjects.click('embeddablePanelExample');
     });
 
-    it('Can create a new child', async () => {
-      await testSubjects.click('embeddablePanelToggleMenuIcon');
-      await testSubjects.click('embeddablePanelAction-ACTION_ADD_PANEL');
-
-      // this seem like an overkill, but clicking this button which opens context menu was flaky
-      await testSubjects.waitForEnabled('createNew');
-      await retry.waitFor('createNew popover opened', async () => {
-        await testSubjects.click('createNew');
-        return await testSubjects.exists('createNew-TODO_EMBEDDABLE');
-      });
-      await testSubjects.click('createNew-TODO_EMBEDDABLE');
-
-      await testSubjects.setValue('taskInputField', 'new task');
-      await testSubjects.click('createTodoEmbeddable');
-      const tasks = await testSubjects.getVisibleTextAll('todoEmbeddableTask');
-      expect(tasks).to.eql(['Goes out on Wednesdays!', 'new task']);
-    });
-
     it('Can add a child backed off a saved object', async () => {
       await testSubjects.click('embeddablePanelToggleMenuIcon');
       await testSubjects.click('embeddablePanelAction-ACTION_ADD_PANEL');
@@ -46,7 +27,7 @@ export default function ({ getService }: PluginFunctionalProviderContext) {
       await testSubjects.moveMouseTo('euiFlyoutCloseButton');
       await flyout.ensureClosed('dashboardAddPanel');
       const tasks = await testSubjects.getVisibleTextAll('todoEmbeddableTask');
-      expect(tasks).to.eql(['Goes out on Wednesdays!', 'new task', 'Take the garbage out']);
+      expect(tasks).to.eql(['Goes out on Wednesdays!', 'Take the garbage out']);
     });
   });
 }
diff --git a/test/examples/embeddables/dashboard.ts b/test/examples/embeddables/dashboard.ts
index 7db49d9dfbfcb1..70e5ba115c3af8 100644
--- a/test/examples/embeddables/dashboard.ts
+++ b/test/examples/embeddables/dashboard.ts
@@ -117,7 +117,7 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
     });
 
     it('saved search', async () => {
-      await dashboardExpect.savedSearchRowCount(50);
+      await dashboardExpect.savedSearchRowCount(11);
     });
   });
 
diff --git a/test/functional/apps/context/_context_navigation.js b/test/functional/apps/context/_context_navigation.js
index 56415f38f92fd5..7f72d44c50ea00 100644
--- a/test/functional/apps/context/_context_navigation.js
+++ b/test/functional/apps/context/_context_navigation.js
@@ -19,10 +19,12 @@ export default function ({ getService, getPageObjects }) {
   const browser = getService('browser');
   const docTable = getService('docTable');
   const PageObjects = getPageObjects(['common', 'context', 'discover', 'timePicker']);
+  const kibanaServer = getService('kibanaServer');
 
   describe('discover - context - back navigation', function contextSize() {
     before(async function () {
       await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
       await PageObjects.common.navigateToApp('discover');
       for (const [columnName, value] of TEST_FILTER_COLUMN_NAMES) {
         await PageObjects.discover.clickFieldListItem(columnName);
@@ -30,6 +32,10 @@ export default function ({ getService, getPageObjects }) {
       }
     });
 
+    after(async function () {
+      await kibanaServer.uiSettings.replace({});
+    });
+
     it('should go back after loading', async function () {
       await retry.waitFor('user navigating to context and returning to discover', async () => {
         // navigate to the context view
diff --git a/test/functional/apps/context/_date_nanos_custom_timestamp.js b/test/functional/apps/context/_date_nanos_custom_timestamp.js
index 8860204b058a53..b837c55d821ac1 100644
--- a/test/functional/apps/context/_date_nanos_custom_timestamp.js
+++ b/test/functional/apps/context/_date_nanos_custom_timestamp.js
@@ -27,7 +27,6 @@ export default function ({ getService, getPageObjects }) {
       await kibanaServer.uiSettings.update({
         'context:defaultSize': `${TEST_DEFAULT_CONTEXT_SIZE}`,
         'context:step': `${TEST_STEP_SIZE}`,
-        'discover:searchFieldsFromSource': true,
       });
     });
 
@@ -35,9 +34,9 @@ export default function ({ getService, getPageObjects }) {
       await PageObjects.context.navigateTo(TEST_INDEX_PATTERN, '1');
       const actualRowsText = await docTable.getRowsText();
       const expectedRowsText = [
-        'Oct 21, 2019 @ 08:30:04.828733000 -',
-        'Oct 21, 2019 @ 00:30:04.828740000 -',
-        'Oct 21, 2019 @ 00:30:04.828723000 -',
+        'Oct 21, 2019 @ 08:30:04.828733000',
+        'Oct 21, 2019 @ 00:30:04.828740000',
+        'Oct 21, 2019 @ 00:30:04.828723000',
       ];
       expect(actualRowsText).to.eql(expectedRowsText);
     });
diff --git a/test/functional/apps/context/_discover_navigation.js b/test/functional/apps/context/_discover_navigation.js
index 572ee3dedf35a0..dc5d56271c7fd7 100644
--- a/test/functional/apps/context/_discover_navigation.js
+++ b/test/functional/apps/context/_discover_navigation.js
@@ -30,10 +30,12 @@ export default function ({ getService, getPageObjects }) {
   const testSubjects = getService('testSubjects');
   const dashboardAddPanel = getService('dashboardAddPanel');
   const browser = getService('browser');
+  const kibanaServer = getService('kibanaServer');
 
   describe('context link in discover', () => {
     before(async () => {
       await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
       await PageObjects.common.navigateToApp('discover');
 
       for (const columnName of TEST_COLUMN_NAMES) {
@@ -46,7 +48,7 @@ export default function ({ getService, getPageObjects }) {
       }
     });
     after(async () => {
-      await PageObjects.timePicker.resetDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.replace({});
     });
 
     it('should open the context view with the selected document as anchor', async () => {
diff --git a/test/functional/apps/dashboard/create_and_add_embeddables.ts b/test/functional/apps/dashboard/create_and_add_embeddables.ts
index 9b8fc4785a6718..3de3b2f843f554 100644
--- a/test/functional/apps/dashboard/create_and_add_embeddables.ts
+++ b/test/functional/apps/dashboard/create_and_add_embeddables.ts
@@ -35,8 +35,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('adds new visualization via the top nav link', async () => {
         const originalPanelCount = await PageObjects.dashboard.getPanelCount();
         await PageObjects.dashboard.switchToEditMode();
-        await dashboardAddPanel.clickCreateNewLink();
-        await PageObjects.visualize.clickAggBasedVisualizations();
+        await dashboardAddPanel.clickEditorMenuButton();
+        await dashboardAddPanel.clickAggBasedVisualizations();
         await PageObjects.visualize.clickAreaChart();
         await PageObjects.visualize.clickNewSearch();
         await PageObjects.visualize.saveVisualizationExpectSuccess(
@@ -52,9 +52,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       it('adds a new visualization', async () => {
         const originalPanelCount = await PageObjects.dashboard.getPanelCount();
-        await dashboardAddPanel.ensureAddPanelIsShowing();
-        await dashboardAddPanel.clickAddNewEmbeddableLink('visualization');
-        await PageObjects.visualize.clickAggBasedVisualizations();
+        await dashboardAddPanel.clickEditorMenuButton();
+        await dashboardAddPanel.clickAggBasedVisualizations();
         await PageObjects.visualize.clickAreaChart();
         await PageObjects.visualize.clickNewSearch();
         await PageObjects.visualize.saveVisualizationExpectSuccess(
@@ -71,7 +70,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       it('adds a markdown visualization via the quick button', async () => {
         const originalPanelCount = await PageObjects.dashboard.getPanelCount();
-        await PageObjects.dashboard.clickMarkdownQuickButton();
+        await dashboardAddPanel.clickMarkdownQuickButton();
         await PageObjects.visualize.saveVisualizationExpectSuccess(
           'visualization from markdown quick button',
           { redirectToOrigin: true }
@@ -84,21 +83,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.dashboard.waitForRenderComplete();
       });
 
-      it('adds an input control visualization via the quick button', async () => {
-        const originalPanelCount = await PageObjects.dashboard.getPanelCount();
-        await PageObjects.dashboard.clickInputControlsQuickButton();
-        await PageObjects.visualize.saveVisualizationExpectSuccess(
-          'visualization from input control quick button',
-          { redirectToOrigin: true }
-        );
-
-        await retry.try(async () => {
-          const panelCount = await PageObjects.dashboard.getPanelCount();
-          expect(panelCount).to.eql(originalPanelCount + 1);
-        });
-        await PageObjects.dashboard.waitForRenderComplete();
-      });
-
       it('saves the listing page instead of the visualization to the app link', async () => {
         await PageObjects.header.clickVisualize(true);
         const currentUrl = await browser.getCurrentUrl();
diff --git a/test/functional/apps/dashboard/dashboard_filter_bar.ts b/test/functional/apps/dashboard/dashboard_filter_bar.ts
index cb2b4a1792a478..ad7e4be9b19352 100644
--- a/test/functional/apps/dashboard/dashboard_filter_bar.ts
+++ b/test/functional/apps/dashboard/dashboard_filter_bar.ts
@@ -11,6 +11,7 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const dataGrid = getService('dataGrid');
   const dashboardExpect = getService('dashboardExpect');
   const dashboardAddPanel = getService('dashboardAddPanel');
   const testSubjects = getService('testSubjects');
@@ -173,8 +174,13 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('are added when a cell magnifying glass is clicked', async function () {
         await dashboardAddPanel.addSavedSearch('Rendering-Test:-saved-search');
         await PageObjects.dashboard.waitForRenderComplete();
-        await testSubjects.click('docTableCellFilter');
-
+        const documentCell = await dataGrid.getCellElement(1, 3);
+        await documentCell.click();
+        const expandCellContentButton = await documentCell.findByClassName(
+          'euiDataGridRowCell__expandButtonIcon'
+        );
+        await expandCellContentButton.click();
+        await testSubjects.click('filterForButton');
         const filterCount = await filterBar.getFilterCount();
         expect(filterCount).to.equal(1);
       });
diff --git a/test/functional/apps/dashboard/dashboard_time_picker.ts b/test/functional/apps/dashboard/dashboard_time_picker.ts
index ef033204385821..eb7c05079fb448 100644
--- a/test/functional/apps/dashboard/dashboard_time_picker.ts
+++ b/test/functional/apps/dashboard/dashboard_time_picker.ts
@@ -12,13 +12,13 @@ import { PIE_CHART_VIS_NAME } from '../../page_objects/dashboard_page';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const dashboardExpect = getService('dashboardExpect');
   const pieChart = getService('pieChart');
   const dashboardVisualizations = getService('dashboardVisualizations');
   const PageObjects = getPageObjects(['dashboard', 'header', 'visualize', 'timePicker']);
   const browser = getService('browser');
   const log = getService('log');
   const kibanaServer = getService('kibanaServer');
+  const dataGrid = getService('dataGrid');
 
   describe('dashboard time picker', function describeIndexTests() {
     before(async function () {
@@ -49,14 +49,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         name: 'saved search',
         fields: ['bytes', 'agent'],
       });
-      await dashboardExpect.docTableFieldCount(150);
+      const initialRows = await dataGrid.getDocTableRows();
+      expect(initialRows.length).to.be(11);
 
       // Set to time range with no data
       await PageObjects.timePicker.setAbsoluteRange(
         'Jan 1, 2000 @ 00:00:00.000',
         'Jan 1, 2000 @ 01:00:00.000'
       );
-      await dashboardExpect.docTableFieldCount(0);
+      const noResults = await dataGrid.hasNoResults();
+      expect(noResults).to.be.ok();
     });
 
     it('Timepicker start, end, interval values are set by url', async () => {
diff --git a/test/functional/apps/dashboard/dashboard_unsaved_listing.ts b/test/functional/apps/dashboard/dashboard_unsaved_listing.ts
index 233d2e91467fee..1cdc4bbff2c532 100644
--- a/test/functional/apps/dashboard/dashboard_unsaved_listing.ts
+++ b/test/functional/apps/dashboard/dashboard_unsaved_listing.ts
@@ -25,8 +25,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('dashboard unsaved listing', () => {
     const addSomePanels = async () => {
       // add an area chart by value
-      await dashboardAddPanel.clickCreateNewLink();
-      await PageObjects.visualize.clickAggBasedVisualizations();
+      await dashboardAddPanel.clickEditorMenuButton();
+      await dashboardAddPanel.clickAggBasedVisualizations();
       await PageObjects.visualize.clickAreaChart();
       await PageObjects.visualize.clickNewSearch();
       await PageObjects.visualize.saveVisualizationAndReturn();
@@ -132,8 +132,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.dashboard.switchToEditMode();
 
       // add another panel so we can delete it later
-      await dashboardAddPanel.clickCreateNewLink();
-      await PageObjects.visualize.clickAggBasedVisualizations();
+      await dashboardAddPanel.clickEditorMenuButton();
+      await dashboardAddPanel.clickAggBasedVisualizations();
       await PageObjects.visualize.clickAreaChart();
       await PageObjects.visualize.clickNewSearch();
       await PageObjects.visualize.saveVisualizationExpectSuccess('Wildvis', {
diff --git a/test/functional/apps/dashboard/dashboard_unsaved_state.ts b/test/functional/apps/dashboard/dashboard_unsaved_state.ts
index e6cc91880010ae..fd203cd8c1356d 100644
--- a/test/functional/apps/dashboard/dashboard_unsaved_state.ts
+++ b/test/functional/apps/dashboard/dashboard_unsaved_state.ts
@@ -41,8 +41,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     it('shows the unsaved changes badge after adding panels', async () => {
       await PageObjects.dashboard.switchToEditMode();
       // add an area chart by value
-      await dashboardAddPanel.clickCreateNewLink();
-      await PageObjects.visualize.clickAggBasedVisualizations();
+      await dashboardAddPanel.clickEditorMenuButton();
+      await dashboardAddPanel.clickAggBasedVisualizations();
       await PageObjects.visualize.clickAreaChart();
       await PageObjects.visualize.clickNewSearch();
       await PageObjects.visualize.saveVisualizationAndReturn();
diff --git a/test/functional/apps/dashboard/edit_embeddable_redirects.ts b/test/functional/apps/dashboard/edit_embeddable_redirects.ts
index 8b7b98a59aa126..be540e18a503f9 100644
--- a/test/functional/apps/dashboard/edit_embeddable_redirects.ts
+++ b/test/functional/apps/dashboard/edit_embeddable_redirects.ts
@@ -13,10 +13,9 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['dashboard', 'header', 'visualize', 'settings', 'common']);
   const esArchiver = getService('esArchiver');
-  const testSubjects = getService('testSubjects');
   const kibanaServer = getService('kibanaServer');
   const dashboardPanelActions = getService('dashboardPanelActions');
-  const dashboardVisualizations = getService('dashboardVisualizations');
+  const dashboardAddPanel = getService('dashboardAddPanel');
 
   describe('edit embeddable redirects', () => {
     before(async () => {
@@ -88,10 +87,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const newTitle = 'test create panel originatingApp';
       await PageObjects.dashboard.loadSavedDashboard('few panels');
       await PageObjects.dashboard.switchToEditMode();
-      await testSubjects.exists('dashboardAddNewPanelButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
-      await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
-      await PageObjects.visualize.clickMarkdownWidget();
+      await dashboardAddPanel.clickMarkdownQuickButton();
       await PageObjects.visualize.saveVisualizationExpectSuccess(newTitle, {
         saveAsNew: true,
         redirectToOrigin: false,
diff --git a/test/functional/apps/dashboard/edit_visualizations.js b/test/functional/apps/dashboard/edit_visualizations.js
index ce32f53587e747..b2f21aefcf79cc 100644
--- a/test/functional/apps/dashboard/edit_visualizations.js
+++ b/test/functional/apps/dashboard/edit_visualizations.js
@@ -14,13 +14,14 @@ export default function ({ getService, getPageObjects }) {
   const testSubjects = getService('testSubjects');
   const appsMenu = getService('appsMenu');
   const kibanaServer = getService('kibanaServer');
+  const dashboardAddPanel = getService('dashboardAddPanel');
   const dashboardPanelActions = getService('dashboardPanelActions');
 
   const originalMarkdownText = 'Original markdown text';
   const modifiedMarkdownText = 'Modified markdown text';
 
   const createMarkdownVis = async (title) => {
-    await PageObjects.dashboard.clickMarkdownQuickButton();
+    await dashboardAddPanel.clickMarkdownQuickButton();
     await PageObjects.visEditor.setMarkdownTxt(originalMarkdownText);
     await PageObjects.visEditor.clickGo();
     if (title) {
diff --git a/test/functional/apps/dashboard/embeddable_rendering.ts b/test/functional/apps/dashboard/embeddable_rendering.ts
index 2a9551786de6e2..11807831dc3524 100644
--- a/test/functional/apps/dashboard/embeddable_rendering.ts
+++ b/test/functional/apps/dashboard/embeddable_rendering.ts
@@ -64,7 +64,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     // TODO add test for 'scripted filter and query' viz
     // TODO add test for 'animal weight linked to search' viz
     // TODO add test for the last vega viz
-    await dashboardExpect.savedSearchRowCount(50);
+    await dashboardExpect.savedSearchRowCount(11);
   };
 
   const expectNoDataRenders = async () => {
diff --git a/test/functional/apps/dashboard/empty_dashboard.ts b/test/functional/apps/dashboard/empty_dashboard.ts
index c096d90aa3595e..2cfa6d73dcb728 100644
--- a/test/functional/apps/dashboard/empty_dashboard.ts
+++ b/test/functional/apps/dashboard/empty_dashboard.ts
@@ -41,15 +41,13 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     it('should open add panel when add button is clicked', async () => {
-      await testSubjects.click('dashboardAddPanelButton');
+      await dashboardAddPanel.clickOpenAddPanel();
       const isAddPanelOpen = await dashboardAddPanel.isAddPanelOpen();
       expect(isAddPanelOpen).to.be(true);
       await testSubjects.click('euiFlyoutCloseButton');
     });
 
     it('should add new visualization from dashboard', async () => {
-      await testSubjects.exists('dashboardAddNewPanelButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
       await dashboardVisualizations.createAndAddMarkdown({
         name: 'Dashboard Test Markdown',
         markdown: 'Markdown text',
@@ -57,5 +55,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.dashboard.waitForRenderComplete();
       await dashboardExpect.markdownWithValuesExists(['Markdown text']);
     });
+
+    it('should open editor menu when editor button is clicked', async () => {
+      await dashboardAddPanel.clickEditorMenuButton();
+      await testSubjects.existOrFail('dashboardEditorContextMenu');
+    });
   });
 }
diff --git a/test/functional/apps/dashboard/saved_search_embeddable.ts b/test/functional/apps/dashboard/saved_search_embeddable.ts
index 71f19b23da9dd9..bea5c7d7491623 100644
--- a/test/functional/apps/dashboard/saved_search_embeddable.ts
+++ b/test/functional/apps/dashboard/saved_search_embeddable.ts
@@ -45,7 +45,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const marks = $('mark')
         .toArray()
         .map((mark) => $(mark).text());
-      expect(marks.length).to.be(50);
+      expect(marks.length).to.be(11);
     });
 
     it('removing a filter removes highlights', async function () {
diff --git a/test/functional/apps/dashboard/view_edit.ts b/test/functional/apps/dashboard/view_edit.ts
index c5c7daab27ff19..99a78ebd069c5d 100644
--- a/test/functional/apps/dashboard/view_edit.ts
+++ b/test/functional/apps/dashboard/view_edit.ts
@@ -113,10 +113,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
         it('when a new vis is added', async function () {
           const originalPanelCount = await PageObjects.dashboard.getPanelCount();
-
-          await dashboardAddPanel.ensureAddPanelIsShowing();
-          await dashboardAddPanel.clickAddNewEmbeddableLink('visualization');
-          await PageObjects.visualize.clickAggBasedVisualizations();
+          await dashboardAddPanel.clickEditorMenuButton();
+          await dashboardAddPanel.clickAggBasedVisualizations();
           await PageObjects.visualize.clickAreaChart();
           await PageObjects.visualize.clickNewSearch();
           await PageObjects.visualize.saveVisualizationExpectSuccess('new viz panel', {
diff --git a/test/functional/apps/discover/_data_grid_doc_table.ts b/test/functional/apps/discover/_data_grid_doc_table.ts
index 5499f0250eb736..f8406f4c8a8a9a 100644
--- a/test/functional/apps/discover/_data_grid_doc_table.ts
+++ b/test/functional/apps/discover/_data_grid_doc_table.ts
@@ -22,6 +22,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     defaultIndex: 'logstash-*',
     'doc_table:legacy': false,
   };
+  const testSubjects = getService('testSubjects');
 
   describe('discover data grid doc table', function describeIndexTests() {
     before(async function () {
@@ -102,6 +103,31 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await dataGrid.closeFlyout();
         });
       });
+
+      it('should show allow adding columns from the detail panel', async function () {
+        await retry.try(async function () {
+          await dataGrid.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
+
+          // add columns
+          const fields = ['_id', '_index', 'agent'];
+          for (const field of fields) {
+            await testSubjects.click(`toggleColumnButton_${field}`);
+          }
+
+          const headerWithFields = await dataGrid.getHeaderFields();
+          expect(headerWithFields.join(' ')).to.contain(fields.join(' '));
+
+          // remove columns
+          for (const field of fields) {
+            await testSubjects.click(`toggleColumnButton_${field}`);
+          }
+
+          const headerWithoutFields = await dataGrid.getHeaderFields();
+          expect(headerWithoutFields.join(' ')).not.to.contain(fields.join(' '));
+
+          await dataGrid.closeFlyout();
+        });
+      });
     });
 
     describe('add and remove columns', function () {
diff --git a/test/functional/apps/discover/_data_grid_field_data.ts b/test/functional/apps/discover/_data_grid_field_data.ts
index f41a98e2f3364c..62c27c8d50dc4e 100644
--- a/test/functional/apps/discover/_data_grid_field_data.ts
+++ b/test/functional/apps/discover/_data_grid_field_data.ts
@@ -41,9 +41,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       it('the search term should be highlighted in the field data', async function () {
         // marks is the style that highlights the text in yellow
+        await PageObjects.discover.clickFieldListItemAdd('extension');
         const marks = await PageObjects.discover.getMarks();
-        expect(marks.length).to.be(50);
+        expect(marks.length).to.be.greaterThan(0);
         expect(marks.indexOf('php')).to.be(0);
+        await PageObjects.discover.clickFieldListItemRemove('extension');
       });
 
       it('search type:apache should show the correct hit count', async function () {
diff --git a/test/functional/apps/discover/_date_nanos_mixed.ts b/test/functional/apps/discover/_date_nanos_mixed.ts
index 35439ef1e8eb03..47c3a19c069868 100644
--- a/test/functional/apps/discover/_date_nanos_mixed.ts
+++ b/test/functional/apps/discover/_date_nanos_mixed.ts
@@ -33,14 +33,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     it('shows a list of records of indices with date & date_nanos fields in the right order', async function () {
-      const rowData1 = await PageObjects.discover.getDocTableIndex(1);
-      expect(rowData1.startsWith('Jan 1, 2019 @ 12:10:30.124000000')).to.be.ok();
-      const rowData2 = await PageObjects.discover.getDocTableIndex(3);
-      expect(rowData2.startsWith('Jan 1, 2019 @ 12:10:30.123498765')).to.be.ok();
-      const rowData3 = await PageObjects.discover.getDocTableIndex(5);
-      expect(rowData3.startsWith('Jan 1, 2019 @ 12:10:30.123456789')).to.be.ok();
-      const rowData4 = await PageObjects.discover.getDocTableIndex(7);
-      expect(rowData4.startsWith('Jan 1, 2019 @ 12:10:30.123000000')).to.be.ok();
+      const rowData1 = await PageObjects.discover.getDocTableField(1);
+      expect(rowData1).to.be('Jan 1, 2019 @ 12:10:30.124000000');
+      const rowData2 = await PageObjects.discover.getDocTableField(2);
+      expect(rowData2).to.be('Jan 1, 2019 @ 12:10:30.123498765');
+      const rowData3 = await PageObjects.discover.getDocTableField(3);
+      expect(rowData3).to.be('Jan 1, 2019 @ 12:10:30.123456789');
+      const rowData4 = await PageObjects.discover.getDocTableField(4);
+      expect(rowData4).to.be('Jan 1, 2019 @ 12:10:30.123000000');
     });
   });
 }
diff --git a/test/functional/apps/discover/_discover.ts b/test/functional/apps/discover/_discover.ts
index 0c12f32f6e717b..ab53eca0cedf5e 100644
--- a/test/functional/apps/discover/_discover.ts
+++ b/test/functional/apps/discover/_discover.ts
@@ -52,7 +52,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(time.end).to.be(PageObjects.timePicker.defaultEndTime);
         const rowData = await PageObjects.discover.getDocTableIndex(1);
         log.debug('check the newest doc timestamp in UTC (check diff timezone in last test)');
-        expect(rowData.startsWith('Sep 22, 2015 @ 23:50:13.253')).to.be.ok();
+        expect(rowData).to.contain('Sep 22, 2015 @ 23:50:13.253');
       });
 
       it('save query should show toast message and display query name', async function () {
@@ -99,11 +99,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         const time = await PageObjects.timePicker.getTimeConfig();
         expect(time.start).to.be('Sep 21, 2015 @ 09:00:00.000');
         expect(time.end).to.be('Sep 21, 2015 @ 12:00:00.000');
-        await retry.waitFor('doc table to contain the right search result', async () => {
-          const rowData = await PageObjects.discover.getDocTableField(1);
-          log.debug(`The first timestamp value in doc table: ${rowData}`);
-          return rowData.includes('Sep 21, 2015 @ 11:59:22.316');
-        });
+        await retry.waitForWithTimeout(
+          'doc table to contain the right search result',
+          1000,
+          async () => {
+            const rowData = await PageObjects.discover.getDocTableField(1);
+            log.debug(`The first timestamp value in doc table: ${rowData}`);
+            return rowData.includes('Sep 21, 2015 @ 11:59:22.316');
+          }
+        );
       });
 
       it('should modify the time range when the histogram is brushed', async function () {
@@ -304,7 +308,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
         await PageObjects.common.navigateToApp('discover');
         await PageObjects.discover.clickFieldListItemAdd('_score');
-        await PageObjects.discover.clickFieldSort('_score');
+        await PageObjects.discover.clickFieldSort('_score', 'Sort Low-High');
         const currentUrlWithScore = await browser.getCurrentUrl();
         expect(currentUrlWithScore).to.contain('_score');
         await PageObjects.discover.clickFieldListItemAdd('_score');
@@ -315,7 +319,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
         await PageObjects.common.navigateToApp('discover');
         await PageObjects.discover.clickFieldListItemAdd('referer');
-        await PageObjects.discover.clickFieldSort('referer');
+        await PageObjects.discover.clickFieldSort('referer', 'Sort A-Z');
         expect(await PageObjects.discover.getDocHeader()).to.have.string('Referer custom');
         expect(await PageObjects.discover.getAllFieldNames()).to.contain('Referer custom');
         const url = await browser.getCurrentUrl();
diff --git a/test/functional/apps/discover/_doc_navigation.ts b/test/functional/apps/discover/_doc_navigation.ts
index e783d159cb2615..90d3c4eca423a6 100644
--- a/test/functional/apps/discover/_doc_navigation.ts
+++ b/test/functional/apps/discover/_doc_navigation.ts
@@ -17,12 +17,23 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'discover', 'timePicker', 'context']);
   const esArchiver = getService('esArchiver');
   const retry = getService('retry');
+  const kibanaServer = getService('kibanaServer');
 
   describe('doc link in discover', function contextSize() {
-    beforeEach(async function () {
+    before(async () => {
       await esArchiver.loadIfNeeded('logstash_functional');
       await esArchiver.loadIfNeeded('discover');
       await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.update({
+        'doc_table:legacy': true,
+        'discover:searchFieldsFromSource': true,
+      });
+    });
+    after(async () => {
+      await kibanaServer.uiSettings.replace({});
+    });
+
+    beforeEach(async function () {
       await PageObjects.common.navigateToApp('discover');
       await PageObjects.discover.waitForDocTableLoadingComplete();
     });
diff --git a/test/functional/apps/discover/_doc_table.ts b/test/functional/apps/discover/_doc_table.ts
index edcb0020001834..1fd26b561195ee 100644
--- a/test/functional/apps/discover/_doc_table.ts
+++ b/test/functional/apps/discover/_doc_table.ts
@@ -16,13 +16,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
   const docTable = getService('docTable');
   const queryBar = getService('queryBar');
+  const find = getService('find');
   const PageObjects = getPageObjects(['common', 'discover', 'header', 'timePicker']);
   const defaultSettings = {
     defaultIndex: 'logstash-*',
   };
+  const testSubjects = getService('testSubjects');
 
   describe('discover doc table', function describeIndexTests() {
-    const defaultRowsLimit = 50;
     const rowsHardLimit = 500;
 
     before(async function () {
@@ -37,10 +38,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.common.navigateToApp('discover');
     });
 
-    it('should show the first 50 rows by default', async function () {
+    it('should show records by default', async function () {
       // with the default range the number of hits is ~14000
       const rows = await PageObjects.discover.getDocTableRows();
-      expect(rows.length).to.be(defaultRowsLimit);
+      expect(rows.length).to.be.greaterThan(0);
     });
 
     it('should refresh the table content when changing time window', async function () {
@@ -57,113 +58,130 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.timePicker.setDefaultAbsoluteRange();
     });
 
-    it(`should load up to ${rowsHardLimit} rows when scrolling at the end of the table`, async function () {
-      const initialRows = await PageObjects.discover.getDocTableRows();
-      // click the Skip to the end of the table
-      await PageObjects.discover.skipToEndOfDocTable();
-      // now count the rows
-      const finalRows = await PageObjects.discover.getDocTableRows();
-      expect(finalRows.length).to.be.above(initialRows.length);
-      expect(finalRows.length).to.be(rowsHardLimit);
-      await PageObjects.discover.backToTop();
-    });
-
-    it('should go the end of the table when using the accessible Skip button', async function () {
-      // click the Skip to the end of the table
-      await PageObjects.discover.skipToEndOfDocTable();
-      // now check the footer text content
-      const footer = await PageObjects.discover.getDocTableFooter();
-      log.debug(await footer.getVisibleText());
-      expect(await footer.getVisibleText()).to.have.string(rowsHardLimit);
-      await PageObjects.discover.backToTop();
-    });
+    describe('legacy', async function () {
+      before(async () => {
+        await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
+        await PageObjects.common.navigateToApp('discover');
+        await PageObjects.discover.waitUntilSearchingHasFinished();
+      });
+      after(async () => {
+        await kibanaServer.uiSettings.replace({});
+      });
+      it(`should load up to ${rowsHardLimit} rows when scrolling at the end of the table`, async function () {
+        const initialRows = await testSubjects.findAll('docTableRow');
+        // click the Skip to the end of the table
+        await PageObjects.discover.skipToEndOfDocTable();
+        // now count the rows
+        const finalRows = await testSubjects.findAll('docTableRow');
+        expect(finalRows.length).to.be.above(initialRows.length);
+        expect(finalRows.length).to.be(rowsHardLimit);
+        await PageObjects.discover.backToTop();
+      });
 
-    describe('expand a document row', function () {
-      const rowToInspect = 1;
-      beforeEach(async function () {
-        // close the toggle if open
-        const details = await docTable.getDetailsRows();
-        if (details.length) {
-          await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
-        }
+      it('should go the end of the table when using the accessible Skip button', async function () {
+        // click the Skip to the end of the table
+        await PageObjects.discover.skipToEndOfDocTable();
+        // now check the footer text content
+        const footer = await PageObjects.discover.getDocTableFooter();
+        log.debug(await footer.getVisibleText());
+        expect(await footer.getVisibleText()).to.have.string(rowsHardLimit);
+        await PageObjects.discover.backToTop();
       });
 
-      it('should expand the detail row when the toggle arrow is clicked', async function () {
-        await retry.try(async function () {
-          await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
-          const detailsEl = await docTable.getDetailsRows();
-          const defaultMessageEl = await detailsEl[0].findByTestSubject('docTableRowDetailsTitle');
-          expect(defaultMessageEl).to.be.ok();
+      describe('expand a document row', function () {
+        const rowToInspect = 1;
+        beforeEach(async function () {
+          // close the toggle if open
+          const details = await docTable.getDetailsRows();
+          if (details.length) {
+            await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
+          }
         });
-      });
 
-      it('should show the detail panel actions', async function () {
-        await retry.try(async function () {
-          await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
-          // const detailsEl = await PageObjects.discover.getDocTableRowDetails(rowToInspect);
-          const [surroundingActionEl, singleActionEl] = await docTable.getRowActions({
-            isAnchorRow: false,
-            rowIndex: rowToInspect - 1,
+        it('should expand the detail row when the toggle arrow is clicked', async function () {
+          await retry.try(async function () {
+            await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
+            const detailsEl = await docTable.getDetailsRows();
+            const defaultMessageEl = await detailsEl[0].findByTestSubject(
+              'docTableRowDetailsTitle'
+            );
+            expect(defaultMessageEl).to.be.ok();
+          });
+        });
+
+        it('should show the detail panel actions', async function () {
+          await retry.try(async function () {
+            await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
+            // const detailsEl = await PageObjects.discover.getDocTableRowDetails(rowToInspect);
+            const [surroundingActionEl, singleActionEl] = await docTable.getRowActions({
+              isAnchorRow: false,
+              rowIndex: rowToInspect - 1,
+            });
+            expect(surroundingActionEl).to.be.ok();
+            expect(singleActionEl).to.be.ok();
+            // TODO: test something more meaninful here?
           });
-          expect(surroundingActionEl).to.be.ok();
-          expect(singleActionEl).to.be.ok();
-          // TODO: test something more meaninful here?
         });
-      });
 
-      it('should not close the detail panel actions when data is re-requested', async function () {
-        await retry.try(async function () {
-          const nrOfFetches = await PageObjects.discover.getNrOfFetches();
-          await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
-          const detailsEl = await docTable.getDetailsRows();
-          const defaultMessageEl = await detailsEl[0].findByTestSubject('docTableRowDetailsTitle');
-          expect(defaultMessageEl).to.be.ok();
-          await queryBar.submitQuery();
-          const nrOfFetchesResubmit = await PageObjects.discover.getNrOfFetches();
-          expect(nrOfFetchesResubmit).to.be.above(nrOfFetches);
-          const defaultMessageElResubmit = await detailsEl[0].findByTestSubject(
-            'docTableRowDetailsTitle'
-          );
-
-          expect(defaultMessageElResubmit).to.be.ok();
+        it('should not close the detail panel actions when data is re-requested', async function () {
+          await retry.try(async function () {
+            const nrOfFetches = await PageObjects.discover.getNrOfFetches();
+            await docTable.clickRowToggle({ isAnchorRow: false, rowIndex: rowToInspect - 1 });
+            const detailsEl = await docTable.getDetailsRows();
+            const defaultMessageEl = await detailsEl[0].findByTestSubject(
+              'docTableRowDetailsTitle'
+            );
+            expect(defaultMessageEl).to.be.ok();
+            await queryBar.submitQuery();
+            const nrOfFetchesResubmit = await PageObjects.discover.getNrOfFetches();
+            expect(nrOfFetchesResubmit).to.be.above(nrOfFetches);
+            const defaultMessageElResubmit = await detailsEl[0].findByTestSubject(
+              'docTableRowDetailsTitle'
+            );
+
+            expect(defaultMessageElResubmit).to.be.ok();
+          });
         });
       });
-    });
 
-    describe('add and remove columns', function () {
-      const extraColumns = ['phpmemory', 'ip'];
+      describe('add and remove columns', function () {
+        const extraColumns = ['phpmemory', 'ip'];
 
-      afterEach(async function () {
-        for (const column of extraColumns) {
-          await PageObjects.discover.clickFieldListItemRemove(column);
-          await PageObjects.header.waitUntilLoadingHasFinished();
-        }
-      });
+        afterEach(async function () {
+          for (const column of extraColumns) {
+            await PageObjects.discover.clickFieldListItemRemove(column);
+            await PageObjects.header.waitUntilLoadingHasFinished();
+          }
+        });
 
-      it('should add more columns to the table', async function () {
-        for (const column of extraColumns) {
-          await PageObjects.discover.clearFieldSearchInput();
-          await PageObjects.discover.findFieldByName(column);
-          await PageObjects.discover.clickFieldListItemAdd(column);
-          await PageObjects.header.waitUntilLoadingHasFinished();
-          // test the header now
-          expect(await PageObjects.discover.getDocHeader()).to.have.string(column);
-        }
-      });
+        it('should add more columns to the table', async function () {
+          for (const column of extraColumns) {
+            await PageObjects.discover.clearFieldSearchInput();
+            await PageObjects.discover.findFieldByName(column);
+            await PageObjects.discover.clickFieldListItemAdd(column);
+            await PageObjects.header.waitUntilLoadingHasFinished();
+            // test the header now
+            const docHeader = await find.byCssSelector('thead > tr:nth-child(1)');
+            const docHeaderText = await docHeader.getVisibleText();
+            expect(docHeaderText).to.have.string(column);
+          }
+        });
 
-      it('should remove columns from the table', async function () {
-        for (const column of extraColumns) {
-          await PageObjects.discover.clearFieldSearchInput();
-          await PageObjects.discover.findFieldByName(column);
-          log.debug(`add a ${column} column`);
-          await PageObjects.discover.clickFieldListItemAdd(column);
+        it('should remove columns from the table', async function () {
+          for (const column of extraColumns) {
+            await PageObjects.discover.clearFieldSearchInput();
+            await PageObjects.discover.findFieldByName(column);
+            log.debug(`add a ${column} column`);
+            await PageObjects.discover.clickFieldListItemAdd(column);
+            await PageObjects.header.waitUntilLoadingHasFinished();
+          }
+          // remove the second column
+          await PageObjects.discover.clickFieldListItemAdd(extraColumns[1]);
           await PageObjects.header.waitUntilLoadingHasFinished();
-        }
-        // remove the second column
-        await PageObjects.discover.clickFieldListItemAdd(extraColumns[1]);
-        await PageObjects.header.waitUntilLoadingHasFinished();
-        // test that the second column is no longer there
-        expect(await PageObjects.discover.getDocHeader()).to.not.have.string(extraColumns[1]);
+          // test that the second column is no longer there
+          const docHeader = await find.byCssSelector('thead > tr:nth-child(1)');
+          expect(await docHeader.getVisibleText()).to.not.have.string(extraColumns[1]);
+        });
       });
     });
   });
diff --git a/test/functional/apps/discover/_field_data.ts b/test/functional/apps/discover/_field_data.ts
index 3583a8b12c4156..492925cf6b2df8 100644
--- a/test/functional/apps/discover/_field_data.ts
+++ b/test/functional/apps/discover/_field_data.ts
@@ -18,6 +18,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const queryBar = getService('queryBar');
   const browser = getService('browser');
   const PageObjects = getPageObjects(['common', 'header', 'discover', 'visualize', 'timePicker']);
+  const find = getService('find');
 
   describe('discover tab', function describeIndexTests() {
     this.tags('includeFirefox');
@@ -44,9 +45,13 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       it('the search term should be highlighted in the field data', async function () {
         // marks is the style that highlights the text in yellow
+        await queryBar.setQuery('php');
+        await queryBar.submitQuery();
+        await PageObjects.discover.clickFieldListItemAdd('extension');
         const marks = await PageObjects.discover.getMarks();
-        expect(marks.length).to.be(50);
+        expect(marks.length).to.be.greaterThan(0);
         expect(marks.indexOf('php')).to.be(0);
+        await PageObjects.discover.clickFieldListItemRemove('extension');
       });
 
       it('search type:apache should show the correct hit count', async function () {
@@ -59,27 +64,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         });
       });
 
-      it('doc view should show Time and _source columns', async function () {
-        const expectedHeader = 'Time _source';
-        const Docheader = await PageObjects.discover.getDocHeader();
-        expect(Docheader).to.be(expectedHeader);
-      });
-
-      it('doc view should sort ascending', async function () {
-        const expectedTimeStamp = 'Sep 20, 2015 @ 00:00:00.000';
-        await PageObjects.discover.clickDocSortDown();
-
-        // we don't technically need this sleep here because the tryForTime will retry and the
-        // results will match on the 2nd or 3rd attempt, but that debug output is huge in this
-        // case and it can be avoided with just a few seconds sleep.
-        await PageObjects.common.sleep(2000);
-        await retry.try(async function tryingForTime() {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
-
-          expect(rowData.startsWith(expectedTimeStamp)).to.be.ok();
-        });
-      });
-
       it('a bad syntax query should show an error message', async function () {
         const expectedError =
           'Expected ":", "<", "<=", ">", ">=", AND, OR, end of input, ' +
@@ -102,15 +86,47 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           { useActualUrl: true }
         );
         await retry.try(async function tryingForTime() {
-          expect(await PageObjects.discover.getDocHeader()).to.be('Time relatedContent');
+          expect(await PageObjects.discover.getDocHeader()).to.contain('relatedContent');
         });
 
-        const field = await PageObjects.discover.getDocTableField(1, 1);
+        const field = await PageObjects.discover.getDocTableField(1, 3);
         expect(field).to.include.string('"og:description":');
 
         const marks = await PageObjects.discover.getMarks();
         expect(marks.length).to.be(0);
       });
+
+      describe('legacy table tests', async function () {
+        before(async function () {
+          await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
+          await PageObjects.common.navigateToApp('discover');
+        });
+
+        after(async function () {
+          await kibanaServer.uiSettings.replace({});
+        });
+        it('doc view should show Time and _source columns', async function () {
+          const expectedHeader = 'Time _source';
+          const docHeader = await find.byCssSelector('thead > tr:nth-child(1)');
+          const docHeaderText = await docHeader.getVisibleText();
+          expect(docHeaderText).to.be(expectedHeader);
+        });
+
+        it('doc view should sort ascending', async function () {
+          const expectedTimeStamp = 'Sep 20, 2015 @ 00:00:00.000';
+          await find.clickByCssSelector('.fa-sort-down');
+
+          // we don't technically need this sleep here because the tryForTime will retry and the
+          // results will match on the 2nd or 3rd attempt, but that debug output is huge in this
+          // case and it can be avoided with just a few seconds sleep.
+          await PageObjects.common.sleep(2000);
+          await retry.try(async function tryingForTime() {
+            const row = await find.byCssSelector(`tr.kbnDocTable__row:nth-child(1)`);
+            const rowData = await row.getVisibleText();
+            expect(rowData.startsWith(expectedTimeStamp)).to.be.ok();
+          });
+        });
+      });
     });
   });
 }
diff --git a/test/functional/apps/discover/_field_data_with_fields_api.ts b/test/functional/apps/discover/_field_data_with_fields_api.ts
index 168f718c386021..c2705311950113 100644
--- a/test/functional/apps/discover/_field_data_with_fields_api.ts
+++ b/test/functional/apps/discover/_field_data_with_fields_api.ts
@@ -18,6 +18,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const queryBar = getService('queryBar');
   const browser = getService('browser');
   const PageObjects = getPageObjects(['common', 'header', 'discover', 'visualize', 'timePicker']);
+  const find = getService('find');
 
   describe('discover tab with new fields API', function describeIndexTests() {
     this.tags('includeFirefox');
@@ -44,9 +45,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       it('the search term should be highlighted in the field data', async function () {
         // marks is the style that highlights the text in yellow
+        await PageObjects.discover.clickFieldListItemAdd('extension');
         const marks = await PageObjects.discover.getMarks();
-        expect(marks.length).to.be(100);
+        expect(marks.length).to.be.greaterThan(0);
         expect(marks.indexOf('php')).to.be(0);
+        await PageObjects.discover.clickFieldListItemRemove('extension');
       });
 
       it('search type:apache should show the correct hit count', async function () {
@@ -60,24 +63,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
 
       it('doc view should show Time and Document columns', async function () {
-        const expectedHeader = 'Time Document';
         const Docheader = await PageObjects.discover.getDocHeader();
-        expect(Docheader).to.be(expectedHeader);
-      });
-
-      it('doc view should sort ascending', async function () {
-        const expectedTimeStamp = 'Sep 20, 2015 @ 00:00:00.000';
-        await PageObjects.discover.clickDocSortDown();
-
-        // we don't technically need this sleep here because the tryForTime will retry and the
-        // results will match on the 2nd or 3rd attempt, but that debug output is huge in this
-        // case and it can be avoided with just a few seconds sleep.
-        await PageObjects.common.sleep(2000);
-        await retry.try(async function tryingForTime() {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
-
-          expect(rowData.startsWith(expectedTimeStamp)).to.be.ok();
-        });
+        expect(Docheader).to.contain('Time');
+        expect(Docheader).to.contain('Document');
       });
 
       it('a bad syntax query should show an error message', async function () {
@@ -102,15 +90,42 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           { useActualUrl: true }
         );
         await retry.try(async function tryingForTime() {
-          expect(await PageObjects.discover.getDocHeader()).to.be('Time relatedContent');
+          expect(await PageObjects.discover.getDocHeader()).to.contain('relatedContent');
         });
 
-        const field = await PageObjects.discover.getDocTableField(1, 1);
-        expect(field).to.include.string('relatedContent.url:');
+        const field = await PageObjects.discover.getDocTableField(1, 3);
+        expect(field).to.include.string('relatedContent.url');
 
         const marks = await PageObjects.discover.getMarks();
-        expect(marks.length).to.be(172);
-        expect(marks.indexOf('election')).to.be(0);
+        expect(marks.length).to.be.above(0);
+        expect(marks).to.contain('election');
+      });
+
+      describe('legacy table tests', async function () {
+        before(async function () {
+          await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
+          await PageObjects.common.navigateToApp('discover');
+        });
+
+        after(async function () {
+          await kibanaServer.uiSettings.replace({});
+        });
+
+        it('doc view should sort ascending', async function () {
+          const expectedTimeStamp = 'Sep 20, 2015 @ 00:00:00.000';
+          await find.clickByCssSelector('.fa-sort-down');
+
+          // we don't technically need this sleep here because the tryForTime will retry and the
+          // results will match on the 2nd or 3rd attempt, but that debug output is huge in this
+          // case and it can be avoided with just a few seconds sleep.
+          await PageObjects.common.sleep(2000);
+          await retry.try(async function tryingForTime() {
+            const row = await find.byCssSelector(`tr.kbnDocTable__row:nth-child(1)`);
+            const rowData = await row.getVisibleText();
+
+            expect(rowData.startsWith(expectedTimeStamp)).to.be.ok();
+          });
+        });
       });
     });
   });
diff --git a/test/functional/apps/discover/_large_string.ts b/test/functional/apps/discover/_large_string.ts
index 3f9a5ab264c7aa..fcc36d11a1eb99 100644
--- a/test/functional/apps/discover/_large_string.ts
+++ b/test/functional/apps/discover/_large_string.ts
@@ -29,7 +29,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     it('verify the large string book present', async function () {
       const ExpectedDoc =
-        'mybook:Project Gutenberg EBook of Hamlet, by William Shakespeare' +
+        'mybookProject Gutenberg EBook of Hamlet, by William Shakespeare' +
         ' This eBook is for the use of anyone anywhere in the United States' +
         ' and most other parts of the world at no cost and with almost no restrictions whatsoever.' +
         ' You may copy it, give it away or re-use it under the terms of the' +
diff --git a/test/functional/apps/discover/_runtime_fields_editor.ts b/test/functional/apps/discover/_runtime_fields_editor.ts
index 7df697a2e7a3a4..9add5323db814e 100644
--- a/test/functional/apps/discover/_runtime_fields_editor.ts
+++ b/test/functional/apps/discover/_runtime_fields_editor.ts
@@ -12,7 +12,7 @@ import { FtrProviderContext } from './ftr_provider_context';
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const log = getService('log');
   const retry = getService('retry');
-  const docTable = getService('docTable');
+  const dataGrid = getService('dataGrid');
   const testSubjects = getService('testSubjects');
   const kibanaServer = getService('kibanaServer');
   const esArchiver = getService('esArchiver');
@@ -103,15 +103,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     it('doc view includes runtime fields', async function () {
       // navigate to doc view
-      await docTable.clickRowToggle({ rowIndex: 0 });
+      await dataGrid.clickRowToggle();
 
       // click the open action
       await retry.try(async () => {
-        const rowActions = await docTable.getRowActions({ rowIndex: 0 });
+        const rowActions = await dataGrid.getRowActions({ rowIndex: 0 });
         if (!rowActions.length) {
           throw new Error('row actions empty, trying again');
         }
-        await rowActions[1].click();
+        await rowActions[0].click();
       });
 
       const hasDocHit = await testSubjects.exists('doc-hit');
diff --git a/test/functional/apps/discover/_saved_queries.ts b/test/functional/apps/discover/_saved_queries.ts
index 1d65b9a68bd4df..a7374c81286306 100644
--- a/test/functional/apps/discover/_saved_queries.ts
+++ b/test/functional/apps/discover/_saved_queries.ts
@@ -26,8 +26,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const savedQueryManagementComponent = getService('savedQueryManagementComponent');
   const testSubjects = getService('testSubjects');
 
-  // Failing: See https://github.com/elastic/kibana/issues/89477
-  describe.skip('saved queries saved objects', function describeIndexTests() {
+  describe('saved queries saved objects', function describeIndexTests() {
     before(async function () {
       log.debug('load kibana index with default index pattern');
       await esArchiver.load('discover');
@@ -134,10 +133,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await savedQueryManagementComponent.saveNewQueryWithNameError('OkResponse');
       });
 
-      it('does not allow saving a query with leading or trailing whitespace in the name', async () => {
-        await savedQueryManagementComponent.saveNewQueryWithNameError('OkResponse ');
-      });
-
       it('resets any changes to a loaded query on reloading the same saved query', async () => {
         await savedQueryManagementComponent.loadSavedQuery('OkResponse');
         await queryBar.setQuery('response:503');
diff --git a/test/functional/apps/home/_sample_data.ts b/test/functional/apps/home/_sample_data.ts
index 12669bafcd780a..5a4bdfeb6b3e83 100644
--- a/test/functional/apps/home/_sample_data.ts
+++ b/test/functional/apps/home/_sample_data.ts
@@ -101,7 +101,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         log.debug('Checking area, bar and heatmap charts rendered');
         await dashboardExpect.seriesElementCount(15);
         log.debug('Checking saved searches rendered');
-        await dashboardExpect.savedSearchRowCount(50);
+        await dashboardExpect.savedSearchRowCount(11);
         log.debug('Checking input controls rendered');
         await dashboardExpect.inputControlItemCount(3);
         log.debug('Checking tag cloud rendered');
diff --git a/test/functional/apps/management/_import_objects.ts b/test/functional/apps/management/_import_objects.ts
index cb4d46f02f56b0..d9eb945be77771 100644
--- a/test/functional/apps/management/_import_objects.ts
+++ b/test/functional/apps/management/_import_objects.ts
@@ -12,6 +12,7 @@ import { keyBy } from 'lodash';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
 function uniq<T>(input: T[]): T[] {
   return [...new Set(input)];
 }
@@ -23,9 +24,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const log = getService('log');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/95660
-  // FLAKY: https://github.com/elastic/kibana/issues/95706
-  describe.skip('import objects', function describeIndexTests() {
+  describe('import objects', function describeIndexTests() {
     describe('.ndjson file', () => {
       beforeEach(async function () {
         await esArchiver.load('management');
@@ -314,7 +313,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         // but as the initial popin can take a few ms before fading, we need to wait a little
         // to avoid clicking twice on the same modal.
         await delay(1000);
-        await PageObjects.common.clickConfirmOnModal(false);
+        await PageObjects.common.clickConfirmOnModal(true);
 
         const isSuccessful = await testSubjects.exists('importSavedObjectsSuccess');
         expect(isSuccessful).to.be(true);
@@ -335,7 +334,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         // but as the initial popin can take a few ms before fading, we need to wait a little
         // to avoid clicking twice on the same modal.
         await delay(1000);
-        await PageObjects.common.clickConfirmOnModal(false);
+        await PageObjects.common.clickConfirmOnModal(true);
 
         const isSuccessful = await testSubjects.exists('importSavedObjectsSuccess');
         expect(isSuccessful).to.be(true);
diff --git a/test/functional/apps/management/_scripted_fields.js b/test/functional/apps/management/_scripted_fields.js
index 13af3206a166dd..fdbc419c162412 100644
--- a/test/functional/apps/management/_scripted_fields.js
+++ b/test/functional/apps/management/_scripted_fields.js
@@ -50,7 +50,7 @@ export default function ({ getService, getPageObjects }) {
       await esArchiver.load('discover');
       // delete .kibana index and then wait for Kibana to re-create it
       await kibanaServer.uiSettings.replace({});
-      await kibanaServer.uiSettings.update({});
+      await kibanaServer.uiSettings.update({ 'doc_table:legacy': true });
     });
 
     after(async function afterAll() {
@@ -149,7 +149,7 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.header.waitUntilLoadingHasFinished();
 
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 18, 2015 @ 18:20:57.916\n18');
         });
       });
@@ -163,14 +163,14 @@ export default function ({ getService, getPageObjects }) {
         await testSubjects.click('docTableHeaderFieldSort_@timestamp');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 17, 2015 @ 10:53:14.181\n-1');
         });
 
         await testSubjects.click(`docTableHeaderFieldSort_${scriptedPainlessFieldName}`);
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 17, 2015 @ 06:32:29.479\n20');
         });
       });
@@ -238,7 +238,7 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.header.waitUntilLoadingHasFinished();
 
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 18, 2015 @ 18:20:57.916\ngood');
         });
       });
@@ -252,14 +252,14 @@ export default function ({ getService, getPageObjects }) {
         await testSubjects.click('docTableHeaderFieldSort_@timestamp');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 17, 2015 @ 09:48:40.594\nbad');
         });
 
         await testSubjects.click(`docTableHeaderFieldSort_${scriptedPainlessFieldName2}`);
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 17, 2015 @ 06:32:29.479\ngood');
         });
       });
@@ -327,7 +327,7 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.header.waitUntilLoadingHasFinished();
 
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 18, 2015 @ 18:20:57.916\ntrue');
         });
       });
@@ -354,14 +354,14 @@ export default function ({ getService, getPageObjects }) {
         await testSubjects.click('docTableHeaderFieldSort_@timestamp');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('updateExpectedResultHere\ntrue');
         });
 
         await testSubjects.click(`docTableHeaderFieldSort_${scriptedPainlessFieldName2}`);
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('updateExpectedResultHere\nfalse');
         });
       });
@@ -417,7 +417,7 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.header.waitUntilLoadingHasFinished();
 
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('Sep 18, 2015 @ 06:52:55.953\n2015-09-18 07:00');
         });
       });
@@ -432,14 +432,14 @@ export default function ({ getService, getPageObjects }) {
         await testSubjects.click('docTableHeaderFieldSort_@timestamp');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('updateExpectedResultHere\n2015-09-18 07:00');
         });
 
         await testSubjects.click(`docTableHeaderFieldSort_${scriptedPainlessFieldName2}`);
         await PageObjects.header.waitUntilLoadingHasFinished();
         await retry.try(async function () {
-          const rowData = await PageObjects.discover.getDocTableIndex(1);
+          const rowData = await PageObjects.discover.getDocTableIndexLegacy(1);
           expect(rowData).to.be('updateExpectedResultHere\n2015-09-18 07:00');
         });
       });
diff --git a/test/functional/page_objects/dashboard_page.ts b/test/functional/page_objects/dashboard_page.ts
index 34559afdf6ae1a..b0610b36eb65f1 100644
--- a/test/functional/page_objects/dashboard_page.ts
+++ b/test/functional/page_objects/dashboard_page.ts
@@ -220,14 +220,15 @@ export function DashboardPageProvider({ getService, getPageObjects }: FtrProvide
 
     /**
      * Asserts that the toolbar pagination (count and arrows) is either displayed or not displayed.
-     * @param { displayed: boolean }
+
      */
-    public async expectToolbarPaginationDisplayed({ displayed = true }) {
-      const subjects = ['btnPrevPage', 'btnNextPage', 'toolBarPagerText'];
-      if (displayed) {
-        await Promise.all(subjects.map(async (subj) => await testSubjects.existOrFail(subj)));
-      } else {
-        await Promise.all(subjects.map(async (subj) => await testSubjects.missingOrFail(subj)));
+    public async expectToolbarPaginationDisplayed() {
+      const subjects = ['pagination-button-previous', 'pagination-button-next'];
+
+      await Promise.all(subjects.map(async (subj) => await testSubjects.existOrFail(subj)));
+      const paginationListExists = await find.existsByCssSelector('.euiPagination__list');
+      if (!paginationListExists) {
+        throw new Error(`expected discover data grid pagination list to exist`);
       }
     }
 
@@ -413,16 +414,6 @@ export function DashboardPageProvider({ getService, getPageObjects }: FtrProvide
       await testSubjects.click('confirmSaveSavedObjectButton');
     }
 
-    public async clickMarkdownQuickButton() {
-      log.debug('Click markdown quick button');
-      await testSubjects.click('dashboardMarkdownQuickButton');
-    }
-
-    public async clickInputControlsQuickButton() {
-      log.debug('Click input controls quick button');
-      await testSubjects.click('dashboardInputControlsQuickButton');
-    }
-
     /**
      *
      * @param dashboardTitle {String}
diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index 62375a39dd7d37..62aa41d89f75e9 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -20,6 +20,7 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
   const docTable = getService('docTable');
   const config = getService('config');
   const defaultFindTimeout = config.get('timeouts.find');
+  const dataGrid = getService('dataGrid');
 
   class DiscoverPage {
     public async getChartTimespan() {
@@ -77,7 +78,7 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     public async getColumnHeaders() {
-      return await docTable.getHeaderFields('embeddedSavedSearchDocTable');
+      return await dataGrid.getHeaderFields();
     }
 
     public async openLoadSavedSearchPanel() {
@@ -139,7 +140,7 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
       await elasticChart.waitForRenderComplete();
       const el = await elasticChart.getCanvas();
 
-      await browser.getActions().move({ x: 0, y: 20, origin: el._webElement }).click().perform();
+      await browser.getActions().move({ x: 0, y: 0, origin: el._webElement }).click().perform();
     }
 
     public async brushHistogram() {
@@ -179,26 +180,31 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     public async getDocHeader() {
-      const docHeader = await find.byCssSelector('thead > tr:nth-child(1)');
-      return await docHeader.getVisibleText();
+      const docHeader = await dataGrid.getHeaders();
+      return docHeader.join();
     }
 
     public async getDocTableRows() {
       await header.waitUntilLoadingHasFinished();
-      const rows = await testSubjects.findAll('docTableRow');
-      return rows;
+      return await dataGrid.getBodyRows();
     }
 
     public async getDocTableIndex(index: number) {
+      const row = await dataGrid.getRow({ rowIndex: index - 1 });
+      const result = await Promise.all(row.map(async (cell) => await cell.getVisibleText()));
+      // Remove control columns
+      return result.slice(2).join(' ');
+    }
+
+    public async getDocTableIndexLegacy(index: number) {
       const row = await find.byCssSelector(`tr.kbnDocTable__row:nth-child(${index})`);
       return await row.getVisibleText();
     }
 
-    public async getDocTableField(index: number, cellIndex = 0) {
-      const fields = await find.allByCssSelector(
-        `tr.kbnDocTable__row:nth-child(${index}) [data-test-subj='docTableField']`
-      );
-      return await fields[cellIndex].getVisibleText();
+    public async getDocTableField(index: number, cellIdx: number = 2) {
+      const row = await dataGrid.getRow({ rowIndex: index - 1 });
+      const result = await Promise.all(row.map(async (cell) => await cell.getVisibleText()));
+      return result[cellIdx];
     }
 
     public async skipToEndOfDocTable() {
@@ -224,11 +230,11 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     public async clickDocSortDown() {
-      await find.clickByCssSelector('.fa-sort-down');
+      await dataGrid.clickDocSortAsc();
     }
 
     public async clickDocSortUp() {
-      await find.clickByCssSelector('.fa-sort-up');
+      await dataGrid.clickDocSortDesc();
     }
 
     public async isShowingDocViewer() {
@@ -237,10 +243,8 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
 
     public async getMarks() {
       const table = await docTable.getTable();
-      const $ = await table.parseDomContent();
-      return $('mark')
-        .toArray()
-        .map((mark) => $(mark).text());
+      const marks = await table.findAllByTagName('mark');
+      return await Promise.all(marks.map((mark) => mark.getVisibleText()));
     }
 
     public async toggleSidebarCollapse() {
@@ -295,8 +299,8 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
       return await testSubjects.click(`field-${field}`);
     }
 
-    public async clickFieldSort(field: string) {
-      return await testSubjects.click(`docTableHeaderFieldSort_${field}`);
+    public async clickFieldSort(field: string, text = 'Sort New-Old') {
+      await dataGrid.clickDocSortAsc(field, text);
     }
 
     public async clickFieldListItemToggle(field: string) {
@@ -368,8 +372,7 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     public async removeHeaderColumn(name: string) {
-      await testSubjects.moveMouseTo(`docTableHeader-${name}`);
-      await testSubjects.click(`docTableRemoveHeader-${name}`);
+      await dataGrid.clickRemoveColumn(name);
     }
 
     public async openSidebarFieldFilter() {
diff --git a/test/functional/services/dashboard/add_panel.ts b/test/functional/services/dashboard/add_panel.ts
index 7bb1603e0193f9..a4e0c8b2647dd8 100644
--- a/test/functional/services/dashboard/add_panel.ts
+++ b/test/functional/services/dashboard/add_panel.ts
@@ -30,15 +30,41 @@ export function DashboardAddPanelProvider({ getService, getPageObjects }: FtrPro
       await PageObjects.common.sleep(500);
     }
 
+    async clickQuickButton(visType: string) {
+      log.debug(`DashboardAddPanel.clickQuickButton${visType}`);
+      await testSubjects.click(`dashboardQuickButton${visType}`);
+    }
+
+    async clickMarkdownQuickButton() {
+      await this.clickQuickButton('markdown');
+    }
+
+    async clickMapQuickButton() {
+      await this.clickQuickButton('map');
+    }
+
+    async clickEditorMenuButton() {
+      log.debug('DashboardAddPanel.clickEditorMenuButton');
+      await testSubjects.click('dashboardEditorMenuButton');
+    }
+
+    async clickAggBasedVisualizations() {
+      log.debug('DashboardAddPanel.clickEditorMenuAggBasedMenuItem');
+      await testSubjects.click('dashboardEditorAggBasedMenuItem');
+    }
+
     async clickVisType(visType: string) {
       log.debug('DashboardAddPanel.clickVisType');
       await testSubjects.click(`visType-${visType}`);
     }
 
+    async clickEmbeddableFactoryGroupButton(groupId: string) {
+      log.debug('DashboardAddPanel.clickEmbeddableFactoryGroupButton');
+      await testSubjects.click(`dashboardEditorMenu-${groupId}Group`);
+    }
+
     async clickAddNewEmbeddableLink(type: string) {
-      await testSubjects.click('createNew');
       await testSubjects.click(`createNew-${type}`);
-      await testSubjects.missingOrFail(`createNew-${type}`);
     }
 
     async toggleFilterPopover() {
diff --git a/test/functional/services/dashboard/expectations.ts b/test/functional/services/dashboard/expectations.ts
index e4dc59ae71566c..329a8204cce0e1 100644
--- a/test/functional/services/dashboard/expectations.ts
+++ b/test/functional/services/dashboard/expectations.ts
@@ -47,14 +47,6 @@ export function DashboardExpectProvider({ getService, getPageObjects }: FtrProvi
       });
     }
 
-    async docTableFieldCount(expectedCount: number) {
-      log.debug(`DashboardExpect.docTableFieldCount(${expectedCount})`);
-      await retry.try(async () => {
-        const docTableCells = await testSubjects.findAll('docTableField', findTimeout);
-        expect(docTableCells.length).to.be(expectedCount);
-      });
-    }
-
     async fieldSuggestions(expectedFields: string[]) {
       log.debug(`DashboardExpect.fieldSuggestions(${expectedFields})`);
       const fields = await filterBar.getFilterEditorFields();
diff --git a/test/functional/services/dashboard/visualizations.ts b/test/functional/services/dashboard/visualizations.ts
index d1aaa6aa1bd707..2bf7458ff9c5f4 100644
--- a/test/functional/services/dashboard/visualizations.ts
+++ b/test/functional/services/dashboard/visualizations.ts
@@ -10,8 +10,6 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 
 export function DashboardVisualizationProvider({ getService, getPageObjects }: FtrProviderContext) {
   const log = getService('log');
-  const find = getService('find');
-  const retry = getService('retry');
   const queryBar = getService('queryBar');
   const testSubjects = getService('testSubjects');
   const dashboardAddPanel = getService('dashboardAddPanel');
@@ -31,8 +29,8 @@ export function DashboardVisualizationProvider({ getService, getPageObjects }: F
       if (inViewMode) {
         await PageObjects.dashboard.switchToEditMode();
       }
-      await dashboardAddPanel.ensureAddPanelIsShowing();
-      await dashboardAddPanel.clickAddNewEmbeddableLink('visualization');
+      await dashboardAddPanel.clickEditorMenuButton();
+      await dashboardAddPanel.clickAddNewEmbeddableLink('metrics');
       await PageObjects.visualize.clickVisualBuilder();
       await PageObjects.visualize.saveVisualizationExpectSuccess(name);
     }
@@ -87,39 +85,13 @@ export function DashboardVisualizationProvider({ getService, getPageObjects }: F
       await dashboardAddPanel.addSavedSearch(name);
     }
 
-    async clickAddVisualizationButton() {
-      log.debug('DashboardVisualizations.clickAddVisualizationButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
-    }
-
-    async isNewVisDialogShowing() {
-      log.debug('DashboardVisualizations.isNewVisDialogShowing');
-      return await find.existsByCssSelector('.visNewVisDialog');
-    }
-
-    async ensureNewVisualizationDialogIsShowing() {
-      let isShowing = await this.isNewVisDialogShowing();
-      log.debug(`DashboardVisualizations.ensureNewVisualizationDialogIsShowing:${isShowing}`);
-      if (!isShowing) {
-        await retry.try(async () => {
-          await this.clickAddVisualizationButton();
-          isShowing = await this.isNewVisDialogShowing();
-          log.debug(`DashboardVisualizations.ensureNewVisualizationDialogIsShowing:${isShowing}`);
-          if (!isShowing) {
-            throw new Error('New Vis Dialog still not open, trying again.');
-          }
-        });
-      }
-    }
-
     async createAndAddMarkdown({ name, markdown }: { name: string; markdown: string }) {
       log.debug(`createAndAddMarkdown(${markdown})`);
       const inViewMode = await PageObjects.dashboard.getIsInViewMode();
       if (inViewMode) {
         await PageObjects.dashboard.switchToEditMode();
       }
-      await this.ensureNewVisualizationDialogIsShowing();
-      await PageObjects.visualize.clickMarkdownWidget();
+      await dashboardAddPanel.clickMarkdownQuickButton();
       await PageObjects.visEditor.setMarkdownTxt(markdown);
       await PageObjects.visEditor.clickGo();
       await PageObjects.visualize.saveVisualizationExpectSuccess(name, {
@@ -134,10 +106,10 @@ export function DashboardVisualizationProvider({ getService, getPageObjects }: F
       if (inViewMode) {
         await PageObjects.dashboard.switchToEditMode();
       }
-      await this.ensureNewVisualizationDialogIsShowing();
-      await PageObjects.visualize.clickAggBasedVisualizations();
-      await PageObjects.visualize.clickMetric();
-      await find.clickByCssSelector('li.euiListGroupItem:nth-of-type(2)');
+      await dashboardAddPanel.clickEditorMenuButton();
+      await dashboardAddPanel.clickAggBasedVisualizations();
+      await dashboardAddPanel.clickVisType('metric');
+      await testSubjects.click('savedObjectTitlelogstash-*');
       await testSubjects.exists('visualizesaveAndReturnButton');
       await testSubjects.click('visualizesaveAndReturnButton');
     }
@@ -148,8 +120,7 @@ export function DashboardVisualizationProvider({ getService, getPageObjects }: F
       if (inViewMode) {
         await PageObjects.dashboard.switchToEditMode();
       }
-      await this.ensureNewVisualizationDialogIsShowing();
-      await PageObjects.visualize.clickMarkdownWidget();
+      await dashboardAddPanel.clickMarkdownQuickButton();
       await PageObjects.visEditor.setMarkdownTxt(markdown);
       await PageObjects.visEditor.clickGo();
       await testSubjects.click('visualizesaveAndReturnButton');
diff --git a/test/functional/services/data_grid.ts b/test/functional/services/data_grid.ts
index 87fa59b48a3249..8ca6c6e816aa53 100644
--- a/test/functional/services/data_grid.ts
+++ b/test/functional/services/data_grid.ts
@@ -23,6 +23,7 @@ export function DataGridProvider({ getService, getPageObjects }: FtrProviderCont
   const find = getService('find');
   const testSubjects = getService('testSubjects');
   const PageObjects = getPageObjects(['common', 'header']);
+  const retry = getService('retry');
 
   class DataGrid {
     async getDataGridTableData(): Promise<TabbedGridData> {
@@ -126,6 +127,9 @@ export function DataGridProvider({ getService, getPageObjects }: FtrProviderCont
      */
     public async getDocTableRows() {
       const table = await this.getTable();
+      if (!table) {
+        return [];
+      }
       const cells = await table.findAllByCssSelector('.euiDataGridRowCell');
 
       const rows: WebElementWrapper[][] = [];
@@ -183,14 +187,39 @@ export function DataGridProvider({ getService, getPageObjects }: FtrProviderCont
       return await detailsRow.findAllByTestSubject('~docTableRowAction');
     }
 
-    public async clickDocSortAsc() {
-      await find.clickByCssSelector('.euiDataGridHeaderCell__button');
-      await find.clickByButtonText('Sort New-Old');
+    public async openColMenuByField(field: string) {
+      await retry.waitFor('header cell action being displayed', async () => {
+        // to prevent flakiness
+        await testSubjects.click(`dataGridHeaderCell-${field}`);
+        return await testSubjects.exists(`dataGridHeaderCellActionGroup-${field}`);
+      });
+    }
+
+    public async clickDocSortAsc(field?: string, sortText = 'Sort New-Old') {
+      if (field) {
+        await this.openColMenuByField(field);
+      } else {
+        await find.clickByCssSelector('.euiDataGridHeaderCell__button');
+      }
+      await find.clickByButtonText(sortText);
+    }
+
+    public async clickDocSortDesc(field?: string, sortText = 'Sort Old-New') {
+      if (field) {
+        await this.openColMenuByField(field);
+      } else {
+        await find.clickByCssSelector('.euiDataGridHeaderCell__button');
+      }
+      await find.clickByButtonText(sortText);
     }
 
-    public async clickDocSortDesc() {
-      await find.clickByCssSelector('.euiDataGridHeaderCell__button');
-      await find.clickByButtonText('Sort Old-New');
+    public async clickRemoveColumn(field?: string) {
+      if (field) {
+        await this.openColMenuByField(field);
+      } else {
+        await find.clickByCssSelector('.euiDataGridHeaderCell__button');
+      }
+      await find.clickByButtonText('Remove column');
     }
     public async getDetailsRow(): Promise<WebElementWrapper> {
       const detailRows = await this.getDetailsRows();
@@ -234,6 +263,10 @@ export function DataGridProvider({ getService, getPageObjects }: FtrProviderCont
       await addInclusiveFilterButton.click();
       await PageObjects.header.awaitGlobalLoadingIndicatorHidden();
     }
+
+    public async hasNoResults() {
+      return await find.existsByCssSelector('.euiDataGrid__noResults');
+    }
   }
 
   return new DataGrid();
diff --git a/test/functional/services/saved_query_management_component.ts b/test/functional/services/saved_query_management_component.ts
index 7398e6ca8c12e1..d4fa34f224547c 100644
--- a/test/functional/services/saved_query_management_component.ts
+++ b/test/functional/services/saved_query_management_component.ts
@@ -50,15 +50,14 @@ export function SavedQueryManagementComponentProvider({
       // an error.
       await testSubjects.click('savedQueryFormSaveButton');
 
-      const saveQueryFormSaveButtonStatus = await testSubjects.isEnabled(
-        'savedQueryFormSaveButton'
-      );
+      await retry.waitForWithTimeout('save button to be disabled', 1000, async () => {
+        const saveQueryFormSaveButtonStatus = await testSubjects.isEnabled(
+          'savedQueryFormSaveButton'
+        );
+        return saveQueryFormSaveButtonStatus === false;
+      });
 
-      try {
-        expect(saveQueryFormSaveButtonStatus).to.not.eql(true);
-      } finally {
-        await testSubjects.click('savedQueryFormCancelButton');
-      }
+      await testSubjects.click('savedQueryFormCancelButton');
     }
 
     public async saveCurrentlyLoadedAsNewQuery(
diff --git a/test/new_visualize_flow/dashboard_embedding.ts b/test/new_visualize_flow/dashboard_embedding.ts
index 6a1315dbfc91ed..04b91542223bad 100644
--- a/test/new_visualize_flow/dashboard_embedding.ts
+++ b/test/new_visualize_flow/dashboard_embedding.ts
@@ -22,7 +22,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
   const dashboardExpect = getService('dashboardExpect');
-  const testSubjects = getService('testSubjects');
   const dashboardVisualizations = getService('dashboardVisualizations');
   const PageObjects = getPageObjects([
     'common',
@@ -47,8 +46,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     it('adding a metric visualization', async function () {
       const originalPanelCount = await PageObjects.dashboard.getPanelCount();
       expect(originalPanelCount).to.eql(0);
-      await testSubjects.exists('dashboardAddNewPanelButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
       await dashboardVisualizations.createAndEmbedMetric('Embedding Vis Test');
       await PageObjects.dashboard.waitForRenderComplete();
       await dashboardExpect.metricValuesExist(['0']);
@@ -59,8 +56,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     it('adding a markdown', async function () {
       const originalPanelCount = await PageObjects.dashboard.getPanelCount();
       expect(originalPanelCount).to.eql(1);
-      await testSubjects.exists('dashboardAddNewPanelButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
       await dashboardVisualizations.createAndEmbedMarkdown({
         name: 'Embedding Markdown Test',
         markdown: 'Nice to meet you, markdown is my name',
diff --git a/test/plugin_functional/plugins/core_http/kibana.json b/test/plugin_functional/plugins/core_http/kibana.json
new file mode 100644
index 00000000000000..69855f59d64b74
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/kibana.json
@@ -0,0 +1,8 @@
+{
+  "id": "coreHttp",
+  "version": "0.0.1",
+  "kibanaVersion": "kibana",
+  "configPath": ["core_http"],
+  "server": true,
+  "ui": true
+}
diff --git a/test/plugin_functional/plugins/core_http/package.json b/test/plugin_functional/plugins/core_http/package.json
new file mode 100644
index 00000000000000..fd0e80d3c18228
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "core_http",
+  "version": "1.0.0",
+  "main": "target/test/plugin_functional/plugins/core_http",
+  "kibana": {
+    "version": "kibana",
+    "templateVersion": "1.0.0"
+  },
+  "license": "SSPL-1.0 OR Elastic License 2.0",
+  "scripts": {
+    "kbn": "node ../../../../scripts/kbn.js",
+    "build": "rm -rf './target' && ../../../../node_modules/.bin/tsc"
+  }
+}
\ No newline at end of file
diff --git a/test/plugin_functional/plugins/core_http/public/index.ts b/test/plugin_functional/plugins/core_http/public/index.ts
new file mode 100644
index 00000000000000..7b353cb1d29056
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/public/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { PluginInitializer } from 'kibana/public';
+import { CoreHttpPlugin, CoreHttpPluginSetup, CoreHttpPluginStart } from './plugin';
+
+export const plugin: PluginInitializer<CoreHttpPluginSetup, CoreHttpPluginStart> = () =>
+  new CoreHttpPlugin();
diff --git a/test/plugin_functional/plugins/core_http/public/plugin.tsx b/test/plugin_functional/plugins/core_http/public/plugin.tsx
new file mode 100644
index 00000000000000..64b59847ffd1b1
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/public/plugin.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Plugin, CoreSetup } from 'kibana/public';
+
+export class CoreHttpPlugin implements Plugin<CoreHttpPluginSetup, CoreHttpPluginStart> {
+  public setup({ http }: CoreSetup, deps: {}) {
+    const tryRequestCancellation = async () => {
+      const abortController = new AbortController();
+
+      const errorNamePromise = http
+        .get('/api/core_http/never_reply', { signal: abortController.signal })
+        .then(
+          () => {
+            return undefined;
+          },
+          (e) => {
+            return e.name;
+          }
+        );
+
+      // simulating 'real' cancellation by awaiting a bit
+      window.setTimeout(() => {
+        abortController.abort();
+      }, 100);
+
+      return errorNamePromise;
+    };
+
+    return {
+      tryRequestCancellation,
+    };
+  }
+
+  public start() {}
+
+  public stop() {}
+}
+
+export type CoreHttpPluginSetup = ReturnType<CoreHttpPlugin['setup']>;
+export type CoreHttpPluginStart = ReturnType<CoreHttpPlugin['start']>;
diff --git a/test/plugin_functional/plugins/core_http/server/index.ts b/test/plugin_functional/plugins/core_http/server/index.ts
new file mode 100644
index 00000000000000..66c2bb9e676f3c
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/server/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { CoreHttpPlugin } from './plugin';
+
+export const plugin = () => new CoreHttpPlugin();
diff --git a/test/plugin_functional/plugins/core_http/server/plugin.ts b/test/plugin_functional/plugins/core_http/server/plugin.ts
new file mode 100644
index 00000000000000..533e3b22b368b6
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/server/plugin.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Plugin, CoreSetup } from 'kibana/server';
+
+export class CoreHttpPlugin implements Plugin {
+  public setup(core: CoreSetup, deps: {}) {
+    const router = core.http.createRouter();
+    router.get(
+      {
+        path: '/api/core_http/never_reply',
+        validate: false,
+      },
+      async (ctx, req, res) => {
+        // need the endpoint to never reply to test request cancelation on the client side.
+        await new Promise(() => undefined);
+        return res.ok();
+      }
+    );
+  }
+
+  public start() {}
+
+  public stop() {}
+}
diff --git a/test/plugin_functional/plugins/core_http/tsconfig.json b/test/plugin_functional/plugins/core_http/tsconfig.json
new file mode 100644
index 00000000000000..3d9d8ca9451d41
--- /dev/null
+++ b/test/plugin_functional/plugins/core_http/tsconfig.json
@@ -0,0 +1,18 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./target",
+    "skipLibCheck": true
+  },
+  "include": [
+    "index.ts",
+    "public/**/*.ts",
+    "public/**/*.tsx",
+    "server/**/*.ts",
+    "../../../../typings/**/*",
+  ],
+  "exclude": [],
+  "references": [
+    { "path": "../../../../src/core/tsconfig.json" }
+  ]
+}
diff --git a/test/plugin_functional/plugins/core_provider_plugin/kibana.json b/test/plugin_functional/plugins/core_provider_plugin/kibana.json
index c55f62762e233d..b3009b07de0a0e 100644
--- a/test/plugin_functional/plugins/core_provider_plugin/kibana.json
+++ b/test/plugin_functional/plugins/core_provider_plugin/kibana.json
@@ -2,7 +2,13 @@
   "id": "coreProviderPlugin",
   "version": "0.0.1",
   "kibanaVersion": "kibana",
-  "optionalPlugins": ["corePluginA", "corePluginB", "licensing", "globalSearchTest"],
+  "optionalPlugins": [
+    "corePluginA",
+    "corePluginB",
+    "coreHttp",
+    "licensing",
+    "globalSearchTest"
+  ],
   "server": false,
   "ui": true
 }
diff --git a/test/plugin_functional/test_suites/core_plugins/http.ts b/test/plugin_functional/test_suites/core_plugins/http.ts
new file mode 100644
index 00000000000000..78682da70e6083
--- /dev/null
+++ b/test/plugin_functional/test_suites/core_plugins/http.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import expect from '@kbn/expect';
+import { PluginFunctionalProviderContext } from '../../services';
+
+export default function ({ getService, getPageObjects }: PluginFunctionalProviderContext) {
+  const PageObjects = getPageObjects(['common']);
+  const browser = getService('browser');
+
+  const getCancelationErrorName = async () => {
+    return await browser.executeAsync(async (cb) => {
+      const errorName = await window._coreProvider.setup.plugins.coreHttp.tryRequestCancellation();
+      cb(errorName);
+    });
+  };
+
+  describe('http requests', () => {
+    beforeEach(async () => {
+      await PageObjects.common.navigateToApp('home');
+    });
+
+    it('returns correct name for aborted requests', async () => {
+      const canceledErrorName = await getCancelationErrorName();
+      expect(canceledErrorName).to.eql('AbortError');
+    });
+  });
+}
diff --git a/test/plugin_functional/test_suites/core_plugins/index.ts b/test/plugin_functional/test_suites/core_plugins/index.ts
index 3f26b317b81edc..25868ac9a62db3 100644
--- a/test/plugin_functional/test_suites/core_plugins/index.ts
+++ b/test/plugin_functional/test_suites/core_plugins/index.ts
@@ -21,5 +21,6 @@ export default function ({ loadTestFile }: PluginFunctionalProviderContext) {
     loadTestFile(require.resolve('./rendering'));
     loadTestFile(require.resolve('./chrome_help_menu_links'));
     loadTestFile(require.resolve('./history_block'));
+    loadTestFile(require.resolve('./http'));
   });
 }
diff --git a/test/plugin_functional/test_suites/data_plugin/session.ts b/test/plugin_functional/test_suites/data_plugin/session.ts
index 0194a9c8e120b2..ae4f8ffdf40726 100644
--- a/test/plugin_functional/test_suites/data_plugin/session.ts
+++ b/test/plugin_functional/test_suites/data_plugin/session.ts
@@ -54,7 +54,7 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
 
       it('Starts a new session on sort', async () => {
         await PageObjects.discover.clickFieldListItemAdd('speaker');
-        await PageObjects.discover.clickFieldSort('speaker');
+        await PageObjects.discover.clickFieldSort('speaker', 'Sort A-Z');
         await PageObjects.header.waitUntilLoadingHasFinished();
         const sessionIds = await getSessionIds();
         expect(sessionIds.length).to.be(1);
diff --git a/test/scripts/checks/type_check.sh b/test/scripts/checks/type_check.sh
index 5e091625de4ed0..bbe5748558684e 100755
--- a/test/scripts/checks/type_check.sh
+++ b/test/scripts/checks/type_check.sh
@@ -2,5 +2,13 @@
 
 source src/dev/ci_setup/setup_env.sh
 
+checks-reporter-with-killswitch "Build TS Refs" \
+  node scripts/build_ts_refs \
+    --ignore-type-failures \
+    --clean \
+    --no-cache \
+    --force \
+    --debug
+
 checks-reporter-with-killswitch "Check Types" \
   node scripts/type_check
diff --git a/vars/workers.groovy b/vars/workers.groovy
index 5d3328bc8a3c46..1260f74f1bdf9f 100644
--- a/vars/workers.groovy
+++ b/vars/workers.groovy
@@ -101,6 +101,7 @@ def base(Map params, Closure closure) {
       "TEST_BROWSER_HEADLESS=1",
       "GIT_BRANCH=${checkoutInfo.branch}",
       "TMPDIR=${env.WORKSPACE}/tmp", // For Chrome and anything else that respects it
+      "BUILD_TS_REFS_DISABLE=true", // no need to build ts refs in bootstrap
     ]) {
       withCredentials([
         string(credentialsId: 'vault-addr', variable: 'VAULT_ADDR'),
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_with_embeddable_example/drilldowns_with_embeddable_example.tsx b/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_with_embeddable_example/drilldowns_with_embeddable_example.tsx
index e6351ec401d880..792b978c992410 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_with_embeddable_example/drilldowns_with_embeddable_example.tsx
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_with_embeddable_example/drilldowns_with_embeddable_example.tsx
@@ -46,7 +46,7 @@ export const DrilldownsWithEmbeddableExample: React.FC = () => {
   );
   const [showManager, setShowManager] = React.useState(false);
   const [openPopup, setOpenPopup] = React.useState(false);
-  const viewRef = React.useRef<'create' | 'manage'>('create');
+  const viewRef = React.useRef<'/create' | '/manage'>('/create');
 
   const panels: EuiContextMenuPanelDescriptor[] = [
     {
@@ -57,7 +57,7 @@ export const DrilldownsWithEmbeddableExample: React.FC = () => {
           icon: 'plusInCircle',
           onClick: () => {
             setOpenPopup(false);
-            viewRef.current = 'create';
+            viewRef.current = '/create';
             setShowManager((x) => !x);
           },
         },
@@ -66,7 +66,7 @@ export const DrilldownsWithEmbeddableExample: React.FC = () => {
           icon: 'list',
           onClick: () => {
             setOpenPopup(false);
-            viewRef.current = 'manage';
+            viewRef.current = '/manage';
             setShowManager((x) => !x);
           },
         },
@@ -122,12 +122,13 @@ export const DrilldownsWithEmbeddableExample: React.FC = () => {
 
       {showManager && (
         <EuiFlyout onClose={() => setShowManager(false)} aria-labelledby="Drilldown Manager">
-          <plugins.uiActionsEnhanced.FlyoutManageDrilldowns
-            onClose={() => setShowManager(false)}
-            viewMode={viewRef.current}
+          <plugins.uiActionsEnhanced.DrilldownManager
+            key={viewRef.current}
+            initialRoute={viewRef.current}
             dynamicActionManager={managerWithEmbeddable}
             triggers={[VALUE_CLICK_TRIGGER]}
             placeContext={{ embeddable }}
+            onClose={() => setShowManager(false)}
           />
         </EuiFlyout>
       )}
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_example/drilldowns_without_embeddable_example.tsx b/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_example/drilldowns_without_embeddable_example.tsx
index d46c146b499168..a0e1f38543c292 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_example/drilldowns_without_embeddable_example.tsx
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_example/drilldowns_without_embeddable_example.tsx
@@ -32,7 +32,7 @@ export const DrilldownsWithoutEmbeddableExample: React.FC = () => {
   const { plugins, managerWithoutEmbeddable } = useUiActions();
   const [showManager, setShowManager] = React.useState(false);
   const [openPopup, setOpenPopup] = React.useState(false);
-  const viewRef = React.useRef<'create' | 'manage'>('create');
+  const viewRef = React.useRef<'/create' | '/manage'>('/create');
 
   const panels: EuiContextMenuPanelDescriptor[] = [
     {
@@ -43,7 +43,7 @@ export const DrilldownsWithoutEmbeddableExample: React.FC = () => {
           icon: 'plusInCircle',
           onClick: () => {
             setOpenPopup(false);
-            viewRef.current = 'create';
+            viewRef.current = '/create';
             setShowManager((x) => !x);
           },
         },
@@ -52,7 +52,7 @@ export const DrilldownsWithoutEmbeddableExample: React.FC = () => {
           icon: 'list',
           onClick: () => {
             setOpenPopup(false);
-            viewRef.current = 'manage';
+            viewRef.current = '/manage';
             setShowManager((x) => !x);
           },
         },
@@ -116,11 +116,12 @@ export const DrilldownsWithoutEmbeddableExample: React.FC = () => {
 
       {showManager && (
         <EuiFlyout onClose={() => setShowManager(false)} aria-labelledby="Drilldown Manager">
-          <plugins.uiActionsEnhanced.FlyoutManageDrilldowns
-            onClose={() => setShowManager(false)}
-            viewMode={viewRef.current}
+          <plugins.uiActionsEnhanced.DrilldownManager
+            key={viewRef.current}
+            initialRoute={viewRef.current}
             dynamicActionManager={managerWithoutEmbeddable}
             triggers={[SAMPLE_APP1_CLICK_TRIGGER]}
+            onClose={() => setShowManager(false)}
           />
         </EuiFlyout>
       )}
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_single_button_example/drilldowns_without_embeddable_single_button_example.tsx b/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_single_button_example/drilldowns_without_embeddable_single_button_example.tsx
index 7c19b091a8948e..2d877eea7ce1fc 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_single_button_example/drilldowns_without_embeddable_single_button_example.tsx
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/containers/drilldowns_without_embeddable_single_button_example/drilldowns_without_embeddable_single_button_example.tsx
@@ -13,7 +13,6 @@ import { sampleApp2ClickContext, SAMPLE_APP2_CLICK_TRIGGER } from '../../trigger
 export const DrilldownsWithoutEmbeddableSingleButtonExample: React.FC = () => {
   const { plugins, managerWithoutEmbeddableSingleButton } = useUiActions();
   const [showManager, setShowManager] = React.useState(false);
-  const viewRef = React.useRef<'create' | 'manage'>('create');
 
   return (
     <>
@@ -50,11 +49,11 @@ export const DrilldownsWithoutEmbeddableSingleButtonExample: React.FC = () => {
 
       {showManager && (
         <EuiFlyout onClose={() => setShowManager(false)} aria-labelledby="Drilldown Manager">
-          <plugins.uiActionsEnhanced.FlyoutManageDrilldowns
-            onClose={() => setShowManager(false)}
-            viewMode={viewRef.current}
+          <plugins.uiActionsEnhanced.DrilldownManager
+            initialRoute={'/create'}
             dynamicActionManager={managerWithoutEmbeddableSingleButton}
             triggers={[SAMPLE_APP2_CLICK_TRIGGER]}
+            onClose={() => setShowManager(false)}
           />
         </EuiFlyout>
       )}
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts b/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts
index 7ab3b1feb06720..8496450745190b 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/plugin.ts
@@ -86,9 +86,9 @@ export class UiActionsEnhancedExamplesPlugin
         const { core: coreStart, plugins: pluginsStart, self } = start();
         const handle = coreStart.overlays.openFlyout(
           toMountPoint(
-            h(pluginsStart.uiActionsEnhanced.FlyoutManageDrilldowns, {
+            h(pluginsStart.uiActionsEnhanced.DrilldownManager, {
               onClose: () => handle.close(),
-              viewMode: 'create',
+              initialRoute: '/create',
               dynamicActionManager: self.managerWithoutEmbeddableSingleButton,
               triggers: [SAMPLE_APP2_CLICK_TRIGGER],
               placeContext: {},
@@ -111,9 +111,9 @@ export class UiActionsEnhancedExamplesPlugin
         const { core: coreStart, plugins: pluginsStart, self } = start();
         const handle = coreStart.overlays.openFlyout(
           toMountPoint(
-            h(pluginsStart.uiActionsEnhanced.FlyoutManageDrilldowns, {
+            h(pluginsStart.uiActionsEnhanced.DrilldownManager, {
               onClose: () => handle.close(),
-              viewMode: 'manage',
+              initialRoute: '/manage',
               dynamicActionManager: self.managerWithoutEmbeddableSingleButton,
               triggers: [SAMPLE_APP2_CLICK_TRIGGER],
               placeContext: { sampleApp2ClickContext },
diff --git a/x-pack/package.json b/x-pack/package.json
index 36a6d120d946bd..0c0924b51264af 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -27,14 +27,12 @@
     "yarn": "^1.21.1"
   },
   "devDependencies": {
-    "@kbn/babel-preset": "link:../packages/kbn-babel-preset",
     "@kbn/dev-utils": "link:../packages/kbn-dev-utils",
     "@kbn/es": "link:../packages/kbn-es",
     "@kbn/expect": "link:../packages/kbn-expect",
     "@kbn/plugin-helpers": "link:../packages/kbn-plugin-helpers",
     "@kbn/storybook": "link:../packages/kbn-storybook",
-    "@kbn/test": "link:../packages/kbn-test",
-    "@kbn/utility-types": "link:../packages/kbn-utility-types"
+    "@kbn/test": "link:../packages/kbn-test"
   },
   "dependencies": {
     "@elastic/safer-lodash-set": "link:../packages/elastic-safer-lodash-set",
diff --git a/x-pack/plugins/alerting/server/plugin.ts b/x-pack/plugins/alerting/server/plugin.ts
index 787d3cc548ba13..1155cfa93337d7 100644
--- a/x-pack/plugins/alerting/server/plugin.ts
+++ b/x-pack/plugins/alerting/server/plugin.ts
@@ -364,7 +364,7 @@ export class AlertingPlugin {
   }
 
   private createRouteHandlerContext = (
-    core: CoreSetup
+    core: CoreSetup<AlertingPluginsStart, unknown>
   ): IContextProvider<AlertingRequestHandlerContext, 'alerting'> => {
     const { alertTypeRegistry, alertsClientFactory } = this;
     return async function alertsRouteHandlerContext(context, request) {
@@ -376,6 +376,10 @@ export class AlertingPlugin {
         listTypes: alertTypeRegistry!.list.bind(alertTypeRegistry!),
         getFrameworkHealth: async () =>
           await getHealth(savedObjects.createInternalRepository(['alert'])),
+        areApiKeysEnabled: async () => {
+          const [, { security }] = await core.getStartServices();
+          return security?.authc.apiKeys.areAPIKeysEnabled() ?? false;
+        },
       };
     };
   };
diff --git a/x-pack/plugins/alerting/server/routes/_mock_handler_arguments.ts b/x-pack/plugins/alerting/server/routes/_mock_handler_arguments.ts
index cd1c32a9b2d8f0..7bab31fa4c89ac 100644
--- a/x-pack/plugins/alerting/server/routes/_mock_handler_arguments.ts
+++ b/x-pack/plugins/alerting/server/routes/_mock_handler_arguments.ts
@@ -8,26 +8,23 @@
 import { KibanaRequest, KibanaResponseFactory } from 'kibana/server';
 import { identity } from 'lodash';
 import type { MethodKeysOf } from '@kbn/utility-types';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { ScopedClusterClientMock } from '../../../../../src/core/server/elasticsearch/client/mocks';
 import { httpServerMock } from '../../../../../src/core/server/mocks';
 import { alertsClientMock, AlertsClientMock } from '../alerts_client.mock';
 import { AlertsHealth, AlertType } from '../../common';
-import { elasticsearchServiceMock } from '../../../../../src/core/server/mocks';
 import type { AlertingRequestHandlerContext } from '../types';
 
 export function mockHandlerArguments(
   {
     alertsClient = alertsClientMock.create(),
     listTypes: listTypesRes = [],
-    esClient = elasticsearchServiceMock.createScopedClusterClient(),
     getFrameworkHealth,
+    areApiKeysEnabled,
   }: {
     alertsClient?: AlertsClientMock;
     listTypes?: AlertType[];
-    esClient?: jest.Mocked<ScopedClusterClientMock>;
     getFrameworkHealth?: jest.MockInstance<Promise<AlertsHealth>, []> &
       (() => Promise<AlertsHealth>);
+    areApiKeysEnabled?: () => Promise<boolean>;
   },
   req: unknown,
   res?: Array<MethodKeysOf<KibanaResponseFactory>>
@@ -39,13 +36,13 @@ export function mockHandlerArguments(
   const listTypes = jest.fn(() => listTypesRes);
   return [
     ({
-      core: { elasticsearch: { client: esClient } },
       alerting: {
         listTypes,
         getAlertsClient() {
           return alertsClient || alertsClientMock.create();
         },
         getFrameworkHealth,
+        areApiKeysEnabled: areApiKeysEnabled ? areApiKeysEnabled : () => Promise.resolve(true),
       },
     } as unknown) as AlertingRequestHandlerContext,
     req as KibanaRequest<unknown, unknown, unknown>,
diff --git a/x-pack/plugins/alerting/server/routes/health.test.ts b/x-pack/plugins/alerting/server/routes/health.test.ts
index be63e0b7054be2..40ad2721e816e7 100644
--- a/x-pack/plugins/alerting/server/routes/health.test.ts
+++ b/x-pack/plugins/alerting/server/routes/health.test.ts
@@ -8,15 +8,12 @@
 import { healthRoute } from './health';
 import { httpServiceMock } from 'src/core/server/mocks';
 import { mockHandlerArguments } from './_mock_handler_arguments';
-import { elasticsearchServiceMock } from '../../../../../src/core/server/mocks';
 import { verifyApiAccess } from '../lib/license_api_access';
 import { licenseStateMock } from '../lib/license_state.mock';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/mocks';
 import { alertsClientMock } from '../alerts_client.mock';
 import { HealthStatus } from '../types';
 import { alertsMock } from '../mocks';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { elasticsearchClientMock } from '../../../../../src/core/server/elasticsearch/client/mocks';
 const alertsClient = alertsClientMock.create();
 
 jest.mock('../lib/license_api_access.ts', () => ({
@@ -65,25 +62,11 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({})
-    );
-
-    const [context, req, res] = mockHandlerArguments({ esClient, alertsClient }, {}, ['ok']);
+    const [context, req, res] = mockHandlerArguments({ alertsClient }, {}, ['ok']);
 
     await handler(context, req, res);
 
     expect(verifyApiAccess).toHaveBeenCalledWith(licenseState);
-
-    expect(esClient.asInternalUser.transport.request.mock.calls[0]).toMatchInlineSnapshot(`
-      Array [
-        Object {
-          "method": "GET",
-          "path": "/_xpack/usage",
-        },
-      ]
-    `);
   });
 
   it('evaluates whether Encrypted Saved Objects is missing encryption key', async () => {
@@ -94,13 +77,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({})
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
@@ -135,13 +113,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({})
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
@@ -176,13 +149,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({ security: {} })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
@@ -217,13 +185,12 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({ security: { enabled: true } })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      {
+        alertsClient,
+        getFrameworkHealth: alerting.getFrameworkHealth,
+        areApiKeysEnabled: () => Promise.resolve(false),
+      },
       {},
       ['ok']
     );
@@ -258,15 +225,12 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({
-        security: { enabled: true, ssl: {} },
-      })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      {
+        alertsClient,
+        getFrameworkHealth: alerting.getFrameworkHealth,
+        areApiKeysEnabled: () => Promise.resolve(false),
+      },
       {},
       ['ok']
     );
@@ -301,15 +265,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchClientMock.createSuccessTransportRequestPromise({
-        security: { enabled: true, ssl: { http: { enabled: true } } },
-      })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
diff --git a/x-pack/plugins/alerting/server/routes/health.ts b/x-pack/plugins/alerting/server/routes/health.ts
index c2a122a28fa490..96016ccc454723 100644
--- a/x-pack/plugins/alerting/server/routes/health.ts
+++ b/x-pack/plugins/alerting/server/routes/health.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { ApiResponse } from '@elastic/elasticsearch';
 import { IRouter } from 'kibana/server';
 import { ILicenseState } from '../lib';
 import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
@@ -16,17 +15,6 @@ import {
   AlertingFrameworkHealth,
 } from '../types';
 
-interface XPackUsageSecurity {
-  security?: {
-    enabled?: boolean;
-    ssl?: {
-      http?: {
-        enabled?: boolean;
-      };
-    };
-  };
-}
-
 const rewriteBodyRes: RewriteResponseCase<AlertingFrameworkHealth> = ({
   isSufficientlySecure,
   hasPermanentEncryptionKey,
@@ -56,23 +44,11 @@ export const healthRoute = (
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {
         try {
-          const {
-            body: {
-              security: {
-                enabled: isSecurityEnabled = false,
-                ssl: { http: { enabled: isTLSEnabled = false } = {} } = {},
-              } = {},
-            },
-          }: ApiResponse<XPackUsageSecurity> = await context.core.elasticsearch.client.asInternalUser.transport // Do not augment with such input. // `transport.request` is potentially unsafe when combined with untrusted user input.
-            .request({
-              method: 'GET',
-              path: '/_xpack/usage',
-            });
-
+          const areApiKeysEnabled = await context.alerting.areApiKeysEnabled();
           const alertingFrameworkHeath = await context.alerting.getFrameworkHealth();
 
           const frameworkHealth: AlertingFrameworkHealth = {
-            isSufficientlySecure: !isSecurityEnabled || (isSecurityEnabled && isTLSEnabled),
+            isSufficientlySecure: areApiKeysEnabled,
             hasPermanentEncryptionKey: encryptedSavedObjects.canEncrypt,
             alertingFrameworkHeath,
           };
diff --git a/x-pack/plugins/alerting/server/routes/legacy/health.test.ts b/x-pack/plugins/alerting/server/routes/legacy/health.test.ts
index 74de5f70a32e77..bc60eae34e0ce6 100644
--- a/x-pack/plugins/alerting/server/routes/legacy/health.test.ts
+++ b/x-pack/plugins/alerting/server/routes/legacy/health.test.ts
@@ -8,8 +8,6 @@
 import { healthRoute } from './health';
 import { httpServiceMock } from 'src/core/server/mocks';
 import { mockHandlerArguments } from './../_mock_handler_arguments';
-import { elasticsearchServiceMock } from '../../../../../../src/core/server/mocks';
-import { verifyApiAccess } from '../../lib/license_api_access';
 import { licenseStateMock } from '../../lib/license_state.mock';
 import { encryptedSavedObjectsMock } from '../../../../encrypted_saved_objects/server/mocks';
 import { alertsClientMock } from '../../alerts_client.mock';
@@ -55,35 +53,6 @@ describe('healthRoute', () => {
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/_health"`);
   });
 
-  it('queries the usage api', async () => {
-    const router = httpServiceMock.createRouter();
-
-    const licenseState = licenseStateMock.create();
-    const encryptedSavedObjects = encryptedSavedObjectsMock.createSetup({ canEncrypt: true });
-    healthRoute(router, licenseState, encryptedSavedObjects);
-    const [, handler] = router.get.mock.calls[0];
-
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({})
-    );
-
-    const [context, req, res] = mockHandlerArguments({ esClient, alertsClient }, {}, ['ok']);
-
-    await handler(context, req, res);
-
-    expect(verifyApiAccess).toHaveBeenCalledWith(licenseState);
-
-    expect(esClient.asInternalUser.transport.request.mock.calls[0]).toMatchInlineSnapshot(`
-      Array [
-        Object {
-          "method": "GET",
-          "path": "/_xpack/usage",
-        },
-      ]
-    `);
-  });
-
   it('evaluates whether Encrypted Saved Objects is missing encryption key', async () => {
     const router = httpServiceMock.createRouter();
 
@@ -92,13 +61,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({})
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
@@ -133,13 +97,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({})
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
@@ -174,13 +133,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({})
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
@@ -215,13 +169,12 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({ security: { enabled: true } })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      {
+        alertsClient,
+        getFrameworkHealth: alerting.getFrameworkHealth,
+        areApiKeysEnabled: () => Promise.resolve(false),
+      },
       {},
       ['ok']
     );
@@ -256,15 +209,12 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({
-        security: { enabled: true, ssl: {} },
-      })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      {
+        alertsClient,
+        getFrameworkHealth: alerting.getFrameworkHealth,
+        areApiKeysEnabled: () => Promise.resolve(false),
+      },
       {},
       ['ok']
     );
@@ -299,15 +249,8 @@ describe('healthRoute', () => {
     healthRoute(router, licenseState, encryptedSavedObjects);
     const [, handler] = router.get.mock.calls[0];
 
-    const esClient = elasticsearchServiceMock.createScopedClusterClient();
-    esClient.asInternalUser.transport.request.mockReturnValue(
-      elasticsearchServiceMock.createSuccessTransportRequestPromise({
-        security: { enabled: true, ssl: { http: { enabled: true } } },
-      })
-    );
-
     const [context, req, res] = mockHandlerArguments(
-      { esClient, alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
+      { alertsClient, getFrameworkHealth: alerting.getFrameworkHealth },
       {},
       ['ok']
     );
diff --git a/x-pack/plugins/alerting/server/routes/legacy/health.ts b/x-pack/plugins/alerting/server/routes/legacy/health.ts
index b9906a56ce9724..206a74c2ea6361 100644
--- a/x-pack/plugins/alerting/server/routes/legacy/health.ts
+++ b/x-pack/plugins/alerting/server/routes/legacy/health.ts
@@ -5,24 +5,12 @@
  * 2.0.
  */
 
-import { ApiResponse } from '@elastic/elasticsearch';
 import type { AlertingRouter } from '../../types';
 import { ILicenseState } from '../../lib/license_state';
 import { verifyApiAccess } from '../../lib/license_api_access';
 import { AlertingFrameworkHealth } from '../../types';
 import { EncryptedSavedObjectsPluginSetup } from '../../../../encrypted_saved_objects/server';
 
-interface XPackUsageSecurity {
-  security?: {
-    enabled?: boolean;
-    ssl?: {
-      http?: {
-        enabled?: boolean;
-      };
-    };
-  };
-}
-
 export function healthRoute(
   router: AlertingRouter,
   licenseState: ILicenseState,
@@ -39,23 +27,11 @@ export function healthRoute(
         return res.badRequest({ body: 'RouteHandlerContext is not registered for alerting' });
       }
       try {
-        const {
-          body: {
-            security: {
-              enabled: isSecurityEnabled = false,
-              ssl: { http: { enabled: isTLSEnabled = false } = {} } = {},
-            } = {},
-          },
-        }: ApiResponse<XPackUsageSecurity> = await context.core.elasticsearch.client.asInternalUser.transport // Do not augment with such input. // `transport.request` is potentially unsafe when combined with untrusted user input.
-          .request({
-            method: 'GET',
-            path: '/_xpack/usage',
-          });
-
         const alertingFrameworkHeath = await context.alerting.getFrameworkHealth();
+        const areApiKeysEnabled = await context.alerting.areApiKeysEnabled();
 
         const frameworkHealth: AlertingFrameworkHealth = {
-          isSufficientlySecure: !isSecurityEnabled || (isSecurityEnabled && isTLSEnabled),
+          isSufficientlySecure: areApiKeysEnabled,
           hasPermanentEncryptionKey: encryptedSavedObjects.canEncrypt,
           alertingFrameworkHeath,
         };
diff --git a/x-pack/plugins/alerting/server/types.ts b/x-pack/plugins/alerting/server/types.ts
index 23aed1070a31a7..dea5d7ddcc8846 100644
--- a/x-pack/plugins/alerting/server/types.ts
+++ b/x-pack/plugins/alerting/server/types.ts
@@ -46,6 +46,7 @@ export interface AlertingApiRequestHandlerContext {
   getAlertsClient: () => AlertsClient;
   listTypes: AlertTypeRegistry['list'];
   getFrameworkHealth: () => Promise<AlertsHealth>;
+  areApiKeysEnabled: () => Promise<boolean>;
 }
 
 /**
diff --git a/x-pack/plugins/apm/common/alert_types.ts b/x-pack/plugins/apm/common/alert_types.ts
index 62bd07ce6f500b..12df93d54b2964 100644
--- a/x-pack/plugins/apm/common/alert_types.ts
+++ b/x-pack/plugins/apm/common/alert_types.ts
@@ -6,9 +6,9 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { ValuesType } from 'utility-types';
-import { ActionGroup } from '../../alerting/common';
-import { ANOMALY_SEVERITY, ANOMALY_THRESHOLD } from '../../ml/common';
+import type { ValuesType } from 'utility-types';
+import type { ActionGroup } from '../../alerting/common';
+import { ANOMALY_SEVERITY, ANOMALY_THRESHOLD } from './ml_constants';
 
 export enum AlertType {
   ErrorCount = 'apm.error_rate', // ErrorRate was renamed to ErrorCount but the key is kept as `error_rate` for backwards-compat.
diff --git a/x-pack/plugins/apm/common/anomaly_detection.ts b/x-pack/plugins/apm/common/anomaly_detection.ts
index b9cc3de8bb5d0a..43a779407d2a49 100644
--- a/x-pack/plugins/apm/common/anomaly_detection.ts
+++ b/x-pack/plugins/apm/common/anomaly_detection.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { ANOMALY_SEVERITY } from '../../ml/common';
+import { ANOMALY_SEVERITY } from './ml_constants';
 import {
   getSeverityType,
   getSeverityColor as mlGetSeverityColor,
diff --git a/x-pack/plugins/apm/common/ml_constants.ts b/x-pack/plugins/apm/common/ml_constants.ts
new file mode 100644
index 00000000000000..7818299d9d883a
--- /dev/null
+++ b/x-pack/plugins/apm/common/ml_constants.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// copied from ml/common, to keep the bundle size small
+export enum ANOMALY_SEVERITY {
+  CRITICAL = 'critical',
+  MAJOR = 'major',
+  MINOR = 'minor',
+  WARNING = 'warning',
+  LOW = 'low',
+  UNKNOWN = 'unknown',
+}
+
+export enum ANOMALY_THRESHOLD {
+  CRITICAL = 75,
+  MAJOR = 50,
+  MINOR = 25,
+  WARNING = 3,
+  LOW = 0,
+}
diff --git a/x-pack/plugins/apm/common/rules.ts b/x-pack/plugins/apm/common/rules.ts
deleted file mode 100644
index a3b60a785f5c7f..00000000000000
--- a/x-pack/plugins/apm/common/rules.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-const plainApmRuleRegistrySettings = {
-  name: 'apm',
-  fieldMap: {
-    'service.environment': {
-      type: 'keyword',
-    },
-    'transaction.type': {
-      type: 'keyword',
-    },
-    'processor.event': {
-      type: 'keyword',
-    },
-  },
-} as const;
-
-type APMRuleRegistrySettings = typeof plainApmRuleRegistrySettings;
-
-export const apmRuleRegistrySettings: APMRuleRegistrySettings = plainApmRuleRegistrySettings;
diff --git a/x-pack/plugins/security_solution/common/graphql/root/schema.gql.ts b/x-pack/plugins/apm/common/rules/apm_rule_field_map.ts
similarity index 50%
rename from x-pack/plugins/security_solution/common/graphql/root/schema.gql.ts
rename to x-pack/plugins/apm/common/rules/apm_rule_field_map.ts
index 16fdeb7ec6c758..9bbd9381c2319a 100644
--- a/x-pack/plugins/security_solution/common/graphql/root/schema.gql.ts
+++ b/x-pack/plugins/apm/common/rules/apm_rule_field_map.ts
@@ -5,15 +5,16 @@
  * 2.0.
  */
 
-import gql from 'graphql-tag';
+export const apmRuleFieldMap = {
+  'service.environment': {
+    type: 'keyword',
+  },
+  'transaction.type': {
+    type: 'keyword',
+  },
+  'processor.event': {
+    type: 'keyword',
+  },
+} as const;
 
-export const rootSchema = gql`
-  schema {
-    query: Query
-    mutation: Mutation
-  }
-
-  type Query
-
-  type Mutation
-`;
+export type APMRuleFieldMap = typeof apmRuleFieldMap;
diff --git a/x-pack/plugins/apm/common/rules/apm_rule_registry_settings.ts b/x-pack/plugins/apm/common/rules/apm_rule_registry_settings.ts
new file mode 100644
index 00000000000000..1257db4e6a4d34
--- /dev/null
+++ b/x-pack/plugins/apm/common/rules/apm_rule_registry_settings.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const apmRuleRegistrySettings = {
+  name: 'apm',
+};
diff --git a/x-pack/plugins/apm/common/service_health_status.ts b/x-pack/plugins/apm/common/service_health_status.ts
index 71c373a48c9d5f..b5318f9333e4f2 100644
--- a/x-pack/plugins/apm/common/service_health_status.ts
+++ b/x-pack/plugins/apm/common/service_health_status.ts
@@ -7,7 +7,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { EuiTheme } from '../../../../src/plugins/kibana_react/common';
-import { ANOMALY_SEVERITY } from '../../ml/common';
+import { ANOMALY_SEVERITY } from './ml_constants';
 
 export enum ServiceHealthStatus {
   healthy = 'healthy',
diff --git a/x-pack/plugins/apm/public/application/application.test.tsx b/x-pack/plugins/apm/public/application/application.test.tsx
index 7df6ca343426ce..e6415f76c60dc6 100644
--- a/x-pack/plugins/apm/public/application/application.test.tsx
+++ b/x-pack/plugins/apm/public/application/application.test.tsx
@@ -8,9 +8,8 @@
 import { act } from '@testing-library/react';
 import { createMemoryHistory } from 'history';
 import { Observable } from 'rxjs';
-import { AppMountParameters, CoreStart } from 'src/core/public';
+import { CoreStart } from 'src/core/public';
 import { mockApmPluginContextValue } from '../context/apm_plugin/mock_apm_plugin_context';
-import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { renderApp } from './';
 import { disableConsoleWarning } from '../utils/testHelpers';
@@ -40,7 +39,7 @@ describe('renderApp', () => {
   });
 
   it('renders the app', () => {
-    const { core, config } = mockApmPluginContextValue;
+    const { core, config, apmRuleRegistry } = mockApmPluginContextValue;
     const plugins = {
       licensing: { license$: new Observable() },
       triggersActionsUi: { actionTypeRegistry: {}, alertTypeRegistry: {} },
@@ -87,13 +86,14 @@ describe('renderApp', () => {
     let unmount: () => void;
 
     act(() => {
-      unmount = renderApp(
-        (core as unknown) as CoreStart,
-        (plugins as unknown) as ApmPluginSetupDeps,
-        (params as unknown) as AppMountParameters,
+      unmount = renderApp({
+        coreStart: core as any,
+        pluginsSetup: plugins as any,
+        appMountParameters: params as any,
+        pluginsStart: startDeps as any,
         config,
-        (startDeps as unknown) as ApmPluginStartDeps
-      );
+        apmRuleRegistry,
+      });
     });
 
     expect(() => {
diff --git a/x-pack/plugins/apm/public/application/csmApp.tsx b/x-pack/plugins/apm/public/application/csmApp.tsx
index 787b15d0a5675e..b1cfd59a37cec3 100644
--- a/x-pack/plugins/apm/public/application/csmApp.tsx
+++ b/x-pack/plugins/apm/public/application/csmApp.tsx
@@ -26,7 +26,11 @@ import { ApmPluginContext } from '../context/apm_plugin/apm_plugin_context';
 import { UrlParamsProvider } from '../context/url_params_context/url_params_context';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
 import { ConfigSchema } from '../index';
-import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
+import {
+  ApmPluginSetupDeps,
+  ApmPluginStartDeps,
+  ApmRuleRegistry,
+} from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { px, units } from '../style/variables';
 import { createStaticIndexPattern } from '../services/rest/index_pattern';
@@ -72,12 +76,14 @@ export function CsmAppRoot({
   deps,
   config,
   corePlugins: { embeddable, maps },
+  apmRuleRegistry,
 }: {
   appMountParameters: AppMountParameters;
   core: CoreStart;
   deps: ApmPluginSetupDeps;
   config: ConfigSchema;
   corePlugins: ApmPluginStartDeps;
+  apmRuleRegistry: ApmRuleRegistry;
 }) {
   const { history } = appMountParameters;
   const i18nCore = core.i18n;
@@ -87,7 +93,9 @@ export function CsmAppRoot({
     config,
     core,
     plugins,
+    apmRuleRegistry,
   };
+
   return (
     <RedirectAppLinks application={core.application}>
       <ApmPluginContext.Provider value={apmPluginContextValue}>
@@ -109,13 +117,21 @@ export function CsmAppRoot({
  * This module is rendered asynchronously in the Kibana platform.
  */
 
-export const renderApp = (
-  core: CoreStart,
-  deps: ApmPluginSetupDeps,
-  appMountParameters: AppMountParameters,
-  config: ConfigSchema,
-  corePlugins: ApmPluginStartDeps
-) => {
+export const renderApp = ({
+  core,
+  deps,
+  appMountParameters,
+  config,
+  corePlugins,
+  apmRuleRegistry,
+}: {
+  core: CoreStart;
+  deps: ApmPluginSetupDeps;
+  appMountParameters: AppMountParameters;
+  config: ConfigSchema;
+  corePlugins: ApmPluginStartDeps;
+  apmRuleRegistry: ApmRuleRegistry;
+}) => {
   const { element } = appMountParameters;
 
   createCallApmApi(core);
@@ -133,6 +149,7 @@ export const renderApp = (
       deps={deps}
       config={config}
       corePlugins={corePlugins}
+      apmRuleRegistry={apmRuleRegistry}
     />,
     element
   );
diff --git a/x-pack/plugins/apm/public/application/index.tsx b/x-pack/plugins/apm/public/application/index.tsx
index bc14bc15316867..acb55a02599f19 100644
--- a/x-pack/plugins/apm/public/application/index.tsx
+++ b/x-pack/plugins/apm/public/application/index.tsx
@@ -30,7 +30,11 @@ import {
 import { LicenseProvider } from '../context/license/license_context';
 import { UrlParamsProvider } from '../context/url_params_context/url_params_context';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
-import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
+import {
+  ApmPluginSetupDeps,
+  ApmPluginStartDeps,
+  ApmRuleRegistry,
+} from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { createStaticIndexPattern } from '../services/rest/index_pattern';
 import { setHelpExtension } from '../setHelpExtension';
@@ -102,25 +106,34 @@ export function ApmAppRoot({
  * This module is rendered asynchronously in the Kibana platform.
  */
 
-export const renderApp = (
-  core: CoreStart,
-  setupDeps: ApmPluginSetupDeps,
-  appMountParameters: AppMountParameters,
-  config: ConfigSchema,
-  startDeps: ApmPluginStartDeps
-) => {
+export const renderApp = ({
+  coreStart,
+  pluginsSetup,
+  appMountParameters,
+  config,
+  pluginsStart,
+  apmRuleRegistry,
+}: {
+  coreStart: CoreStart;
+  pluginsSetup: ApmPluginSetupDeps;
+  appMountParameters: AppMountParameters;
+  config: ConfigSchema;
+  pluginsStart: ApmPluginStartDeps;
+  apmRuleRegistry: ApmRuleRegistry;
+}) => {
   const { element } = appMountParameters;
   const apmPluginContextValue = {
     appMountParameters,
     config,
-    core,
-    plugins: setupDeps,
+    core: coreStart,
+    plugins: pluginsSetup,
+    apmRuleRegistry,
   };
 
   // render APM feedback link in global help menu
-  setHelpExtension(core);
-  setReadonlyBadge(core);
-  createCallApmApi(core);
+  setHelpExtension(coreStart);
+  setReadonlyBadge(coreStart);
+  createCallApmApi(coreStart);
 
   // Automatically creates static index pattern and stores as saved object
   createStaticIndexPattern().catch((e) => {
@@ -131,7 +144,7 @@ export const renderApp = (
   ReactDOM.render(
     <ApmAppRoot
       apmPluginContextValue={apmPluginContextValue}
-      startDeps={startDeps}
+      startDeps={pluginsStart}
     />,
     element
   );
diff --git a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
index 8834cbc70e0b1a..98c8b99411bc3d 100644
--- a/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
+++ b/x-pack/plugins/apm/public/components/alerting/register_apm_alerts.ts
@@ -7,11 +7,20 @@
 
 import { i18n } from '@kbn/i18n';
 import { lazy } from 'react';
-import { format } from 'url';
+import { stringify } from 'querystring';
 import { ENVIRONMENT_ALL } from '../../../common/environment_filter_values';
-import { asDuration, asPercent } from '../../../common/utils/formatters';
 import { AlertType } from '../../../common/alert_types';
-import { ApmRuleRegistry } from '../../plugin';
+import type { ApmRuleRegistry } from '../../plugin';
+
+const format = ({
+  pathname,
+  query,
+}: {
+  pathname: string;
+  query: Record<string, any>;
+}): string => {
+  return `${pathname}?${stringify(query)}`;
+};
 
 export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
   apmRuleRegistry.registerType({
@@ -31,7 +40,7 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
           },
         }),
         link: format({
-          pathname: `/app/apm/services/${alert['service.name']!}`,
+          pathname: `/app/apm/services/${alert['service.name']!}/errors`,
           query: {
             ...(alert['service.environment']
               ? { environment: alert['service.environment'] }
@@ -71,7 +80,7 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
           'Alert when the latency of a specific transaction type in a service exceeds a defined threshold.',
       }
     ),
-    format: ({ alert }) => ({
+    format: ({ alert, formatters: { asDuration } }) => ({
       reason: i18n.translate(
         'xpack.apm.alertTypes.transactionDuration.reason',
         {
@@ -131,7 +140,7 @@ export function registerApmAlerts(apmRuleRegistry: ApmRuleRegistry) {
           'Alert when the rate of transaction errors in a service exceeds a defined threshold.',
       }
     ),
-    format: ({ alert }) => ({
+    format: ({ alert, formatters: { asPercent } }) => ({
       reason: i18n.translate(
         'xpack.apm.alertTypes.transactionErrorRate.reason',
         {
diff --git a/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx b/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx
index 62926796cafb4b..10d139f6ccea3d 100644
--- a/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/index.tsx
@@ -8,7 +8,7 @@
 import { useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
-import { ANOMALY_SEVERITY } from '../../../../../ml/common';
+import { ANOMALY_SEVERITY } from '../../../../common/ml_constants';
 import { useEnvironmentsFetcher } from '../../../hooks/use_environments_fetcher';
 import { useUrlParams } from '../../../context/url_params_context/use_url_params';
 import { ServiceAlertTrigger } from '../service_alert_trigger';
diff --git a/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/select_anomaly_severity.test.tsx b/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/select_anomaly_severity.test.tsx
index 85f48ae151e104..7b56eaa4721deb 100644
--- a/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/select_anomaly_severity.test.tsx
+++ b/x-pack/plugins/apm/public/components/alerting/transaction_duration_anomaly_alert_trigger/select_anomaly_severity.test.tsx
@@ -8,7 +8,7 @@
 import { render } from '@testing-library/react';
 import React, { ReactNode } from 'react';
 import { IntlProvider } from 'react-intl';
-import { ANOMALY_SEVERITY } from '../../../../../ml/common';
+import { ANOMALY_SEVERITY } from '../../../../common/ml_constants';
 import { SelectAnomalySeverity } from './select_anomaly_severity';
 
 function Wrapper({ children }: { children?: ReactNode }) {
diff --git a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
index a0bcfe60e72b59..19a567a3866bdd 100644
--- a/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ErrorGroupDetails/Distribution/index.tsx
@@ -19,9 +19,12 @@ import {
 import { EuiTitle } from '@elastic/eui';
 import d3 from 'd3';
 import React from 'react';
+import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { asRelativeDateTimeRange } from '../../../../../common/utils/formatters';
 import { useTheme } from '../../../../hooks/use_theme';
+import { AlertType } from '../../../../../common/alert_types';
+import { getAlertAnnotations } from '../../../shared/charts/helper/get_alert_annotations';
 
 type ErrorDistributionAPIResponse = APIReturnType<'GET /api/apm/services/{serviceName}/errors/distribution'>;
 
@@ -61,6 +64,8 @@ export function ErrorDistribution({ distribution, title }: Props) {
 
   const xFormatter = niceTimeFormatter([xMin, xMax]);
 
+  const { alerts } = useApmServiceContext();
+
   const tooltipProps: SettingsSpec['tooltip'] = {
     headerFormatter: (tooltip: TooltipValue) => {
       const serie = buckets.find((bucket) => bucket.x0 === tooltip.value);
@@ -108,6 +113,12 @@ export function ErrorDistribution({ distribution, title }: Props) {
             data={buckets}
             color={theme.eui.euiColorVis1}
           />
+          {getAlertAnnotations({
+            alerts: alerts?.filter(
+              (alert) => alert['rule.id'] === AlertType.ErrorCount
+            ),
+            theme,
+          })}
         </Chart>
       </div>
     </div>
diff --git a/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap b/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap
index 5094287a402ea0..b1bcf561bed848 100644
--- a/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap
+++ b/x-pack/plugins/apm/public/components/app/Home/__snapshots__/Home.test.tsx.snap
@@ -4,6 +4,10 @@ exports[`Home component should render services 1`] = `
 <ContextProvider
   value={
     Object {
+      "apmRuleRegistry": Object {
+        "getTypeByRuleId": [Function],
+        "registerType": [Function],
+      },
       "appMountParameters": Object {
         "setHeaderActionMenu": [Function],
       },
@@ -78,6 +82,9 @@ exports[`Home component should render services 1`] = `
             },
           },
         },
+        "observability": Object {
+          "isAlertingExperienceEnabled": [Function],
+        },
       },
     }
   }
@@ -92,6 +99,10 @@ exports[`Home component should render traces 1`] = `
 <ContextProvider
   value={
     Object {
+      "apmRuleRegistry": Object {
+        "getTypeByRuleId": [Function],
+        "registerType": [Function],
+      },
       "appMountParameters": Object {
         "setHeaderActionMenu": [Function],
       },
@@ -166,6 +177,9 @@ exports[`Home component should render traces 1`] = `
             },
           },
         },
+        "observability": Object {
+          "isAlertingExperienceEnabled": [Function],
+        },
       },
     }
   }
diff --git a/x-pack/plugins/apm/public/components/app/Main/route_config/index.tsx b/x-pack/plugins/apm/public/components/app/Main/route_config/index.tsx
index 0ed9c5c919ddb1..9410fd00411e38 100644
--- a/x-pack/plugins/apm/public/components/app/Main/route_config/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/Main/route_config/index.tsx
@@ -173,6 +173,7 @@ export const routes: APMRouteDefinition[] = [
     render: renderAsRedirectTo('/services'),
     breadcrumb: 'APM',
   },
+  // !! Need to be kept in sync with the searchDeepLinks in x-pack/plugins/apm/public/plugin.ts
   {
     exact: true,
     path: '/services',
@@ -181,6 +182,7 @@ export const routes: APMRouteDefinition[] = [
       defaultMessage: 'Services',
     }),
   },
+  // !! Need to be kept in sync with the searchDeepLinks in x-pack/plugins/apm/public/plugin.ts
   {
     exact: true,
     path: '/traces',
@@ -326,6 +328,7 @@ export const routes: APMRouteDefinition[] = [
     component: TraceLink,
     breadcrumb: null,
   },
+  // !! Need to be kept in sync with the searchDeepLinks in x-pack/plugins/apm/public/plugin.ts
   {
     exact: true,
     path: '/service-map',
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/ResetPercentileZoom.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/ResetPercentileZoom.tsx
index 0dd59654f477d8..96b0198a870a50 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/ResetPercentileZoom.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/ResetPercentileZoom.tsx
@@ -11,6 +11,7 @@ import {
   EuiHideFor,
   EuiShowFor,
   EuiButtonIcon,
+  EuiFlexItem,
 } from '@elastic/eui';
 import { I18LABELS } from '../translations';
 import { PercentileRange } from './index';
@@ -28,27 +29,21 @@ export function ResetPercentileZoom({
   const onClick = () => {
     setPercentileRange({ min: null, max: null });
   };
-  return (
-    <>
+  return !isDisabled ? (
+    <EuiFlexItem grow={false}>
       <EuiShowFor sizes={['xs']}>
         <EuiButtonIcon
           iconType="inspect"
           size="s"
           aria-label={I18LABELS.resetZoom}
           onClick={onClick}
-          disabled={isDisabled}
         />
       </EuiShowFor>
       <EuiHideFor sizes={['xs']}>
-        <EuiButtonEmpty
-          iconType="inspect"
-          size="s"
-          onClick={onClick}
-          disabled={isDisabled}
-        >
+        <EuiButtonEmpty iconType="inspect" size="s" onClick={onClick}>
           {I18LABELS.resetZoom}
         </EuiButtonEmpty>
       </EuiHideFor>
-    </>
-  );
+    </EuiFlexItem>
+  ) : null;
 }
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
index 050d3b54a200f4..b2e8ca5fda805d 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
@@ -6,7 +6,14 @@
  */
 
 import React, { useState } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
+import {
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { I18LABELS } from '../translations';
@@ -14,6 +21,8 @@ import { BreakdownFilter } from '../Breakdowns/BreakdownFilter';
 import { PageLoadDistChart } from '../Charts/PageLoadDistChart';
 import { BreakdownItem } from '../../../../../typings/ui_filters';
 import { ResetPercentileZoom } from './ResetPercentileZoom';
+import { createExploratoryViewUrl } from '../../../../../../observability/public';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
 
 export interface PercentileRange {
   min?: number | null;
@@ -21,9 +30,15 @@ export interface PercentileRange {
 }
 
 export function PageLoadDistribution() {
+  const {
+    services: { http },
+  } = useKibana();
+
   const { urlParams, uiFilters } = useUrlParams();
 
-  const { start, end, searchTerm } = urlParams;
+  const { start, end, rangeFrom, rangeTo, searchTerm } = urlParams;
+
+  const { serviceName } = uiFilters;
 
   const [percentileRange, setPercentileRange] = useState<PercentileRange>({
     min: null,
@@ -34,8 +49,6 @@ export function PageLoadDistribution() {
 
   const { data, status } = useFetcher(
     (callApmApi) => {
-      const { serviceName } = uiFilters;
-
       if (start && end && serviceName) {
         return callApmApi({
           endpoint: 'GET /api/apm/rum-client/page-load-distribution',
@@ -64,6 +77,7 @@ export function PageLoadDistribution() {
       percentileRange.min,
       percentileRange.max,
       searchTerm,
+      serviceName,
     ]
   );
 
@@ -71,6 +85,20 @@ export function PageLoadDistribution() {
     setPercentileRange({ min, max });
   };
 
+  const exploratoryViewLink = createExploratoryViewUrl(
+    {
+      [`${serviceName}-page-views`]: {
+        reportType: 'pld',
+        time: { from: rangeFrom!, to: rangeTo! },
+        reportDefinitions: {
+          'service.name': serviceName?.[0] as string,
+        },
+        ...(breakdown ? { breakdown: breakdown.fieldName } : {}),
+      },
+    },
+    http?.basePath.get()
+  );
+
   return (
     <div data-cy="pageLoadDist">
       <EuiFlexGroup responsive={false}>
@@ -79,12 +107,10 @@ export function PageLoadDistribution() {
             <h3>{I18LABELS.pageLoadDistribution}</h3>
           </EuiTitle>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <ResetPercentileZoom
-            percentileRange={percentileRange}
-            setPercentileRange={setPercentileRange}
-          />
-        </EuiFlexItem>
+        <ResetPercentileZoom
+          percentileRange={percentileRange}
+          setPercentileRange={setPercentileRange}
+        />
         <EuiFlexItem grow={false} style={{ width: 170 }}>
           <BreakdownFilter
             selectedBreakdown={breakdown}
@@ -92,6 +118,18 @@ export function PageLoadDistribution() {
             dataTestSubj={'pldBreakdownFilter'}
           />
         </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiButton
+            size="s"
+            isDisabled={!serviceName?.[0]}
+            href={exploratoryViewLink}
+          >
+            <FormattedMessage
+              id="xpack.apm.csm.pageViews.analyze"
+              defaultMessage="Analyze"
+            />
+          </EuiButton>
+        </EuiFlexItem>
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <PageLoadDistChart
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
index 85df933bcb9e29..52668cf712b8c8 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
@@ -6,25 +6,37 @@
  */
 
 import React, { useState } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
+import {
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { I18LABELS } from '../translations';
 import { BreakdownFilter } from '../Breakdowns/BreakdownFilter';
 import { PageViewsChart } from '../Charts/PageViewsChart';
 import { BreakdownItem } from '../../../../../typings/ui_filters';
+import { createExploratoryViewUrl } from '../../../../../../observability/public';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
 
 export function PageViewsTrend() {
+  const {
+    services: { http },
+  } = useKibana();
+
   const { urlParams, uiFilters } = useUrlParams();
+  const { serviceName } = uiFilters;
 
-  const { start, end, searchTerm } = urlParams;
+  const { start, end, searchTerm, rangeTo, rangeFrom } = urlParams;
 
   const [breakdown, setBreakdown] = useState<BreakdownItem | null>(null);
 
   const { data, status } = useFetcher(
     (callApmApi) => {
-      const { serviceName } = uiFilters;
-
       if (start && end && serviceName) {
         return callApmApi({
           endpoint: 'GET /api/apm/rum-client/page-view-trends',
@@ -45,7 +57,21 @@ export function PageViewsTrend() {
       }
       return Promise.resolve(undefined);
     },
-    [end, start, uiFilters, breakdown, searchTerm]
+    [start, end, serviceName, uiFilters, searchTerm, breakdown]
+  );
+
+  const exploratoryViewLink = createExploratoryViewUrl(
+    {
+      [`${serviceName}-page-views`]: {
+        reportType: 'kpi',
+        time: { from: rangeFrom!, to: rangeTo! },
+        reportDefinitions: {
+          'service.name': serviceName?.[0] as string,
+        },
+        ...(breakdown ? { breakdown: breakdown.fieldName } : {}),
+      },
+    },
+    http?.basePath.get()
   );
 
   return (
@@ -63,6 +89,18 @@ export function PageViewsTrend() {
             dataTestSubj={'pvBreakdownFilter'}
           />
         </EuiFlexItem>
+        <EuiFlexItem grow={false} style={{ width: 170 }}>
+          <EuiButton
+            size="s"
+            isDisabled={!serviceName?.[0]}
+            href={exploratoryViewLink}
+          >
+            <FormattedMessage
+              id="xpack.apm.csm.pageViews.analyze"
+              defaultMessage="Analyze"
+            />
+          </EuiButton>
+        </EuiFlexItem>
       </EuiFlexGroup>
       <EuiSpacer size="s" />
       <PageViewsChart data={data} loading={status !== 'success'} />
diff --git a/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx b/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
new file mode 100644
index 00000000000000..7607b6fd91392a
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_details/service_icons/alert_details.tsx
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiLink } from '@elastic/eui';
+import { parse, format } from 'url';
+import { uniqBy } from 'lodash';
+import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
+import { APIReturnType } from '../../../../services/rest/createCallApmApi';
+import { asPercent, asDuration } from '../../../../../common/utils/formatters';
+import { TimestampTooltip } from '../../../shared/TimestampTooltip';
+
+interface AlertDetailProps {
+  alerts: APIReturnType<'GET /api/apm/services/{serviceName}/alerts'>['alerts'];
+}
+
+export function AlertDetails({ alerts }: AlertDetailProps) {
+  const {
+    apmRuleRegistry,
+    core: {
+      http: {
+        basePath: { prepend },
+      },
+    },
+  } = useApmPluginContext();
+
+  const {
+    urlParams: { rangeFrom, rangeTo },
+  } = useUrlParams();
+
+  const collapsedAlerts = uniqBy(
+    alerts,
+    (alert) => alert['kibana.rac.alert.id']!
+  );
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="s">
+      {collapsedAlerts.map((alert) => {
+        const ruleType = apmRuleRegistry.getTypeByRuleId(alert['rule.id']!);
+        const formatted = {
+          link: undefined,
+          reason: alert['rule.name'],
+          ...(ruleType?.format?.({
+            alert,
+            formatters: { asDuration, asPercent },
+          }) ?? {}),
+        };
+
+        const parsedLink = formatted.link
+          ? parse(formatted.link, true)
+          : undefined;
+
+        return (
+          <EuiFlexItem grow>
+            <EuiFlexGroup direction="row" gutterSize="s">
+              <EuiFlexItem grow>
+                {parsedLink ? (
+                  <EuiLink
+                    href={prepend(
+                      format({
+                        ...parsedLink,
+                        query: {
+                          ...parsedLink.query,
+                          rangeFrom,
+                          rangeTo,
+                        },
+                      })
+                    )}
+                  >
+                    {formatted.reason}
+                  </EuiLink>
+                ) : (
+                  formatted.reason
+                )}
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <TimestampTooltip
+                  time={new Date(alert['kibana.rac.alert.start']!).getTime()}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlexItem>
+        );
+      })}
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_details/service_icons/icon_popover.tsx b/x-pack/plugins/apm/public/components/app/service_details/service_icons/icon_popover.tsx
index f7495d3e51671c..79f93ea76ee51f 100644
--- a/x-pack/plugins/apm/public/components/app/service_details/service_icons/icon_popover.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_details/service_icons/icon_popover.tsx
@@ -23,7 +23,11 @@ interface IconPopoverProps {
   onClose: () => void;
   detailsFetchStatus: FETCH_STATUS;
   isOpen: boolean;
-  icon?: string;
+  icon: {
+    type?: string;
+    size?: 's' | 'm' | 'l';
+    color?: string;
+  };
 }
 export function IconPopover({
   icon,
@@ -34,7 +38,7 @@ export function IconPopover({
   detailsFetchStatus,
   isOpen,
 }: IconPopoverProps) {
-  if (!icon) {
+  if (!icon.type) {
     return null;
   }
   const isLoading = detailsFetchStatus === FETCH_STATUS.LOADING;
@@ -44,7 +48,11 @@ export function IconPopover({
       ownFocus={false}
       button={
         <EuiButtonEmpty onClick={onClick} data-test-subj={`popover_${title}`}>
-          <EuiIcon type={icon} size="l" color="text" />
+          <EuiIcon
+            type={icon.type}
+            size={icon.size ?? 'l'}
+            color={icon.color ?? 'text'}
+          />
         </EuiButtonEmpty>
       }
       isOpen={isOpen}
diff --git a/x-pack/plugins/apm/public/components/app/service_details/service_icons/index.tsx b/x-pack/plugins/apm/public/components/app/service_details/service_icons/index.tsx
index 6f9c82200fb608..7dde7ed3d145da 100644
--- a/x-pack/plugins/apm/public/components/app/service_details/service_icons/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_details/service_icons/index.tsx
@@ -8,6 +8,7 @@
 import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { ReactChild, useState } from 'react';
+import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { useTheme } from '../../../../hooks/use_theme';
 import { ContainerType } from '../../../../../common/service_metadata';
 import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
@@ -17,6 +18,7 @@ import { CloudDetails } from './cloud_details';
 import { ContainerDetails } from './container_details';
 import { IconPopover } from './icon_popover';
 import { ServiceDetails } from './service_details';
+import { AlertDetails } from './alert_details';
 
 interface Props {
   serviceName: string;
@@ -46,10 +48,15 @@ function getContainerIcon(container?: ContainerType) {
   }
 }
 
-type Icons = 'service' | 'container' | 'cloud';
+type Icons = 'service' | 'container' | 'cloud' | 'alerts';
+
 interface PopoverItem {
   key: Icons;
-  icon?: string;
+  icon: {
+    type?: string;
+    color?: string;
+    size?: 's' | 'm' | 'l';
+  };
   isVisible: boolean;
   title: string;
   component: ReactChild;
@@ -66,6 +73,8 @@ export function ServiceIcons({ serviceName }: Props) {
 
   const theme = useTheme();
 
+  const { alerts } = useApmServiceContext();
+
   const { data: icons, status: iconsFetchStatus } = useFetcher(
     (callApmApi) => {
       if (serviceName && start && end) {
@@ -106,7 +115,9 @@ export function ServiceIcons({ serviceName }: Props) {
   const popoverItems: PopoverItem[] = [
     {
       key: 'service',
-      icon: getAgentIcon(icons?.agentName, theme.darkMode) || 'node',
+      icon: {
+        type: getAgentIcon(icons?.agentName, theme.darkMode) || 'node',
+      },
       isVisible: !!icons?.agentName,
       title: i18n.translate('xpack.apm.serviceIcons.service', {
         defaultMessage: 'Service',
@@ -115,7 +126,9 @@ export function ServiceIcons({ serviceName }: Props) {
     },
     {
       key: 'container',
-      icon: getContainerIcon(icons?.containerType),
+      icon: {
+        type: getContainerIcon(icons?.containerType),
+      },
       isVisible: !!icons?.containerType,
       title: i18n.translate('xpack.apm.serviceIcons.container', {
         defaultMessage: 'Container',
@@ -124,13 +137,28 @@ export function ServiceIcons({ serviceName }: Props) {
     },
     {
       key: 'cloud',
-      icon: getCloudIcon(icons?.cloudProvider),
+      icon: {
+        type: getCloudIcon(icons?.cloudProvider),
+      },
       isVisible: !!icons?.cloudProvider,
       title: i18n.translate('xpack.apm.serviceIcons.cloud', {
         defaultMessage: 'Cloud',
       }),
       component: <CloudDetails cloud={details?.cloud} />,
     },
+    {
+      key: 'alerts',
+      icon: {
+        type: 'bell',
+        color: theme.eui.euiColorDanger,
+        size: 'm',
+      },
+      isVisible: alerts.length > 0,
+      title: i18n.translate('xpack.apm.serviceIcons.alerts', {
+        defaultMessage: 'Alerts',
+      }),
+      component: <AlertDetails alerts={alerts} />,
+    },
   ];
 
   return (
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx
index c6ed4e640693f0..4d6c0be9ff818f 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx
@@ -72,6 +72,7 @@ describe('ServiceOverview', () => {
         agentName: 'java',
         transactionType: 'request',
         transactionTypes: ['request'],
+        alerts: [],
       });
     jest
       .spyOn(useAnnotationsHooks, 'useAnnotationsContext')
@@ -85,16 +86,16 @@ describe('ServiceOverview', () => {
 
     /* eslint-disable @typescript-eslint/naming-convention */
     const calls = {
-      'GET /api/apm/services/{serviceName}/error_groups/primary_statistics': {
+      'GET /api/apm/services/{serviceName}/error_groups/main_statistics': {
         error_groups: [] as any[],
       },
-      'GET /api/apm/services/{serviceName}/transactions/groups/primary_statistics': {
+      'GET /api/apm/services/{serviceName}/transactions/groups/main_statistics': {
         transactionGroups: [] as any[],
         totalTransactionGroups: 0,
         isAggregationAccurate: true,
       },
       'GET /api/apm/services/{serviceName}/dependencies': [],
-      'GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics': [],
+      'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics': [],
     };
     /* eslint-enable @typescript-eslint/naming-convention */
 
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx
index fd1120808db9e7..4ad83f7d87426c 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx
@@ -16,18 +16,18 @@ import { TimestampTooltip } from '../../../shared/TimestampTooltip';
 import { TruncateWithTooltip } from '../../../shared/truncate_with_tooltip';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 
-type ErrorGroupPrimaryStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/primary_statistics'>;
-type ErrorGroupComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/comparison_statistics'>;
+type ErrorGroupMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/main_statistics'>;
+type ErrorGroupDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/detailed_statistics'>;
 
 export function getColumns({
   serviceName,
-  errorGroupComparisonStatistics,
+  errorGroupDetailedStatistics,
   comparisonEnabled,
 }: {
   serviceName: string;
-  errorGroupComparisonStatistics: ErrorGroupComparisonStatistics;
+  errorGroupDetailedStatistics: ErrorGroupDetailedStatistics;
   comparisonEnabled?: boolean;
-}): Array<EuiBasicTableColumn<ErrorGroupPrimaryStatistics['error_groups'][0]>> {
+}): Array<EuiBasicTableColumn<ErrorGroupMainStatistics['error_groups'][0]>> {
   return [
     {
       field: 'name',
@@ -74,10 +74,10 @@ export function getColumns({
       width: px(unit * 12),
       render: (_, { occurrences, group_id: errorGroupId }) => {
         const currentPeriodTimeseries =
-          errorGroupComparisonStatistics?.currentPeriod?.[errorGroupId]
+          errorGroupDetailedStatistics?.currentPeriod?.[errorGroupId]
             ?.timeseries;
         const previousPeriodTimeseries =
-          errorGroupComparisonStatistics?.previousPeriod?.[errorGroupId]
+          errorGroupDetailedStatistics?.previousPeriod?.[errorGroupId]
             ?.timeseries;
 
         return (
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
index d36bee8d6be73a..7c222f85133e3b 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
@@ -28,8 +28,8 @@ import { getColumns } from './get_column';
 interface Props {
   serviceName: string;
 }
-type ErrorGroupPrimaryStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/primary_statistics'>;
-type ErrorGroupComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/comparison_statistics'>;
+type ErrorGroupMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/main_statistics'>;
+type ErrorGroupDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/detailed_statistics'>;
 
 type SortDirection = 'asc' | 'desc';
 type SortField = 'name' | 'last_seen' | 'occurrences';
@@ -40,8 +40,8 @@ const DEFAULT_SORT = {
   field: 'occurrences' as const,
 };
 
-const INITIAL_STATE_PRIMARY_STATISTICS: {
-  items: ErrorGroupPrimaryStatistics['error_groups'];
+const INITIAL_STATE_MAIN_STATISTICS: {
+  items: ErrorGroupMainStatistics['error_groups'];
   totalItems: number;
   requestId?: string;
 } = {
@@ -50,7 +50,7 @@ const INITIAL_STATE_PRIMARY_STATISTICS: {
   requestId: undefined,
 };
 
-const INITIAL_STATE_COMPARISON_STATISTICS: ErrorGroupComparisonStatistics = {
+const INITIAL_STATE_DETAILED_STATISTICS: ErrorGroupDetailedStatistics = {
   currentPeriod: {},
   previousPeriod: {},
 };
@@ -82,19 +82,20 @@ export function ServiceOverviewErrorsTable({ serviceName }: Props) {
     start,
     end,
     comparisonType,
+    comparisonEnabled,
   });
 
   const { pageIndex, sort } = tableOptions;
   const { direction, field } = sort;
 
-  const { data = INITIAL_STATE_PRIMARY_STATISTICS, status } = useFetcher(
+  const { data = INITIAL_STATE_MAIN_STATISTICS, status } = useFetcher(
     (callApmApi) => {
       if (!start || !end || !transactionType) {
         return;
       }
       return callApmApi({
         endpoint:
-          'GET /api/apm/services/{serviceName}/error_groups/primary_statistics',
+          'GET /api/apm/services/{serviceName}/error_groups/main_statistics',
         params: {
           path: { serviceName },
           query: {
@@ -113,13 +114,13 @@ export function ServiceOverviewErrorsTable({ serviceName }: Props) {
         ).slice(pageIndex * PAGE_SIZE, (pageIndex + 1) * PAGE_SIZE);
 
         return {
+          // Everytime the main statistics is refetched, updates the requestId making the comparison API to be refetched.
           requestId: uuid(),
           items: currentPageErrorGroups,
           totalItems: response.error_groups.length,
         };
       });
     },
-    // comparisonType is listed as dependency even thought it is not used. This is needed to trigger the comparison api when it is changed.
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [
       environment,
@@ -131,21 +132,24 @@ export function ServiceOverviewErrorsTable({ serviceName }: Props) {
       pageIndex,
       direction,
       field,
+      // not used, but needed to trigger an update when comparisonType is changed either manually by user or when time range is changed
       comparisonType,
+      // not used, but needed to trigger an update when comparison feature is disabled/enabled by user
+      comparisonEnabled,
     ]
   );
 
   const { requestId, items, totalItems } = data;
 
   const {
-    data: errorGroupComparisonStatistics = INITIAL_STATE_COMPARISON_STATISTICS,
-    status: errorGroupComparisonStatisticsStatus,
+    data: errorGroupDetailedStatistics = INITIAL_STATE_DETAILED_STATISTICS,
+    status: errorGroupDetailedStatisticsStatus,
   } = useFetcher(
     (callApmApi) => {
       if (requestId && items.length && start && end && transactionType) {
         return callApmApi({
           endpoint:
-            'GET /api/apm/services/{serviceName}/error_groups/comparison_statistics',
+            'GET /api/apm/services/{serviceName}/error_groups/detailed_statistics',
           params: {
             path: { serviceName },
             query: {
@@ -173,7 +177,7 @@ export function ServiceOverviewErrorsTable({ serviceName }: Props) {
 
   const columns = getColumns({
     serviceName,
-    errorGroupComparisonStatistics,
+    errorGroupDetailedStatistics,
     comparisonEnabled,
   });
 
@@ -218,7 +222,7 @@ export function ServiceOverviewErrorsTable({ serviceName }: Props) {
               }}
               loading={
                 status === FETCH_STATUS.LOADING ||
-                errorGroupComparisonStatisticsStatus === FETCH_STATUS.LOADING
+                errorGroupDetailedStatisticsStatus === FETCH_STATUS.LOADING
               }
               onChange={(newTableOptions: {
                 page?: {
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
index 55eb2e3ddab732..8305b5a0dde3ba 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
@@ -25,7 +25,7 @@ interface ServiceOverviewInstancesChartAndTableProps {
   serviceName: string;
 }
 
-export interface PrimaryStatsServiceInstanceItem {
+export interface MainStatsServiceInstanceItem {
   serviceNodeName: string;
   errorRate: number;
   throughput: number;
@@ -34,15 +34,15 @@ export interface PrimaryStatsServiceInstanceItem {
   memoryUsage: number;
 }
 
-const INITIAL_STATE_PRIMARY_STATS = {
-  primaryStatsItems: [] as PrimaryStatsServiceInstanceItem[],
-  primaryStatsRequestId: undefined,
-  primaryStatsItemCount: 0,
+const INITIAL_STATE_MAIN_STATS = {
+  mainStatsItems: [] as MainStatsServiceInstanceItem[],
+  mainStatsRequestId: undefined,
+  mainStatsItemCount: 0,
 };
 
-type ApiResponseComparisonStats = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/comparison_statistics'>;
+type ApiResponseDetailedStats = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
 
-const INITIAL_STATE_COMPARISON_STATISTICS: ApiResponseComparisonStats = {
+const INITIAL_STATE_DETAILED_STATISTICS: ApiResponseDetailedStats = {
   currentPeriod: {},
   previousPeriod: {},
 };
@@ -83,6 +83,7 @@ export function ServiceOverviewInstancesChartAndTable({
       start,
       end,
       comparisonType,
+      comparisonEnabled,
     },
   } = useUrlParams();
 
@@ -90,11 +91,12 @@ export function ServiceOverviewInstancesChartAndTable({
     start,
     end,
     comparisonType,
+    comparisonEnabled,
   });
 
   const {
-    data: primaryStatsData = INITIAL_STATE_PRIMARY_STATS,
-    status: primaryStatsStatus,
+    data: mainStatsData = INITIAL_STATE_MAIN_STATS,
+    status: mainStatsStatus,
   } = useFetcher(
     (callApmApi) => {
       if (!start || !end || !transactionType || !latencyAggregationType) {
@@ -103,7 +105,7 @@ export function ServiceOverviewInstancesChartAndTable({
 
       return callApmApi({
         endpoint:
-          'GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics',
+          'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics',
         params: {
           path: {
             serviceName,
@@ -118,7 +120,7 @@ export function ServiceOverviewInstancesChartAndTable({
           },
         },
       }).then((response) => {
-        const primaryStatsItems = orderBy(
+        const mainStatsItems = orderBy(
           // need top-level sortable fields for the managed table
           response.serviceInstances.map((item) => ({
             ...item,
@@ -133,13 +135,13 @@ export function ServiceOverviewInstancesChartAndTable({
         ).slice(pageIndex * PAGE_SIZE, (pageIndex + 1) * PAGE_SIZE);
 
         return {
-          primaryStatsRequestId: uuid(),
-          primaryStatsItems,
-          primaryStatsItemCount: response.serviceInstances.length,
+          // Everytime the main statistics is refetched, updates the requestId making the detailed API to be refetched.
+          mainStatsRequestId: uuid(),
+          mainStatsItems,
+          mainStatsItemCount: response.serviceInstances.length,
         };
       });
     },
-    // comparisonType is listed as dependency even thought it is not used. This is needed to trigger the comparison api when it is changed.
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [
       environment,
@@ -152,19 +154,22 @@ export function ServiceOverviewInstancesChartAndTable({
       pageIndex,
       field,
       direction,
+      // not used, but needed to trigger an update when comparisonType is changed either manually by user or when time range is changed
       comparisonType,
+      // not used, but needed to trigger an update when comparison feature is disabled/enabled by user
+      comparisonEnabled,
     ]
   );
 
   const {
-    primaryStatsItems,
-    primaryStatsRequestId,
-    primaryStatsItemCount,
-  } = primaryStatsData;
+    mainStatsItems,
+    mainStatsRequestId,
+    mainStatsItemCount,
+  } = mainStatsData;
 
   const {
-    data: comparisonStatsData = INITIAL_STATE_COMPARISON_STATISTICS,
-    status: comparisonStatisticsStatus,
+    data: detailedStatsData = INITIAL_STATE_DETAILED_STATISTICS,
+    status: detailedStatsStatus,
   } = useFetcher(
     (callApmApi) => {
       if (
@@ -172,14 +177,14 @@ export function ServiceOverviewInstancesChartAndTable({
         !end ||
         !transactionType ||
         !latencyAggregationType ||
-        !primaryStatsItemCount
+        !mainStatsItemCount
       ) {
         return;
       }
 
       return callApmApi({
         endpoint:
-          'GET /api/apm/services/{serviceName}/service_overview_instances/comparison_statistics',
+          'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics',
         params: {
           path: {
             serviceName,
@@ -193,7 +198,7 @@ export function ServiceOverviewInstancesChartAndTable({
             numBuckets: 20,
             transactionType,
             serviceNodeIds: JSON.stringify(
-              primaryStatsItems.map((item) => item.serviceNodeName)
+              mainStatsItems.map((item) => item.serviceNodeName)
             ),
             comparisonStart,
             comparisonEnd,
@@ -201,9 +206,9 @@ export function ServiceOverviewInstancesChartAndTable({
         },
       });
     },
-    // only fetches comparison statistics when requestId is invalidated by primary statistics api call
+    // only fetches detailed statistics when requestId is invalidated by main statistics api call
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [primaryStatsRequestId],
+    [mainStatsRequestId],
     { preservePreviousData: false }
   );
 
@@ -212,22 +217,22 @@ export function ServiceOverviewInstancesChartAndTable({
       <EuiFlexItem grow={3}>
         <InstancesLatencyDistributionChart
           height={chartHeight}
-          items={primaryStatsItems}
-          status={primaryStatsStatus}
+          items={mainStatsItems}
+          status={mainStatsStatus}
         />
       </EuiFlexItem>
       <EuiFlexItem grow={7}>
         <EuiPanel>
           <ServiceOverviewInstancesTable
-            primaryStatsItems={primaryStatsItems}
-            primaryStatsStatus={primaryStatsStatus}
-            primaryStatsItemCount={primaryStatsItemCount}
-            comparisonStatsData={comparisonStatsData}
+            mainStatsItems={mainStatsItems}
+            mainStatsStatus={mainStatsStatus}
+            mainStatsItemCount={mainStatsItemCount}
+            detailedStatsData={detailedStatsData}
             serviceName={serviceName}
             tableOptions={tableOptions}
             isLoading={
-              primaryStatsStatus === FETCH_STATUS.LOADING ||
-              comparisonStatisticsStatus === FETCH_STATUS.LOADING
+              mainStatsStatus === FETCH_STATUS.LOADING ||
+              detailedStatsStatus === FETCH_STATUS.LOADING
             }
             onChangeTableOptions={(newTableOptions) => {
               setTableOptions({
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx
index d61593f52b2ed6..f52c2b083330fa 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx
@@ -26,23 +26,23 @@ import { MetricOverviewLink } from '../../../shared/Links/apm/MetricOverviewLink
 import { ServiceNodeMetricOverviewLink } from '../../../shared/Links/apm/ServiceNodeMetricOverviewLink';
 import { TruncateWithTooltip } from '../../../shared/truncate_with_tooltip';
 import { getLatencyColumnLabel } from '../get_latency_column_label';
-import { PrimaryStatsServiceInstanceItem } from '../service_overview_instances_chart_and_table';
+import { MainStatsServiceInstanceItem } from '../service_overview_instances_chart_and_table';
 
-type ServiceInstanceComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/comparison_statistics'>;
+type ServiceInstanceDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
 
 export function getColumns({
   serviceName,
   agentName,
   latencyAggregationType,
-  comparisonStatsData,
+  detailedStatsData,
   comparisonEnabled,
 }: {
   serviceName: string;
   agentName?: string;
   latencyAggregationType?: LatencyAggregationType;
-  comparisonStatsData?: ServiceInstanceComparisonStatistics;
+  detailedStatsData?: ServiceInstanceDetailedStatistics;
   comparisonEnabled?: boolean;
-}): Array<EuiBasicTableColumn<PrimaryStatsServiceInstanceItem>> {
+}): Array<EuiBasicTableColumn<MainStatsServiceInstanceItem>> {
   return [
     {
       field: 'serviceNodeName',
@@ -87,9 +87,9 @@ export function getColumns({
       width: px(unit * 10),
       render: (_, { serviceNodeName, latency }) => {
         const currentPeriodTimestamp =
-          comparisonStatsData?.currentPeriod?.[serviceNodeName]?.latency;
+          detailedStatsData?.currentPeriod?.[serviceNodeName]?.latency;
         const previousPeriodTimestamp =
-          comparisonStatsData?.previousPeriod?.[serviceNodeName]?.latency;
+          detailedStatsData?.previousPeriod?.[serviceNodeName]?.latency;
         return (
           <SparkPlot
             color="euiColorVis1"
@@ -112,9 +112,9 @@ export function getColumns({
       width: px(unit * 10),
       render: (_, { serviceNodeName, throughput }) => {
         const currentPeriodTimestamp =
-          comparisonStatsData?.currentPeriod?.[serviceNodeName]?.throughput;
+          detailedStatsData?.currentPeriod?.[serviceNodeName]?.throughput;
         const previousPeriodTimestamp =
-          comparisonStatsData?.previousPeriod?.[serviceNodeName]?.throughput;
+          detailedStatsData?.previousPeriod?.[serviceNodeName]?.throughput;
         return (
           <SparkPlot
             compact
@@ -138,9 +138,9 @@ export function getColumns({
       width: px(unit * 8),
       render: (_, { serviceNodeName, errorRate }) => {
         const currentPeriodTimestamp =
-          comparisonStatsData?.currentPeriod?.[serviceNodeName]?.errorRate;
+          detailedStatsData?.currentPeriod?.[serviceNodeName]?.errorRate;
         const previousPeriodTimestamp =
-          comparisonStatsData?.previousPeriod?.[serviceNodeName]?.errorRate;
+          detailedStatsData?.previousPeriod?.[serviceNodeName]?.errorRate;
         return (
           <SparkPlot
             compact
@@ -164,9 +164,9 @@ export function getColumns({
       width: px(unit * 8),
       render: (_, { serviceNodeName, cpuUsage }) => {
         const currentPeriodTimestamp =
-          comparisonStatsData?.currentPeriod?.[serviceNodeName]?.cpuUsage;
+          detailedStatsData?.currentPeriod?.[serviceNodeName]?.cpuUsage;
         const previousPeriodTimestamp =
-          comparisonStatsData?.previousPeriod?.[serviceNodeName]?.cpuUsage;
+          detailedStatsData?.previousPeriod?.[serviceNodeName]?.cpuUsage;
         return (
           <SparkPlot
             compact
@@ -190,9 +190,9 @@ export function getColumns({
       width: px(unit * 9),
       render: (_, { serviceNodeName, memoryUsage }) => {
         const currentPeriodTimestamp =
-          comparisonStatsData?.currentPeriod?.[serviceNodeName]?.memoryUsage;
+          detailedStatsData?.currentPeriod?.[serviceNodeName]?.memoryUsage;
         const previousPeriodTimestamp =
-          comparisonStatsData?.previousPeriod?.[serviceNodeName]?.memoryUsage;
+          detailedStatsData?.previousPeriod?.[serviceNodeName]?.memoryUsage;
         return (
           <SparkPlot
             compact
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
index 28654acbefa464..1bab5e45bcc52c 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
@@ -20,14 +20,14 @@ import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { TableFetchWrapper } from '../../../shared/table_fetch_wrapper';
 import {
   PAGE_SIZE,
-  PrimaryStatsServiceInstanceItem,
+  MainStatsServiceInstanceItem,
   SortDirection,
   SortField,
 } from '../service_overview_instances_chart_and_table';
 import { ServiceOverviewTableContainer } from '../service_overview_table_container';
 import { getColumns } from './get_columns';
 
-type ServiceInstanceComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/comparison_statistics'>;
+type ServiceInstanceDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
 
 export interface TableOptions {
   pageIndex: number;
@@ -38,26 +38,26 @@ export interface TableOptions {
 }
 
 interface Props {
-  primaryStatsItems: PrimaryStatsServiceInstanceItem[];
+  mainStatsItems: MainStatsServiceInstanceItem[];
   serviceName: string;
-  primaryStatsStatus: FETCH_STATUS;
-  primaryStatsItemCount: number;
+  mainStatsStatus: FETCH_STATUS;
+  mainStatsItemCount: number;
   tableOptions: TableOptions;
   onChangeTableOptions: (newTableOptions: {
     page?: { index: number };
     sort?: { field: string; direction: SortDirection };
   }) => void;
-  comparisonStatsData?: ServiceInstanceComparisonStatistics;
+  detailedStatsData?: ServiceInstanceDetailedStatistics;
   isLoading: boolean;
 }
 export function ServiceOverviewInstancesTable({
-  primaryStatsItems = [],
-  primaryStatsItemCount,
+  mainStatsItems = [],
+  mainStatsItemCount,
   serviceName,
-  primaryStatsStatus: status,
+  mainStatsStatus: status,
   tableOptions,
   onChangeTableOptions,
-  comparisonStatsData: comparisonStatsData,
+  detailedStatsData: detailedStatsData,
   isLoading,
 }: Props) {
   const { agentName } = useApmServiceContext();
@@ -72,14 +72,14 @@ export function ServiceOverviewInstancesTable({
     agentName,
     serviceName,
     latencyAggregationType,
-    comparisonStatsData,
+    detailedStatsData,
     comparisonEnabled,
   });
 
   const pagination = {
     pageIndex,
     pageSize: PAGE_SIZE,
-    totalItemCount: primaryStatsItemCount,
+    totalItemCount: mainStatsItemCount,
     hidePerPageOptions: true,
   };
 
@@ -97,11 +97,11 @@ export function ServiceOverviewInstancesTable({
       <EuiFlexItem>
         <TableFetchWrapper status={status}>
           <ServiceOverviewTableContainer
-            isEmptyAndLoading={primaryStatsItemCount === 0 && isLoading}
+            isEmptyAndLoading={mainStatsItemCount === 0 && isLoading}
           >
             <EuiBasicTable
               loading={isLoading}
-              items={primaryStatsItems}
+              items={mainStatsItems}
               columns={columns}
               pagination={pagination}
               sorting={{ sort: { field, direction } }}
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx
index 4f6f41f862e19f..60f91a9571c71a 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx
@@ -48,6 +48,7 @@ export function ServiceOverviewThroughputChart({
     start,
     end,
     comparisonType,
+    comparisonEnabled,
   });
 
   const { data = INITIAL_STATE, status } = useFetcher(
@@ -98,7 +99,7 @@ export function ServiceOverviewThroughputChart({
           {
             data: data.previousPeriod,
             type: 'area',
-            color: theme.eui.euiColorLightestShade,
+            color: theme.eui.euiColorMediumShade,
             title: i18n.translate(
               'xpack.apm.serviceOverview.throughtputChart.previousPeriodLabel',
               { defaultMessage: 'Previous period' }
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/get_columns.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/get_columns.tsx
index d9ca3356d7fd2d..02aad49ddfc9c4 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/get_columns.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/get_columns.tsx
@@ -23,22 +23,22 @@ import { TransactionDetailLink } from '../../../shared/Links/apm/transaction_det
 import { TruncateWithTooltip } from '../../../shared/truncate_with_tooltip';
 import { getLatencyColumnLabel } from '../get_latency_column_label';
 
-type TransactionGroupPrimaryStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/primary_statistics'>;
+type TransactionGroupMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/main_statistics'>;
 
 type ServiceTransactionGroupItem = ValuesType<
-  TransactionGroupPrimaryStatistics['transactionGroups']
+  TransactionGroupMainStatistics['transactionGroups']
 >;
-type TransactionGroupComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/comparison_statistics'>;
+type TransactionGroupDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/detailed_statistics'>;
 
 export function getColumns({
   serviceName,
   latencyAggregationType,
-  transactionGroupComparisonStatistics,
+  transactionGroupDetailedStatistics,
   comparisonEnabled,
 }: {
   serviceName: string;
   latencyAggregationType?: LatencyAggregationType;
-  transactionGroupComparisonStatistics?: TransactionGroupComparisonStatistics;
+  transactionGroupDetailedStatistics?: TransactionGroupDetailedStatistics;
   comparisonEnabled?: boolean;
 }): Array<EuiBasicTableColumn<ServiceTransactionGroupItem>> {
   return [
@@ -74,9 +74,9 @@ export function getColumns({
       width: px(unit * 10),
       render: (_, { latency, name }) => {
         const currentTimeseries =
-          transactionGroupComparisonStatistics?.currentPeriod?.[name]?.latency;
+          transactionGroupDetailedStatistics?.currentPeriod?.[name]?.latency;
         const previousTimeseries =
-          transactionGroupComparisonStatistics?.previousPeriod?.[name]?.latency;
+          transactionGroupDetailedStatistics?.previousPeriod?.[name]?.latency;
         return (
           <SparkPlot
             color="euiColorVis1"
@@ -100,10 +100,9 @@ export function getColumns({
       width: px(unit * 10),
       render: (_, { throughput, name }) => {
         const currentTimeseries =
-          transactionGroupComparisonStatistics?.currentPeriod?.[name]
-            ?.throughput;
+          transactionGroupDetailedStatistics?.currentPeriod?.[name]?.throughput;
         const previousTimeseries =
-          transactionGroupComparisonStatistics?.previousPeriod?.[name]
+          transactionGroupDetailedStatistics?.previousPeriod?.[name]
             ?.throughput;
         return (
           <SparkPlot
@@ -128,11 +127,9 @@ export function getColumns({
       width: px(unit * 8),
       render: (_, { errorRate, name }) => {
         const currentTimeseries =
-          transactionGroupComparisonStatistics?.currentPeriod?.[name]
-            ?.errorRate;
+          transactionGroupDetailedStatistics?.currentPeriod?.[name]?.errorRate;
         const previousTimeseries =
-          transactionGroupComparisonStatistics?.previousPeriod?.[name]
-            ?.errorRate;
+          transactionGroupDetailedStatistics?.previousPeriod?.[name]?.errorRate;
         return (
           <SparkPlot
             color="euiColorVis7"
@@ -156,10 +153,10 @@ export function getColumns({
       width: px(unit * 5),
       render: (_, { name }) => {
         const currentImpact =
-          transactionGroupComparisonStatistics?.currentPeriod?.[name]?.impact ??
+          transactionGroupDetailedStatistics?.currentPeriod?.[name]?.impact ??
           0;
         const previousImpact =
-          transactionGroupComparisonStatistics?.previousPeriod?.[name]?.impact;
+          transactionGroupDetailedStatistics?.previousPeriod?.[name]?.impact;
         return (
           <EuiFlexGroup gutterSize="xs" direction="column">
             <EuiFlexItem>
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/index.tsx
index 121b96b0361b2d..0a4a735c117d29 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_transactions_table/index.tsx
@@ -29,7 +29,7 @@ interface Props {
   serviceName: string;
 }
 
-type ApiResponse = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/primary_statistics'>;
+type ApiResponse = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/main_statistics'>;
 const INITIAL_STATE = {
   transactionGroups: [] as ApiResponse['transactionGroups'],
   isAggregationAccurate: true,
@@ -77,6 +77,7 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
     start,
     end,
     comparisonType,
+    comparisonEnabled,
   });
 
   const { data = INITIAL_STATE, status } = useFetcher(
@@ -86,7 +87,7 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
       }
       return callApmApi({
         endpoint:
-          'GET /api/apm/services/{serviceName}/transactions/groups/primary_statistics',
+          'GET /api/apm/services/{serviceName}/transactions/groups/main_statistics',
         params: {
           path: { serviceName },
           query: {
@@ -107,14 +108,13 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
 
         return {
           ...response,
-          // Everytime the primary statistics is refetched, updates the requestId making the comparison API to be refetched.
+          // Everytime the main statistics is refetched, updates the requestId making the detailed API to be refetched.
           requestId: uuid(),
           transactionGroupsTotalItems: response.transactionGroups.length,
           transactionGroups: currentPageTransactionGroups,
         };
       });
     },
-    // comparisonType is listed as dependency even thought it is not used. This is needed to trigger the comparison api when it is changed.
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [
       environment,
@@ -127,15 +127,18 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
       pageIndex,
       direction,
       field,
+      // not used, but needed to trigger an update when comparisonType is changed either manually by user or when time range is changed
       comparisonType,
+      // not used, but needed to trigger an update when comparison feature is disabled/enabled by user
+      comparisonEnabled,
     ]
   );
 
   const { transactionGroups, requestId, transactionGroupsTotalItems } = data;
 
   const {
-    data: transactionGroupComparisonStatistics,
-    status: transactionGroupComparisonStatisticsStatus,
+    data: transactionGroupDetailedStatistics,
+    status: transactionGroupDetailedStatisticsStatus,
   } = useFetcher(
     (callApmApi) => {
       if (
@@ -147,7 +150,7 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
       ) {
         return callApmApi({
           endpoint:
-            'GET /api/apm/services/{serviceName}/transactions/groups/comparison_statistics',
+            'GET /api/apm/services/{serviceName}/transactions/groups/detailed_statistics',
           params: {
             path: { serviceName },
             query: {
@@ -168,7 +171,7 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
         });
       }
     },
-    // only fetches comparison statistics when requestId is invalidated by primary statistics api call
+    // only fetches detailed statistics when requestId is invalidated by main statistics api call
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [requestId],
     { preservePreviousData: false }
@@ -177,13 +180,13 @@ export function ServiceOverviewTransactionsTable({ serviceName }: Props) {
   const columns = getColumns({
     serviceName,
     latencyAggregationType,
-    transactionGroupComparisonStatistics,
+    transactionGroupDetailedStatistics,
     comparisonEnabled,
   });
 
   const isLoading =
     status === FETCH_STATUS.LOADING ||
-    transactionGroupComparisonStatisticsStatus === FETCH_STATUS.LOADING;
+    transactionGroupDetailedStatisticsStatus === FETCH_STATUS.LOADING;
 
   const pagination = {
     pageIndex,
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/WaterfallWithSummmary/TransactionTabs.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/WaterfallWithSummmary/TransactionTabs.tsx
index 5d6e46bb2ffd25..7f8ffb62d9e728 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/WaterfallWithSummmary/TransactionTabs.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/WaterfallWithSummmary/TransactionTabs.tsx
@@ -137,6 +137,19 @@ function LogsTabContent({ transaction }: { transaction: Transaction }) {
       endTimestamp={endTimestamp + framePaddingMs}
       query={`trace.id:"${transaction.trace.id}" OR "${transaction.trace.id}"`}
       height={640}
+      columns={[
+        { type: 'timestamp' },
+        {
+          type: 'field',
+          field: 'service.name',
+          header: i18n.translate(
+            'xpack.apm.propertiesTable.tabs.logs.serviceName',
+            { defaultMessage: 'Service Name' }
+          ),
+          width: 200,
+        },
+        { type: 'message' },
+      ]}
     />
   );
 }
diff --git a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
new file mode 100644
index 00000000000000..2c086dbb17222f
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { ValuesType } from 'utility-types';
+import { RectAnnotation } from '@elastic/charts';
+import { EuiTheme } from 'src/plugins/kibana_react/common';
+import { rgba } from 'polished';
+import { APIReturnType } from '../../../../services/rest/createCallApmApi';
+
+type Alert = ValuesType<
+  APIReturnType<'GET /api/apm/services/{serviceName}/alerts'>['alerts']
+>;
+
+function getAlertColor({ theme, ruleId }: { ruleId: string; theme: EuiTheme }) {
+  switch (ruleId) {
+    default:
+      return theme.eui.euiColorVis2;
+  }
+}
+
+export function getAlertAnnotations({
+  alerts,
+  theme,
+}: {
+  alerts?: Alert[];
+  theme: EuiTheme;
+}) {
+  return alerts?.flatMap((alert) => {
+    const uuid = alert['kibana.rac.alert.uuid']!;
+    const start = new Date(alert['kibana.rac.alert.start']!).getTime();
+    const end = start + alert['kibana.rac.alert.duration.us']! / 1000;
+    const color = getAlertColor({ ruleId: alert['rule.id']!, theme });
+
+    return [
+      <RectAnnotation
+        key={`alert_${uuid}_area`}
+        id={`alert_${uuid}_area`}
+        dataValues={[
+          {
+            coordinates: {
+              x0: start,
+              x1: end,
+            },
+          },
+        ]}
+        style={{ fill: color }}
+      />,
+      <RectAnnotation
+        key={`alert_${uuid}_border`}
+        id={`alert_${uuid}_border`}
+        dataValues={[
+          {
+            coordinates: {
+              x0: start,
+              x1: end,
+              y0: 0,
+              y1: 0,
+            },
+          },
+        ]}
+        style={{
+          fill: rgba(0, 0, 0, 0),
+          strokeWidth: 2,
+          stroke: color,
+          opacity: 1,
+        }}
+      />,
+    ];
+  });
+}
diff --git a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx
index 0e24c8e51c5436..0eb5b0e84ff39f 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx
@@ -9,13 +9,13 @@ import { TooltipInfo } from '@elastic/charts';
 import React, { ComponentType } from 'react';
 import { EuiThemeProvider } from '../../../../../../../../src/plugins/kibana_react/common';
 import { getDurationFormatter } from '../../../../../common/utils/formatters';
-import { PrimaryStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
+import { MainStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
 import { CustomTooltip } from './custom_tooltip';
 
 function getLatencyFormatter(props: TooltipInfo) {
   const maxLatency = Math.max(
     ...props.values.map((value) => {
-      const datum = (value.datum as unknown) as PrimaryStatsServiceInstanceItem;
+      const datum = (value.datum as unknown) as MainStatsServiceInstanceItem;
       return datum.latency ?? 0;
     })
   );
diff --git a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx
index 2280fa91a659c0..027f764317e46f 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx
@@ -15,7 +15,7 @@ import {
   TimeFormatter,
 } from '../../../../../common/utils/formatters';
 import { useTheme } from '../../../../hooks/use_theme';
-import { PrimaryStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
+import { MainStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
 
 const latencyLabel = i18n.translate(
   'xpack.apm.instancesLatencyDistributionChartTooltipLatencyLabel',
@@ -48,7 +48,7 @@ function SingleInstanceCustomTooltip({
 }) {
   const value = values[0];
   const { color } = value;
-  const datum = (value.datum as unknown) as PrimaryStatsServiceInstanceItem;
+  const datum = (value.datum as unknown) as MainStatsServiceInstanceItem;
   const { latency, serviceNodeName, throughput } = datum;
 
   return (
@@ -119,7 +119,7 @@ function MultipleInstanceCustomTooltip({
       </div>
       {values.map((value) => {
         const { color } = value;
-        const datum = (value.datum as unknown) as PrimaryStatsServiceInstanceItem;
+        const datum = (value.datum as unknown) as MainStatsServiceInstanceItem;
         const { latency, serviceNodeName, throughput } = datum;
         return (
           <div className="echTooltip__list" key={serviceNodeName}>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/index.tsx
index 57ecbd4ca0b78b..394d5b5410d414 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/index.tsx
@@ -30,7 +30,7 @@ import {
 } from '../../../../../common/utils/formatters';
 import { FETCH_STATUS } from '../../../../hooks/use_fetcher';
 import { useTheme } from '../../../../hooks/use_theme';
-import { PrimaryStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
+import { MainStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
 import * as urlHelpers from '../../Links/url_helpers';
 import { ChartContainer } from '../chart_container';
 import { getResponseTimeTickFormatter } from '../transaction_charts/helper';
@@ -38,7 +38,7 @@ import { CustomTooltip } from './custom_tooltip';
 
 export interface InstancesLatencyDistributionChartProps {
   height: number;
-  items?: PrimaryStatsServiceInstanceItem[];
+  items?: MainStatsServiceInstanceItem[];
   status: FETCH_STATUS;
 }
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
index 3f61273729e64b..a20f7325f93760 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
@@ -9,6 +9,8 @@ import { EuiFlexGroup, EuiFlexItem, EuiSelect, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
+import { AlertType } from '../../../../../common/alert_types';
+import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { LatencyAggregationType } from '../../../../../common/latency_aggregation_types';
 import { getDurationFormatter } from '../../../../../common/utils/formatters';
 import { useLicenseContext } from '../../../../context/license/use_license_context';
@@ -58,6 +60,8 @@ export function LatencyChart({ height }: Props) {
     mlJobId,
   } = latencyChartsData;
 
+  const { alerts } = useApmServiceContext();
+
   const timeseries = [
     currentPeriod,
     comparisonEnabled ? previousPeriod : undefined,
@@ -121,6 +125,11 @@ export function LatencyChart({ height }: Props) {
           timeseries={timeseries}
           yLabelFormat={getResponseTimeTickFormatter(latencyFormatter)}
           anomalyTimeseries={anomalyTimeseries}
+          alerts={alerts.filter(
+            (alert) =>
+              alert['rule.id'] === AlertType.TransactionDuration ||
+              alert['rule.id'] === AlertType.TransactionDurationAnomaly
+          )}
         />
       </EuiFlexItem>
     </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/timeseries_chart.tsx b/x-pack/plugins/apm/public/components/shared/charts/timeseries_chart.tsx
index f0faec4e994907..f8e01ea37d373d 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/timeseries_chart.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/timeseries_chart.tsx
@@ -41,6 +41,8 @@ import { unit } from '../../../style/variables';
 import { ChartContainer } from './chart_container';
 import { onBrushEnd, isTimeseriesEmpty } from './helper/helper';
 import { getLatencyChartSelector } from '../../../selectors/latency_chart_selectors';
+import { APMServiceAlert } from '../../../context/apm_service/apm_service_context';
+import { getAlertAnnotations } from './helper/get_alert_annotations';
 
 interface Props {
   id: string;
@@ -62,8 +64,8 @@ interface Props {
     typeof getLatencyChartSelector
   >['anomalyTimeseries'];
   customTheme?: Record<string, unknown>;
+  alerts?: APMServiceAlert[];
 }
-
 export function TimeseriesChart({
   id,
   height = unit * 16,
@@ -76,6 +78,7 @@ export function TimeseriesChart({
   yDomain,
   anomalyTimeseries,
   customTheme = {},
+  alerts,
 }: Props) {
   const history = useHistory();
   const { annotations } = useAnnotationsContext();
@@ -193,6 +196,10 @@ export function TimeseriesChart({
             style={{ fill: anomalyTimeseries.scores.color }}
           />
         )}
+        {getAlertAnnotations({
+          alerts,
+          theme,
+        })}
       </Chart>
     </ChartContainer>
   );
diff --git a/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx
index fd9435db57bfdb..9aefa55aaaa36d 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/transaction_error_rate_chart/index.tsx
@@ -9,6 +9,7 @@ import { EuiPanel, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useParams } from 'react-router-dom';
+import { AlertType } from '../../../../../common/alert_types';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { asPercent } from '../../../../../common/utils/formatters';
 import { useFetcher } from '../../../../hooks/use_fetcher';
@@ -62,12 +63,13 @@ export function TransactionErrorRateChart({
       comparisonType,
     },
   } = useUrlParams();
-  const { transactionType } = useApmServiceContext();
+  const { transactionType, alerts } = useApmServiceContext();
   const comparisonChartThem = getComparisonChartTheme(theme);
   const { comparisonStart, comparisonEnd } = getTimeRangeComparison({
     start,
     end,
     comparisonType,
+    comparisonEnabled,
   });
 
   const { data = INITIAL_STATE, status } = useFetcher(
@@ -121,7 +123,7 @@ export function TransactionErrorRateChart({
           {
             data: data.previousPeriod.transactionErrorRate,
             type: 'area',
-            color: theme.eui.euiColorLightestShade,
+            color: theme.eui.euiColorMediumShade,
             title: i18n.translate(
               'xpack.apm.errorRate.chart.errorRate.previousPeriodLabel',
               { defaultMessage: 'Previous period' }
@@ -149,6 +151,9 @@ export function TransactionErrorRateChart({
         yLabelFormat={yLabelFormat}
         yDomain={{ min: 0, max: 1 }}
         customTheme={comparisonChartThem}
+        alerts={alerts.filter(
+          (alert) => alert['rule.id'] === AlertType.TransactionErrorRate
+        )}
       />
     </EuiPanel>
   );
diff --git a/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.test.ts b/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.test.ts
index 7234e94881ce79..77ae49bff7d847 100644
--- a/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.test.ts
+++ b/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.test.ts
@@ -11,12 +11,23 @@ import {
 
 describe('getTimeRangeComparison', () => {
   describe('return empty object', () => {
+    it('when comparison is disabled', () => {
+      const end = '2021-01-28T15:00:00.000Z';
+      const result = getTimeRangeComparison({
+        start: undefined,
+        end,
+        comparisonType: TimeRangeComparisonType.DayBefore,
+        comparisonEnabled: false,
+      });
+      expect(result).toEqual({});
+    });
     it('when start is not defined', () => {
       const end = '2021-01-28T15:00:00.000Z';
       const result = getTimeRangeComparison({
         start: undefined,
         end,
         comparisonType: TimeRangeComparisonType.DayBefore,
+        comparisonEnabled: true,
       });
       expect(result).toEqual({});
     });
@@ -27,6 +38,7 @@ describe('getTimeRangeComparison', () => {
         start,
         end: undefined,
         comparisonType: TimeRangeComparisonType.DayBefore,
+        comparisonEnabled: true,
       });
       expect(result).toEqual({});
     });
@@ -39,6 +51,7 @@ describe('getTimeRangeComparison', () => {
         const end = '2021-01-28T15:00:00.000Z';
         const result = getTimeRangeComparison({
           comparisonType: TimeRangeComparisonType.DayBefore,
+          comparisonEnabled: true,
           start,
           end,
         });
@@ -52,6 +65,7 @@ describe('getTimeRangeComparison', () => {
         const end = '2021-01-28T15:00:00.000Z';
         const result = getTimeRangeComparison({
           comparisonType: TimeRangeComparisonType.WeekBefore,
+          comparisonEnabled: true,
           start,
           end,
         });
@@ -67,6 +81,7 @@ describe('getTimeRangeComparison', () => {
           start,
           end,
           comparisonType: TimeRangeComparisonType.PeriodBefore,
+          comparisonEnabled: true,
         });
         expect(result).toEqual({
           comparisonStart: '2021-02-09T14:24:02.174Z',
@@ -83,6 +98,7 @@ describe('getTimeRangeComparison', () => {
         const end = '2021-01-28T15:00:00.000Z';
         const result = getTimeRangeComparison({
           comparisonType: TimeRangeComparisonType.WeekBefore,
+          comparisonEnabled: true,
           start,
           end,
         });
@@ -98,6 +114,7 @@ describe('getTimeRangeComparison', () => {
       const end = '2021-01-18T15:00:00.000Z';
       const result = getTimeRangeComparison({
         comparisonType: TimeRangeComparisonType.PeriodBefore,
+        comparisonEnabled: true,
         start,
         end,
       });
@@ -110,6 +127,7 @@ describe('getTimeRangeComparison', () => {
       const end = '2021-01-31T15:00:00.000Z';
       const result = getTimeRangeComparison({
         comparisonType: TimeRangeComparisonType.PeriodBefore,
+        comparisonEnabled: true,
         start,
         end,
       });
diff --git a/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.ts b/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.ts
index e436f65e85ad9e..025e8c2a9935d1 100644
--- a/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.ts
+++ b/x-pack/plugins/apm/public/components/shared/time_comparison/get_time_range_comparison.ts
@@ -39,15 +39,17 @@ const oneDayInMilliseconds = moment.duration(1, 'day').asMilliseconds();
 const oneWeekInMilliseconds = moment.duration(1, 'week').asMilliseconds();
 
 export function getTimeRangeComparison({
+  comparisonEnabled,
   comparisonType,
   start,
   end,
 }: {
+  comparisonEnabled?: boolean;
   comparisonType?: TimeRangeComparisonType;
   start?: string;
   end?: string;
 }) {
-  if (!comparisonType || !start || !end) {
+  if (!comparisonEnabled || !comparisonType || !start || !end) {
     return {};
   }
 
diff --git a/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx b/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx
index 84a2dad278a9b5..98fbd4f399d980 100644
--- a/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx
@@ -63,10 +63,12 @@ function getSelectOptions({
   start,
   end,
   rangeTo,
+  comparisonEnabled,
 }: {
   start?: string;
   end?: string;
   rangeTo?: string;
+  comparisonEnabled?: boolean;
 }) {
   const momentStart = moment(start);
   const momentEnd = moment(end);
@@ -112,6 +114,7 @@ function getSelectOptions({
     comparisonType: TimeRangeComparisonType.PeriodBefore,
     start,
     end,
+    comparisonEnabled,
   });
 
   const dateFormat = getDateFormat({
@@ -140,7 +143,12 @@ export function TimeComparison() {
     urlParams: { start, end, comparisonEnabled, comparisonType, rangeTo },
   } = useUrlParams();
 
-  const selectOptions = getSelectOptions({ start, end, rangeTo });
+  const selectOptions = getSelectOptions({
+    start,
+    end,
+    rangeTo,
+    comparisonEnabled,
+  });
 
   // Sets default values
   if (comparisonEnabled === undefined || comparisonType === undefined) {
diff --git a/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx b/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx
index b52bf21a6be1ec..175471e7ae8177 100644
--- a/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx
+++ b/x-pack/plugins/apm/public/context/apm_plugin/apm_plugin_context.tsx
@@ -8,7 +8,7 @@
 import { AppMountParameters, CoreStart } from 'kibana/public';
 import { createContext } from 'react';
 import { ConfigSchema } from '../..';
-import { ApmPluginSetupDeps } from '../../plugin';
+import { ApmPluginSetupDeps, ApmRuleRegistry } from '../../plugin';
 import { MapsStartApi } from '../../../../maps/public';
 
 export interface ApmPluginContextValue {
@@ -16,6 +16,7 @@ export interface ApmPluginContextValue {
   config: ConfigSchema;
   core: CoreStart;
   plugins: ApmPluginSetupDeps & { maps?: MapsStartApi };
+  apmRuleRegistry: ApmRuleRegistry;
 }
 
 export const ApmPluginContext = createContext({} as ApmPluginContextValue);
diff --git a/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx b/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx
index 9a910787d5fe8e..07da5ea7f6c1fe 100644
--- a/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx
+++ b/x-pack/plugins/apm/public/context/apm_plugin/mock_apm_plugin_context.tsx
@@ -12,6 +12,7 @@ import { ConfigSchema } from '../..';
 import { UI_SETTINGS } from '../../../../../../src/plugins/data/common';
 import { createCallApmApi } from '../../services/rest/createCallApmApi';
 import { MlUrlGenerator } from '../../../../ml/public';
+import { ApmRuleRegistry } from '../../plugin';
 
 const uiSettings: Record<string, unknown> = {
   [UI_SETTINGS.TIMEPICKER_QUICK_RANGES]: [
@@ -76,6 +77,11 @@ const mockCore = {
   },
 };
 
+const mockApmRuleRegistry = ({
+  getTypeByRuleId: () => undefined,
+  registerType: () => undefined,
+} as unknown) as ApmRuleRegistry;
+
 const mockConfig: ConfigSchema = {
   serviceMapEnabled: true,
   ui: {
@@ -96,6 +102,9 @@ const mockPlugin = {
       timefilter: { timefilter: { setTime: () => {}, getTime: () => ({}) } },
     },
   },
+  observability: {
+    isAlertingExperienceEnabled: () => false,
+  },
 };
 
 const mockAppMountParameters = {
@@ -107,6 +116,7 @@ export const mockApmPluginContextValue = {
   config: mockConfig,
   core: mockCore,
   plugins: mockPlugin,
+  apmRuleRegistry: mockApmRuleRegistry,
 };
 
 export function MockApmPluginContextWrapper({
diff --git a/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx b/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx
index c99995b982a560..54914580aefbd6 100644
--- a/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx
+++ b/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { createContext, ReactNode } from 'react';
+import { ValuesType } from 'utility-types';
 import { isRumAgentName } from '../../../common/agent_name';
 import {
   TRANSACTION_PAGE_LOAD,
@@ -15,12 +16,19 @@ import { useServiceTransactionTypesFetcher } from './use_service_transaction_typ
 import { useUrlParams } from '../url_params_context/use_url_params';
 import { useServiceAgentNameFetcher } from './use_service_agent_name_fetcher';
 import { IUrlParams } from '../url_params_context/types';
+import { APIReturnType } from '../../services/rest/createCallApmApi';
+import { useServiceAlertsFetcher } from './use_service_alerts_fetcher';
+
+export type APMServiceAlert = ValuesType<
+  APIReturnType<'GET /api/apm/services/{serviceName}/alerts'>['alerts']
+>;
 
 export const APMServiceContext = createContext<{
   agentName?: string;
   transactionType?: string;
   transactionTypes: string[];
-}>({ transactionTypes: [] });
+  alerts: APMServiceAlert[];
+}>({ transactionTypes: [], alerts: [] });
 
 export function ApmServiceContextProvider({
   children,
@@ -29,16 +37,25 @@ export function ApmServiceContextProvider({
 }) {
   const { urlParams } = useUrlParams();
   const { agentName } = useServiceAgentNameFetcher();
+
   const transactionTypes = useServiceTransactionTypesFetcher();
+
   const transactionType = getTransactionType({
     urlParams,
     transactionTypes,
     agentName,
   });
 
+  const { alerts } = useServiceAlertsFetcher(transactionType);
+
   return (
     <APMServiceContext.Provider
-      value={{ agentName, transactionType, transactionTypes }}
+      value={{
+        agentName,
+        transactionType,
+        transactionTypes,
+        alerts,
+      }}
       children={children}
     />
   );
diff --git a/x-pack/plugins/apm/public/context/apm_service/use_service_alerts_fetcher.tsx b/x-pack/plugins/apm/public/context/apm_service/use_service_alerts_fetcher.tsx
new file mode 100644
index 00000000000000..b07e6562a21542
--- /dev/null
+++ b/x-pack/plugins/apm/public/context/apm_service/use_service_alerts_fetcher.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useParams } from 'react-router-dom';
+import { useApmPluginContext } from '../apm_plugin/use_apm_plugin_context';
+import { useUrlParams } from '../url_params_context/use_url_params';
+import { useFetcher } from '../../hooks/use_fetcher';
+import type { APMServiceAlert } from './apm_service_context';
+
+export function useServiceAlertsFetcher(transactionType?: string) {
+  const {
+    plugins: { observability },
+  } = useApmPluginContext();
+
+  const {
+    urlParams: { start, end, environment },
+  } = useUrlParams();
+  const { serviceName } = useParams<{ serviceName?: string }>();
+
+  const experimentalAlertsEnabled = observability.isAlertingExperienceEnabled();
+
+  const fetcherStatus = useFetcher(
+    (callApmApi) => {
+      if (
+        !start ||
+        !end ||
+        !serviceName ||
+        !transactionType ||
+        !experimentalAlertsEnabled
+      ) {
+        return;
+      }
+
+      return callApmApi({
+        endpoint: 'GET /api/apm/services/{serviceName}/alerts',
+        params: {
+          path: {
+            serviceName,
+          },
+          query: {
+            start,
+            end,
+            transactionType,
+            environment,
+          },
+        },
+      }).catch((error) => {
+        console.error(error);
+        return {
+          alerts: [] as APMServiceAlert[],
+        };
+      });
+    },
+    [
+      start,
+      end,
+      serviceName,
+      transactionType,
+      environment,
+      experimentalAlertsEnabled,
+    ]
+  );
+
+  const { data, ...rest } = fetcherStatus;
+
+  return {
+    ...rest,
+    alerts: data?.alerts ?? [],
+  };
+}
diff --git a/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts b/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts
index 16a82b1d4972b3..0f1592ca2679fd 100644
--- a/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts
+++ b/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts
@@ -27,6 +27,7 @@ export function useTransactionLatencyChartsFetcher() {
       transactionName,
       latencyAggregationType,
       comparisonType,
+      comparisonEnabled,
     },
   } = useUrlParams();
 
@@ -34,6 +35,7 @@ export function useTransactionLatencyChartsFetcher() {
     start,
     end,
     comparisonType,
+    comparisonEnabled,
   });
 
   const { data, error, status } = useFetcher(
diff --git a/x-pack/plugins/apm/public/plugin.ts b/x-pack/plugins/apm/public/plugin.ts
index 391c54c1e24977..f7bbe647d8e37d 100644
--- a/x-pack/plugins/apm/public/plugin.ts
+++ b/x-pack/plugins/apm/public/plugin.ts
@@ -5,13 +5,8 @@
  * 2.0.
  */
 
-import { ConfigSchema } from '.';
-import {
-  FetchDataParams,
-  FormatterRuleRegistry,
-  HasDataParams,
-  ObservabilityPublicSetup,
-} from '../../observability/public';
+import { i18n } from '@kbn/i18n';
+import type { ConfigSchema } from '.';
 import {
   AppMountParameters,
   CoreSetup,
@@ -20,28 +15,35 @@ import {
   Plugin,
   PluginInitializerContext,
 } from '../../../../src/core/public';
-import {
+import type {
   DataPublicPluginSetup,
   DataPublicPluginStart,
 } from '../../../../src/plugins/data/public';
-import { HomePublicPluginSetup } from '../../../../src/plugins/home/public';
-import {
+import type { EmbeddableStart } from '../../../../src/plugins/embeddable/public';
+import type { HomePublicPluginSetup } from '../../../../src/plugins/home/public';
+import type {
   PluginSetupContract as AlertingPluginPublicSetup,
   PluginStartContract as AlertingPluginPublicStart,
 } from '../../alerting/public';
-import { FeaturesPluginSetup } from '../../features/public';
-import { LicensingPluginSetup } from '../../licensing/public';
-import {
+import type { FeaturesPluginSetup } from '../../features/public';
+import type { LicensingPluginSetup } from '../../licensing/public';
+import type { MapsStartApi } from '../../maps/public';
+import type { MlPluginSetup, MlPluginStart } from '../../ml/public';
+import type {
+  FetchDataParams,
+  HasDataParams,
+  ObservabilityPublicSetup,
+} from '../../observability/public';
+import { FormatterRuleRegistry } from '../../observability/public';
+import type {
   TriggersAndActionsUIPublicPluginSetup,
   TriggersAndActionsUIPublicPluginStart,
 } from '../../triggers_actions_ui/public';
+import { apmRuleRegistrySettings } from '../common/rules/apm_rule_registry_settings';
+import type { APMRuleFieldMap } from '../common/rules/apm_rule_field_map';
+import { registerApmAlerts } from './components/alerting/register_apm_alerts';
 import { featureCatalogueEntry } from './featureCatalogueEntry';
 import { toggleAppLinkInNav } from './toggleAppLinkInNav';
-import { EmbeddableStart } from '../../../../src/plugins/embeddable/public';
-import { registerApmAlerts } from './components/alerting/register_apm_alerts';
-import { MlPluginSetup, MlPluginStart } from '../../ml/public';
-import { MapsStartApi } from '../../maps/public';
-import { apmRuleRegistrySettings } from '../common/rules';
 
 export type ApmPluginSetup = ReturnType<ApmPlugin['setup']>;
 export type ApmRuleRegistry = ApmPluginSetup['ruleRegistry'];
@@ -85,54 +87,57 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
       pluginSetupDeps.home.featureCatalogue.register(featureCatalogueEntry);
     }
 
-    if (plugins.observability) {
-      const getApmDataHelper = async () => {
-        const {
-          fetchObservabilityOverviewPageData,
-          getHasData,
-          createCallApmApi,
-        } = await import('./services/rest/apm_observability_overview_fetchers');
-        // have to do this here as well in case app isn't mounted yet
-        createCallApmApi(core);
-
-        return { fetchObservabilityOverviewPageData, getHasData };
-      };
-      plugins.observability.dashboard.register({
-        appName: 'apm',
-        hasData: async () => {
-          const dataHelper = await getApmDataHelper();
-          return await dataHelper.getHasData();
-        },
-        fetchData: async (params: FetchDataParams) => {
-          const dataHelper = await getApmDataHelper();
-          return await dataHelper.fetchObservabilityOverviewPageData(params);
-        },
-      });
-
-      const getUxDataHelper = async () => {
-        const {
-          fetchUxOverviewDate,
-          hasRumData,
-          createCallApmApi,
-        } = await import('./components/app/RumDashboard/ux_overview_fetchers');
-        // have to do this here as well in case app isn't mounted yet
-        createCallApmApi(core);
-
-        return { fetchUxOverviewDate, hasRumData };
-      };
-
-      plugins.observability.dashboard.register({
-        appName: 'ux',
-        hasData: async (params?: HasDataParams) => {
-          const dataHelper = await getUxDataHelper();
-          return await dataHelper.hasRumData(params!);
-        },
-        fetchData: async (params: FetchDataParams) => {
-          const dataHelper = await getUxDataHelper();
-          return await dataHelper.fetchUxOverviewDate(params);
-        },
-      });
-    }
+    const apmRuleRegistry = plugins.observability.ruleRegistry.create({
+      ...apmRuleRegistrySettings,
+      fieldMap: {} as APMRuleFieldMap,
+      ctor: FormatterRuleRegistry,
+    });
+    const getApmDataHelper = async () => {
+      const {
+        fetchObservabilityOverviewPageData,
+        getHasData,
+        createCallApmApi,
+      } = await import('./services/rest/apm_observability_overview_fetchers');
+      // have to do this here as well in case app isn't mounted yet
+      createCallApmApi(core);
+
+      return { fetchObservabilityOverviewPageData, getHasData };
+    };
+    plugins.observability.dashboard.register({
+      appName: 'apm',
+      hasData: async () => {
+        const dataHelper = await getApmDataHelper();
+        return await dataHelper.getHasData();
+      },
+      fetchData: async (params: FetchDataParams) => {
+        const dataHelper = await getApmDataHelper();
+        return await dataHelper.fetchObservabilityOverviewPageData(params);
+      },
+    });
+
+    const getUxDataHelper = async () => {
+      const {
+        fetchUxOverviewDate,
+        hasRumData,
+        createCallApmApi,
+      } = await import('./components/app/RumDashboard/ux_overview_fetchers');
+      // have to do this here as well in case app isn't mounted yet
+      createCallApmApi(core);
+
+      return { fetchUxOverviewDate, hasRumData };
+    };
+
+    plugins.observability.dashboard.register({
+      appName: 'ux',
+      hasData: async (params?: HasDataParams) => {
+        const dataHelper = await getUxDataHelper();
+        return await dataHelper.hasRumData(params!);
+      },
+      fetchData: async (params: FetchDataParams) => {
+        const dataHelper = await getUxDataHelper();
+        return await dataHelper.fetchUxOverviewDate(params);
+      },
+    });
 
     core.application.register({
       id: 'apm',
@@ -142,29 +147,51 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
       appRoute: '/app/apm',
       icon: 'plugins/apm/public/icon.svg',
       category: DEFAULT_APP_CATEGORIES.observability,
+      meta: {
+        // !! Need to be kept in sync with the routes in x-pack/plugins/apm/public/components/app/Main/route_config/index.tsx
+        searchDeepLinks: [
+          {
+            id: 'services',
+            title: i18n.translate('xpack.apm.breadcrumb.servicesTitle', {
+              defaultMessage: 'Services',
+            }),
+            path: '/services',
+          },
+          {
+            id: 'traces',
+            title: i18n.translate('xpack.apm.breadcrumb.tracesTitle', {
+              defaultMessage: 'Traces',
+            }),
+            path: '/traces',
+          },
+          {
+            id: 'service-map',
+            title: i18n.translate('xpack.apm.breadcrumb.serviceMapTitle', {
+              defaultMessage: 'Service Map',
+            }),
+            path: '/service-map',
+          },
+        ],
+      },
 
-      async mount(params: AppMountParameters<unknown>) {
+      async mount(appMountParameters: AppMountParameters<unknown>) {
         // Load application bundle and Get start services
-        const [{ renderApp }, [coreStart, corePlugins]] = await Promise.all([
+        const [{ renderApp }, [coreStart, pluginsStart]] = await Promise.all([
           import('./application'),
           core.getStartServices(),
         ]);
 
-        return renderApp(
+        return renderApp({
           coreStart,
-          pluginSetupDeps,
-          params,
+          pluginsSetup: pluginSetupDeps,
+          appMountParameters,
           config,
-          corePlugins as ApmPluginStartDeps
-        );
+          pluginsStart: pluginsStart as ApmPluginStartDeps,
+          apmRuleRegistry,
+        });
       },
     });
 
-    const apmRuleRegistry = plugins.observability.ruleRegistry.create({
-      ...apmRuleRegistrySettings,
-      ctor: FormatterRuleRegistry,
-    });
-
     registerApmAlerts(apmRuleRegistry);
 
     core.application.register({
@@ -191,20 +218,21 @@ export class ApmPlugin implements Plugin<ApmPluginSetup, ApmPluginStart> {
           'web perf',
         ],
       },
-      async mount(params: AppMountParameters<unknown>) {
+      async mount(appMountParameters: AppMountParameters<unknown>) {
         // Load application bundle and Get start service
         const [{ renderApp }, [coreStart, corePlugins]] = await Promise.all([
           import('./application/csmApp'),
           core.getStartServices(),
         ]);
 
-        return renderApp(
-          coreStart,
-          pluginSetupDeps,
-          params,
+        return renderApp({
+          core: coreStart,
+          deps: pluginSetupDeps,
+          appMountParameters,
           config,
-          corePlugins as ApmPluginStartDeps
-        );
+          corePlugins: corePlugins as ApmPluginStartDeps,
+          apmRuleRegistry,
+        });
       },
     });
 
diff --git a/x-pack/plugins/apm/public/selectors/latency_chart_selector.test.ts b/x-pack/plugins/apm/public/selectors/latency_chart_selector.test.ts
index 252ced2be5e0ec..808beb72f2e7ae 100644
--- a/x-pack/plugins/apm/public/selectors/latency_chart_selector.test.ts
+++ b/x-pack/plugins/apm/public/selectors/latency_chart_selector.test.ts
@@ -18,7 +18,7 @@ const theme = {
     euiColorVis5: 'red',
     euiColorVis7: 'black',
     euiColorVis9: 'yellow',
-    euiColorLightestShade: 'green',
+    euiColorMediumShade: 'green',
   },
 } as EuiTheme;
 
diff --git a/x-pack/plugins/apm/public/selectors/latency_chart_selectors.ts b/x-pack/plugins/apm/public/selectors/latency_chart_selectors.ts
index 2ee4a717106ebf..a84a4abfe58109 100644
--- a/x-pack/plugins/apm/public/selectors/latency_chart_selectors.ts
+++ b/x-pack/plugins/apm/public/selectors/latency_chart_selectors.ts
@@ -65,7 +65,7 @@ function getPreviousPeriodTimeseries({
   return {
     data: previousPeriod.latencyTimeseries ?? [],
     type: 'area',
-    color: theme.eui.euiColorLightestShade,
+    color: theme.eui.euiColorMediumShade,
     title: i18n.translate(
       'xpack.apm.serviceOverview.latencyChartTitle.previousPeriodLabel',
       { defaultMessage: 'Previous period' }
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.test.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.test.ts
index b9346b2bf4649b..ad1a8fcbf6e55c 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.test.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 import { registerTransactionDurationAnomalyAlertType } from './register_transaction_duration_anomaly_alert_type';
-import { ANOMALY_SEVERITY } from '../../../../ml/common';
+import { ANOMALY_SEVERITY } from '../../../common/ml_constants';
 import { Job, MlPluginSetup } from '../../../../ml/server';
 import * as GetServiceAnomalies from '../service_map/get_service_anomalies';
 import { createRuleTypeMocks } from './test_utils';
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
index 66eb7125b03700..67ff7cdb8e4e07 100644
--- a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts
@@ -18,7 +18,7 @@ import {
   TRANSACTION_TYPE,
 } from '../../../common/elasticsearch_fieldnames';
 import { asMutableArray } from '../../../common/utils/as_mutable_array';
-import { ANOMALY_SEVERITY } from '../../../../ml/common';
+import { ANOMALY_SEVERITY } from '../../../common/ml_constants';
 import { KibanaRequest } from '../../../../../../src/core/server';
 import {
   AlertType,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
new file mode 100644
index 00000000000000..6356731cc48d15
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/services/get_service_alerts.ts
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+} from '../../../common/elasticsearch_fieldnames';
+import type { PromiseReturnType } from '../../../../observability/typings/common';
+import type { APMRuleRegistry } from '../../plugin';
+import { environmentQuery, rangeQuery } from '../../utils/queries';
+
+export async function getServiceAlerts({
+  apmRuleRegistryClient,
+  start,
+  end,
+  serviceName,
+  environment,
+  transactionType,
+}: {
+  apmRuleRegistryClient: Exclude<
+    PromiseReturnType<APMRuleRegistry['createScopedRuleRegistryClient']>,
+    undefined
+  >;
+  start: number;
+  end: number;
+  serviceName: string;
+  environment?: string;
+  transactionType: string;
+}) {
+  const response = await apmRuleRegistryClient.search({
+    body: {
+      query: {
+        bool: {
+          filter: [
+            ...rangeQuery(start, end),
+            ...environmentQuery(environment),
+            { term: { [SERVICE_NAME]: serviceName } },
+          ],
+          should: [
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      [TRANSACTION_TYPE]: transactionType,
+                    },
+                  },
+                ],
+              },
+            },
+            {
+              bool: {
+                must_not: {
+                  exists: {
+                    field: TRANSACTION_TYPE,
+                  },
+                },
+              },
+            },
+          ],
+          minimum_should_match: 1,
+        },
+      },
+      size: 100,
+      fields: ['*'],
+      collapse: {
+        field: 'kibana.rac.alert.uuid',
+      },
+      sort: {
+        '@timestamp': 'desc',
+      },
+    },
+  });
+
+  return response.events;
+}
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_comparison_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_detailed_statistics.ts
similarity index 94%
rename from x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_comparison_statistics.ts
rename to x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_detailed_statistics.ts
index b559f55bbe78ec..dd41269f0bad6d 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_comparison_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_detailed_statistics.ts
@@ -22,7 +22,7 @@ import { withApmSpan } from '../../../utils/with_apm_span';
 import { getBucketSize } from '../../helpers/get_bucket_size';
 import { Setup, SetupTimeRange } from '../../helpers/setup_request';
 
-export async function getServiceErrorGroupComparisonStatistics({
+export async function getServiceErrorGroupDetailedStatistics({
   kuery,
   serviceName,
   setup,
@@ -44,7 +44,7 @@ export async function getServiceErrorGroupComparisonStatistics({
   end: number;
 }): Promise<Array<{ groupId: string; timeseries: Coordinate[] }>> {
   return withApmSpan(
-    'get_service_error_group_comparison_statistics',
+    'get_service_error_group_detailed_statistics',
     async () => {
       const { apmEventClient } = setup;
 
@@ -147,7 +147,7 @@ export async function getServiceErrorGroupPeriods({
     groupIds,
   };
 
-  const currentPeriodPromise = getServiceErrorGroupComparisonStatistics({
+  const currentPeriodPromise = getServiceErrorGroupDetailedStatistics({
     ...commonProps,
     start,
     end,
@@ -155,7 +155,7 @@ export async function getServiceErrorGroupPeriods({
 
   const previousPeriodPromise =
     comparisonStart && comparisonEnd
-      ? getServiceErrorGroupComparisonStatistics({
+      ? getServiceErrorGroupDetailedStatistics({
           ...commonProps,
           start: comparisonStart,
           end: comparisonEnd,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_primary_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts
similarity index 95%
rename from x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_primary_statistics.ts
rename to x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts
index 13a60698763699..361c92244aee06 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_primary_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts
@@ -23,7 +23,7 @@ import { withApmSpan } from '../../../utils/with_apm_span';
 import { getErrorName } from '../../helpers/get_error_name';
 import { Setup, SetupTimeRange } from '../../helpers/setup_request';
 
-export function getServiceErrorGroupPrimaryStatistics({
+export function getServiceErrorGroupMainStatistics({
   kuery,
   serviceName,
   setup,
@@ -36,7 +36,7 @@ export function getServiceErrorGroupPrimaryStatistics({
   transactionType: string;
   environment?: string;
 }) {
-  return withApmSpan('get_service_error_group_primary_statistics', async () => {
+  return withApmSpan('get_service_error_group_main_statistics', async () => {
     const { apmEventClient, start, end } = setup;
 
     const response = await apmEventClient.search({
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_instances/comparison_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_instances/detailed_statistics.ts
similarity index 80%
rename from x-pack/plugins/apm/server/lib/services/get_service_instances/comparison_statistics.ts
rename to x-pack/plugins/apm/server/lib/services/get_service_instances/detailed_statistics.ts
index 6fca42723b9cce..85414100a1563a 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_instances/comparison_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_instances/detailed_statistics.ts
@@ -15,7 +15,7 @@ import { Setup, SetupTimeRange } from '../../helpers/setup_request';
 import { getServiceInstancesSystemMetricStatistics } from './get_service_instances_system_metric_statistics';
 import { getServiceInstancesTransactionStatistics } from './get_service_instances_transaction_statistics';
 
-interface ServiceInstanceComparisonStatisticsParams {
+interface ServiceInstanceDetailedStatisticsParams {
   environment?: string;
   kuery?: string;
   latencyAggregationType: LatencyAggregationType;
@@ -29,8 +29,8 @@ interface ServiceInstanceComparisonStatisticsParams {
   serviceNodeIds: string[];
 }
 
-async function getServiceInstancesComparisonStatistics(
-  params: ServiceInstanceComparisonStatisticsParams
+async function getServiceInstancesDetailedStatistics(
+  params: ServiceInstanceDetailedStatisticsParams
 ): Promise<
   Array<{
     serviceNodeName: string;
@@ -41,31 +41,28 @@ async function getServiceInstancesComparisonStatistics(
     memoryUsage?: Coordinate[];
   }>
 > {
-  return withApmSpan(
-    'get_service_instances_comparison_statistics',
-    async () => {
-      const [transactionStats, systemMetricStats = []] = await Promise.all([
-        getServiceInstancesTransactionStatistics({
-          ...params,
-          isComparisonSearch: true,
-        }),
-        getServiceInstancesSystemMetricStatistics({
-          ...params,
-          isComparisonSearch: true,
-        }),
-      ]);
+  return withApmSpan('get_service_instances_detailed_statistics', async () => {
+    const [transactionStats, systemMetricStats = []] = await Promise.all([
+      getServiceInstancesTransactionStatistics({
+        ...params,
+        isComparisonSearch: true,
+      }),
+      getServiceInstancesSystemMetricStatistics({
+        ...params,
+        isComparisonSearch: true,
+      }),
+    ]);
 
-      const stats = joinByKey(
-        [...transactionStats, ...systemMetricStats],
-        'serviceNodeName'
-      );
+    const stats = joinByKey(
+      [...transactionStats, ...systemMetricStats],
+      'serviceNodeName'
+    );
 
-      return stats;
-    }
-  );
+    return stats;
+  });
 }
 
-export async function getServiceInstancesComparisonStatisticsPeriods({
+export async function getServiceInstancesDetailedStatisticsPeriods({
   environment,
   kuery,
   latencyAggregationType,
@@ -91,7 +88,7 @@ export async function getServiceInstancesComparisonStatisticsPeriods({
   comparisonEnd?: number;
 }) {
   return withApmSpan(
-    'get_service_instances_comparison_statistics_periods',
+    'get_service_instances_detailed_statistics_periods',
     async () => {
       const { start, end } = setup;
 
@@ -107,7 +104,7 @@ export async function getServiceInstancesComparisonStatisticsPeriods({
         serviceNodeIds,
       };
 
-      const currentPeriodPromise = getServiceInstancesComparisonStatistics({
+      const currentPeriodPromise = getServiceInstancesDetailedStatistics({
         ...commonParams,
         start,
         end,
@@ -115,7 +112,7 @@ export async function getServiceInstancesComparisonStatisticsPeriods({
 
       const previousPeriodPromise =
         comparisonStart && comparisonEnd
-          ? getServiceInstancesComparisonStatistics({
+          ? getServiceInstancesDetailedStatistics({
               ...commonParams,
               start: comparisonStart,
               end: comparisonEnd,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_instances/primary_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_instances/main_statistics.ts
similarity index 87%
rename from x-pack/plugins/apm/server/lib/services/get_service_instances/primary_statistics.ts
rename to x-pack/plugins/apm/server/lib/services/get_service_instances/main_statistics.ts
index 3cd98558eff02b..8bfa67f8c6247e 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_instances/primary_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_instances/main_statistics.ts
@@ -12,7 +12,7 @@ import { Setup, SetupTimeRange } from '../../helpers/setup_request';
 import { getServiceInstancesSystemMetricStatistics } from './get_service_instances_system_metric_statistics';
 import { getServiceInstancesTransactionStatistics } from './get_service_instances_transaction_statistics';
 
-interface ServiceInstancePrimaryStatisticsParams {
+interface ServiceInstanceMainStatisticsParams {
   environment?: string;
   kuery?: string;
   latencyAggregationType: LatencyAggregationType;
@@ -25,8 +25,8 @@ interface ServiceInstancePrimaryStatisticsParams {
   end: number;
 }
 
-export async function getServiceInstancesPrimaryStatistics(
-  params: Omit<ServiceInstancePrimaryStatisticsParams, 'size'>
+export async function getServiceInstancesMainStatistics(
+  params: Omit<ServiceInstanceMainStatisticsParams, 'size'>
 ): Promise<
   Array<{
     serviceNodeName: string;
@@ -37,7 +37,7 @@ export async function getServiceInstancesPrimaryStatistics(
     memoryUsage?: number | null;
   }>
 > {
-  return withApmSpan('get_service_instances_primary_statistics', async () => {
+  return withApmSpan('get_service_instances_main_statistics', async () => {
     const paramsForSubQueries = {
       ...params,
       size: 50,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_transaction_group_comparison_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_transaction_group_detailed_statistics.ts
similarity index 95%
rename from x-pack/plugins/apm/server/lib/services/get_service_transaction_group_comparison_statistics.ts
rename to x-pack/plugins/apm/server/lib/services/get_service_transaction_group_detailed_statistics.ts
index 54e882d1dd6da2..314d6c7bd14589 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_transaction_group_comparison_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_transaction_group_detailed_statistics.ts
@@ -35,7 +35,7 @@ import {
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
 import { calculateTransactionErrorPercentage } from '../helpers/transaction_error_rate';
 
-export async function getServiceTransactionGroupComparisonStatistics({
+export async function getServiceTransactionGroupDetailedStatistics({
   environment,
   kuery,
   serviceName,
@@ -69,7 +69,7 @@ export async function getServiceTransactionGroupComparisonStatistics({
   }>
 > {
   return withApmSpan(
-    'get_service_transaction_group_comparison_statistics',
+    'get_service_transaction_group_detailed_statistics',
     async () => {
       const { apmEventClient } = setup;
       const { intervalString } = getBucketSize({ start, end, numBuckets });
@@ -185,7 +185,7 @@ export async function getServiceTransactionGroupComparisonStatistics({
   );
 }
 
-export async function getServiceTransactionGroupComparisonStatisticsPeriods({
+export async function getServiceTransactionGroupDetailedStatisticsPeriods({
   serviceName,
   transactionNames,
   setup,
@@ -224,7 +224,7 @@ export async function getServiceTransactionGroupComparisonStatisticsPeriods({
     kuery,
   };
 
-  const currentPeriodPromise = getServiceTransactionGroupComparisonStatistics({
+  const currentPeriodPromise = getServiceTransactionGroupDetailedStatistics({
     ...commonProps,
     start,
     end,
@@ -232,7 +232,7 @@ export async function getServiceTransactionGroupComparisonStatisticsPeriods({
 
   const previousPeriodPromise =
     comparisonStart && comparisonEnd
-      ? getServiceTransactionGroupComparisonStatistics({
+      ? getServiceTransactionGroupDetailedStatistics({
           ...commonProps,
           start: comparisonStart,
           end: comparisonEnd,
diff --git a/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/index.ts b/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/index.ts
index a03b1ac82e90a6..bcd279c57f4a57 100644
--- a/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/get_anomaly_data/index.ts
@@ -14,7 +14,7 @@ import { getBucketSize } from '../../helpers/get_bucket_size';
 import { Setup, SetupTimeRange } from '../../helpers/setup_request';
 import { anomalySeriesFetcher } from './fetcher';
 import { getMLJobIds } from '../../service_map/get_service_anomalies';
-import { ANOMALY_THRESHOLD } from '../../../../../ml/common';
+import { ANOMALY_THRESHOLD } from '../../../../common/ml_constants';
 import { withApmSpan } from '../../../utils/with_apm_span';
 
 export async function getAnomalySeries({
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index 714b887a4008ba..e12d0898558347 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -42,7 +42,8 @@ import {
 } from './types';
 import { registerRoutes } from './routes/register_routes';
 import { getGlobalApmServerRouteRepository } from './routes/get_global_apm_server_route_repository';
-import { apmRuleRegistrySettings } from '../common/rules';
+import { apmRuleRegistrySettings } from '../common/rules/apm_rule_registry_settings';
+import { apmRuleFieldMap } from '../common/rules/apm_rule_field_map';
 
 export type APMRuleRegistry = ReturnType<APMPlugin['setup']>['ruleRegistry'];
 
@@ -123,6 +124,11 @@ export class APMPlugin
 
     registerFeaturesUsage({ licensingPlugin: plugins.licensing });
 
+    const apmRuleRegistry = plugins.observability.ruleRegistry.create({
+      ...apmRuleRegistrySettings,
+      fieldMap: apmRuleFieldMap,
+    });
+
     registerRoutes({
       core: {
         setup: core,
@@ -131,6 +137,7 @@ export class APMPlugin
       logger: this.logger,
       config: currentConfig,
       repository: getGlobalApmServerRouteRepository(),
+      apmRuleRegistry,
       plugins: mapValues(plugins, (value, key) => {
         return {
           setup: value,
@@ -150,11 +157,6 @@ export class APMPlugin
         savedObjectsClient: await getInternalSavedObjectsClient(core),
         config: await mergedConfig$.pipe(take(1)).toPromise(),
       });
-
-    const apmRuleRegistry = plugins.observability.ruleRegistry.create(
-      apmRuleRegistrySettings
-    );
-
     registerApmAlerts({
       registry: apmRuleRegistry,
       ml: plugins.ml,
diff --git a/x-pack/plugins/apm/server/routes/register_routes/index.ts b/x-pack/plugins/apm/server/routes/register_routes/index.ts
index 3a88a496b923f5..f792e078c528a5 100644
--- a/x-pack/plugins/apm/server/routes/register_routes/index.ts
+++ b/x-pack/plugins/apm/server/routes/register_routes/index.ts
@@ -39,12 +39,14 @@ export function registerRoutes({
   plugins,
   logger,
   config,
+  apmRuleRegistry,
 }: {
   core: APMRouteHandlerResources['core'];
   plugins: APMRouteHandlerResources['plugins'];
   logger: APMRouteHandlerResources['logger'];
   repository: ServerRouteRepository<APMRouteHandlerResources>;
   config: APMRouteHandlerResources['config'];
+  apmRuleRegistry: APMRouteHandlerResources['apmRuleRegistry'];
 }) {
   const routes = repository.getRoutes();
 
@@ -97,6 +99,7 @@ export function registerRoutes({
               },
               validatedParams
             ),
+            apmRuleRegistry,
           })) as any;
 
           if (Array.isArray(data)) {
diff --git a/x-pack/plugins/apm/server/routes/services.ts b/x-pack/plugins/apm/server/routes/services.ts
index 3ac76d4a5b4c25..30aa4cce45d04e 100644
--- a/x-pack/plugins/apm/server/routes/services.ts
+++ b/x-pack/plugins/apm/server/routes/services.ts
@@ -16,11 +16,12 @@ import { setupRequest } from '../lib/helpers/setup_request';
 import { getServiceAnnotations } from '../lib/services/annotations';
 import { getServices } from '../lib/services/get_services';
 import { getServiceAgentName } from '../lib/services/get_service_agent_name';
+import { getServiceAlerts } from '../lib/services/get_service_alerts';
 import { getServiceDependencies } from '../lib/services/get_service_dependencies';
-import { getServiceErrorGroupPeriods } from '../lib/services/get_service_error_groups/get_service_error_group_comparison_statistics';
-import { getServiceErrorGroupPrimaryStatistics } from '../lib/services/get_service_error_groups/get_service_error_group_primary_statistics';
-import { getServiceInstancesComparisonStatisticsPeriods } from '../lib/services/get_service_instances/comparison_statistics';
-import { getServiceInstancesPrimaryStatistics } from '../lib/services/get_service_instances/primary_statistics';
+import { getServiceErrorGroupPeriods } from '../lib/services/get_service_error_groups/get_service_error_group_detailed_statistics';
+import { getServiceErrorGroupMainStatistics } from '../lib/services/get_service_error_groups/get_service_error_group_main_statistics';
+import { getServiceInstancesDetailedStatisticsPeriods } from '../lib/services/get_service_instances/detailed_statistics';
+import { getServiceInstancesMainStatistics } from '../lib/services/get_service_instances/main_statistics';
 import { getServiceMetadataDetails } from '../lib/services/get_service_metadata_details';
 import { getServiceMetadataIcons } from '../lib/services/get_service_metadata_icons';
 import { getServiceNodeMetadata } from '../lib/services/get_service_node_metadata';
@@ -292,9 +293,8 @@ const serviceAnnotationsCreateRoute = createApmServerRoute({
   },
 });
 
-const serviceErrorGroupsPrimaryStatisticsRoute = createApmServerRoute({
-  endpoint:
-    'GET /api/apm/services/{serviceName}/error_groups/primary_statistics',
+const serviceErrorGroupsMainStatisticsRoute = createApmServerRoute({
+  endpoint: 'GET /api/apm/services/{serviceName}/error_groups/main_statistics',
   params: t.type({
     path: t.type({
       serviceName: t.string,
@@ -317,7 +317,7 @@ const serviceErrorGroupsPrimaryStatisticsRoute = createApmServerRoute({
       path: { serviceName },
       query: { kuery, transactionType, environment },
     } = params;
-    return getServiceErrorGroupPrimaryStatistics({
+    return getServiceErrorGroupMainStatistics({
       kuery,
       serviceName,
       setup,
@@ -327,9 +327,9 @@ const serviceErrorGroupsPrimaryStatisticsRoute = createApmServerRoute({
   },
 });
 
-const serviceErrorGroupsComparisonStatisticsRoute = createApmServerRoute({
+const serviceErrorGroupsDetailedStatisticsRoute = createApmServerRoute({
   endpoint:
-    'GET /api/apm/services/{serviceName}/error_groups/comparison_statistics',
+    'GET /api/apm/services/{serviceName}/error_groups/detailed_statistics',
   params: t.type({
     path: t.type({
       serviceName: t.string,
@@ -444,9 +444,9 @@ const serviceThroughputRoute = createApmServerRoute({
   },
 });
 
-const serviceInstancesPrimaryStatisticsRoute = createApmServerRoute({
+const serviceInstancesMainStatisticsRoute = createApmServerRoute({
   endpoint:
-    'GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics',
+    'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics',
   params: t.type({
     path: t.type({
       serviceName: t.string,
@@ -479,7 +479,7 @@ const serviceInstancesPrimaryStatisticsRoute = createApmServerRoute({
 
     const { start, end } = setup;
 
-    const serviceInstances = await getServiceInstancesPrimaryStatistics({
+    const serviceInstances = await getServiceInstancesMainStatistics({
       environment,
       kuery,
       latencyAggregationType,
@@ -495,9 +495,9 @@ const serviceInstancesPrimaryStatisticsRoute = createApmServerRoute({
   },
 });
 
-const serviceInstancesComparisonStatisticsRoute = createApmServerRoute({
+const serviceInstancesDetailedStatisticsRoute = createApmServerRoute({
   endpoint:
-    'GET /api/apm/services/{serviceName}/service_overview_instances/comparison_statistics',
+    'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics',
   params: t.type({
     path: t.type({
       serviceName: t.string,
@@ -535,7 +535,7 @@ const serviceInstancesComparisonStatisticsRoute = createApmServerRoute({
       setup
     );
 
-    return getServiceInstancesComparisonStatisticsPeriods({
+    return getServiceInstancesDetailedStatisticsPeriods({
       environment,
       kuery,
       latencyAggregationType,
@@ -662,6 +662,57 @@ const serviceProfilingStatisticsRoute = createApmServerRoute({
   },
 });
 
+const serviceAlertsRoute = createApmServerRoute({
+  endpoint: 'GET /api/apm/services/{serviceName}/alerts',
+  params: t.type({
+    path: t.type({
+      serviceName: t.string,
+    }),
+    query: t.intersection([
+      rangeRt,
+      environmentRt,
+      t.type({
+        transactionType: t.string,
+      }),
+    ]),
+  }),
+  options: {
+    tags: ['access:apm'],
+  },
+  handler: async ({ context, params, apmRuleRegistry }) => {
+    const alertsClient = context.alerting.getAlertsClient();
+
+    const {
+      query: { start, end, environment, transactionType },
+      path: { serviceName },
+    } = params;
+
+    const apmRuleRegistryClient = await apmRuleRegistry.createScopedRuleRegistryClient(
+      {
+        alertsClient,
+        context,
+      }
+    );
+
+    if (!apmRuleRegistryClient) {
+      throw Boom.failedDependency(
+        'xpack.ruleRegistry.unsafe.write.enabled is set to false'
+      );
+    }
+
+    return {
+      alerts: await getServiceAlerts({
+        apmRuleRegistryClient,
+        start,
+        end,
+        serviceName,
+        environment,
+        transactionType,
+      }),
+    };
+  },
+});
+
 export const serviceRouteRepository = createApmServerRouteRepository()
   .add(servicesRoute)
   .add(serviceMetadataDetailsRoute)
@@ -671,11 +722,12 @@ export const serviceRouteRepository = createApmServerRouteRepository()
   .add(serviceNodeMetadataRoute)
   .add(serviceAnnotationsRoute)
   .add(serviceAnnotationsCreateRoute)
-  .add(serviceErrorGroupsPrimaryStatisticsRoute)
-  .add(serviceErrorGroupsComparisonStatisticsRoute)
+  .add(serviceErrorGroupsMainStatisticsRoute)
+  .add(serviceErrorGroupsDetailedStatisticsRoute)
   .add(serviceThroughputRoute)
-  .add(serviceInstancesPrimaryStatisticsRoute)
-  .add(serviceInstancesComparisonStatisticsRoute)
+  .add(serviceInstancesMainStatisticsRoute)
+  .add(serviceInstancesDetailedStatisticsRoute)
   .add(serviceDependenciesRoute)
   .add(serviceProfilingTimelineRoute)
-  .add(serviceProfilingStatisticsRoute);
+  .add(serviceProfilingStatisticsRoute)
+  .add(serviceAlertsRoute);
diff --git a/x-pack/plugins/apm/server/routes/transactions.ts b/x-pack/plugins/apm/server/routes/transactions.ts
index b323801430dba7..bcc554e552fc33 100644
--- a/x-pack/plugins/apm/server/routes/transactions.ts
+++ b/x-pack/plugins/apm/server/routes/transactions.ts
@@ -15,7 +15,7 @@ import {
 import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 import { setupRequest } from '../lib/helpers/setup_request';
 import { getServiceTransactionGroups } from '../lib/services/get_service_transaction_groups';
-import { getServiceTransactionGroupComparisonStatisticsPeriods } from '../lib/services/get_service_transaction_group_comparison_statistics';
+import { getServiceTransactionGroupDetailedStatisticsPeriods } from '../lib/services/get_service_transaction_group_detailed_statistics';
 import { getTransactionBreakdown } from '../lib/transactions/breakdown';
 import { getTransactionDistribution } from '../lib/transactions/distribution';
 import { getAnomalySeries } from '../lib/transactions/get_anomaly_data';
@@ -34,7 +34,7 @@ import {
 
 /**
  * Returns a list of transactions grouped by name
- * //TODO: delete this once we moved away from the old table in the transaction overview page. It should be replaced by /transactions/groups/primary_statistics/
+ * //TODO: delete this once we moved away from the old table in the transaction overview page. It should be replaced by /transactions/groups/main_statistics/
  */
 const transactionGroupsRoute = createApmServerRoute({
   endpoint: 'GET /api/apm/services/{serviceName}/transactions/groups',
@@ -74,9 +74,9 @@ const transactionGroupsRoute = createApmServerRoute({
   },
 });
 
-const transactionGroupsPrimaryStatisticsRoute = createApmServerRoute({
+const transactionGroupsMainStatisticsRoute = createApmServerRoute({
   endpoint:
-    'GET /api/apm/services/{serviceName}/transactions/groups/primary_statistics',
+    'GET /api/apm/services/{serviceName}/transactions/groups/main_statistics',
   params: t.type({
     path: t.type({ serviceName: t.string }),
     query: t.intersection([
@@ -117,9 +117,9 @@ const transactionGroupsPrimaryStatisticsRoute = createApmServerRoute({
   },
 });
 
-const transactionGroupsComparisonStatisticsRoute = createApmServerRoute({
+const transactionGroupsDetailedStatisticsRoute = createApmServerRoute({
   endpoint:
-    'GET /api/apm/services/{serviceName}/transactions/groups/comparison_statistics',
+    'GET /api/apm/services/{serviceName}/transactions/groups/detailed_statistics',
   params: t.type({
     path: t.type({ serviceName: t.string }),
     query: t.intersection([
@@ -161,7 +161,7 @@ const transactionGroupsComparisonStatisticsRoute = createApmServerRoute({
       },
     } = params;
 
-    return await getServiceTransactionGroupComparisonStatisticsPeriods({
+    return await getServiceTransactionGroupDetailedStatisticsPeriods({
       environment,
       kuery,
       setup,
@@ -431,8 +431,8 @@ const transactionChartsErrorRateRoute = createApmServerRoute({
 
 export const transactionRouteRepository = createApmServerRouteRepository()
   .add(transactionGroupsRoute)
-  .add(transactionGroupsPrimaryStatisticsRoute)
-  .add(transactionGroupsComparisonStatisticsRoute)
+  .add(transactionGroupsMainStatisticsRoute)
+  .add(transactionGroupsDetailedStatisticsRoute)
   .add(transactionLatencyChartsRoute)
   .add(transactionThroughputChartsRoute)
   .add(transactionChartsDistributionRoute)
diff --git a/x-pack/plugins/apm/server/routes/typings.ts b/x-pack/plugins/apm/server/routes/typings.ts
index 517387c5f74efb..602e1f3e0edb95 100644
--- a/x-pack/plugins/apm/server/routes/typings.ts
+++ b/x-pack/plugins/apm/server/routes/typings.ts
@@ -12,12 +12,15 @@ import {
   KibanaRequest,
   CoreStart,
 } from 'src/core/server';
+import { AlertingApiRequestHandlerContext } from '../../../alerting/server';
 import { LicensingApiRequestHandlerContext } from '../../../licensing/server';
 import { APMConfig } from '..';
 import { APMPluginDependencies } from '../types';
+import { APMRuleRegistry } from '../plugin';
 
 export interface ApmPluginRequestHandlerContext extends RequestHandlerContext {
   licensing: LicensingApiRequestHandlerContext;
+  alerting: AlertingApiRequestHandlerContext;
 }
 
 export type InspectResponse = Array<{
@@ -59,4 +62,5 @@ export interface APMRouteHandlerResources {
       start: () => Promise<Required<APMPluginDependencies>[key]['start']>;
     };
   };
+  apmRuleRegistry: APMRuleRegistry;
 }
diff --git a/x-pack/plugins/canvas/public/application.tsx b/x-pack/plugins/canvas/public/application.tsx
index f910aff9a83fe3..154beb6faa7b03 100644
--- a/x-pack/plugins/canvas/public/application.tsx
+++ b/x-pack/plugins/canvas/public/application.tsx
@@ -24,7 +24,6 @@ import { KibanaContextProvider } from '../../../../src/plugins/kibana_react/publ
 import { registerLanguage } from './lib/monaco_language_def';
 import { SetupRegistries } from './plugin_api';
 import { initRegistries, populateRegistries, destroyRegistries } from './registries';
-import { getDocumentationLinks } from './lib/documentation_links';
 import { HelpMenu } from './components/help_menu/help_menu';
 import { createStore } from './store';
 
@@ -127,6 +126,8 @@ export const initializeCanvas = async (
         }
   );
 
+  // Setup documentation links
+  const { docLinks } = coreStart;
   // Set help extensions
   coreStart.chrome.setHelpExtension({
     appName: i18n.translate('xpack.canvas.helpMenu.appName', {
@@ -135,7 +136,7 @@ export const initializeCanvas = async (
     links: [
       {
         linkType: 'documentation',
-        href: getDocumentationLinks().canvas,
+        href: docLinks.links.canvas.guide,
       },
     ],
     content: (domNode) => {
diff --git a/x-pack/plugins/canvas/public/lib/documentation_links.ts b/x-pack/plugins/canvas/public/lib/documentation_links.ts
deleted file mode 100644
index e76ab6d1db54b9..00000000000000
--- a/x-pack/plugins/canvas/public/lib/documentation_links.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { platformService } from '../services';
-
-export const getDocumentationLinks = () => ({
-  canvas: `${platformService
-    .getService()
-    .getElasticWebsiteUrl()}guide/en/kibana/${platformService
-    .getService()
-    .getDocLinkVersion()}/canvas.html`,
-  numeral: `${platformService
-    .getService()
-    .getElasticWebsiteUrl()}guide/en/kibana/${platformService
-    .getService()
-    .getDocLinkVersion()}/guide/numeral.html`,
-});
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/drilldown_shared.ts b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/drilldown_shared.ts
index c42bbde22ce31a..ce96b3497e9fff 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/drilldown_shared.ts
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/drilldown_shared.ts
@@ -9,7 +9,11 @@ import { APPLY_FILTER_TRIGGER } from '../../../../../../../src/plugins/data/publ
 import {
   SELECT_RANGE_TRIGGER,
   VALUE_CLICK_TRIGGER,
+  IEmbeddable,
+  Container as EmbeddableContainer,
 } from '../../../../../../../src/plugins/embeddable/public';
+import { isEnhancedEmbeddable } from '../../../../../embeddable_enhanced/public';
+import { UiActionsEnhancedDrilldownTemplate as DrilldownTemplate } from '../../../../../ui_actions_enhanced/public';
 
 /**
  * We know that VALUE_CLICK_TRIGGER and SELECT_RANGE_TRIGGER are also triggering APPLY_FILTER_TRIGGER.
@@ -31,3 +35,47 @@ export function ensureNestedTriggers(triggers: string[]): string[] {
 
   return triggers;
 }
+
+const isEmbeddableContainer = (x: unknown): x is EmbeddableContainer =>
+  x instanceof EmbeddableContainer;
+
+/**
+ * Given a dashboard panel embeddable, it will find the parent (dashboard
+ * container embeddable), then iterate through all the dashboard panels and
+ * generate DrilldownTemplate for each existing drilldown.
+ */
+export const createDrilldownTemplatesFromSiblings = (
+  embeddable: IEmbeddable
+): DrilldownTemplate[] => {
+  const templates: DrilldownTemplate[] = [];
+  const embeddableId = embeddable.id;
+
+  const container = embeddable.getRoot();
+
+  if (!container) return templates;
+  if (!isEmbeddableContainer(container)) return templates;
+
+  const childrenIds = (container as EmbeddableContainer).getChildIds();
+
+  for (const childId of childrenIds) {
+    const child = (container as EmbeddableContainer).getChild(childId);
+    if (child.id === embeddableId) continue;
+    if (!isEnhancedEmbeddable(child)) continue;
+    const events = child.enhancements.dynamicActions.state.get().events;
+
+    for (const event of events) {
+      const template: DrilldownTemplate = {
+        id: event.eventId,
+        name: event.action.name,
+        icon: 'dashboardApp',
+        description: child.getTitle() || child.id,
+        config: event.action.config,
+        factoryId: event.action.factoryId,
+        triggers: event.triggers,
+      };
+      templates.push(template);
+    }
+  }
+
+  return templates;
+};
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx
index 2f91cdc71581cd..4c0db8f317e516 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/flyout_create_drilldown.tsx
@@ -9,17 +9,17 @@ import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { Action } from '../../../../../../../../src/plugins/ui_actions/public';
 import { toMountPoint } from '../../../../../../../../src/plugins/kibana_react/public';
-import {
-  isEnhancedEmbeddable,
-  embeddableEnhancedDrilldownGrouping,
-} from '../../../../../../embeddable_enhanced/public';
 import {
   CONTEXT_MENU_TRIGGER,
   EmbeddableContext,
 } from '../../../../../../../../src/plugins/embeddable/public';
+import {
+  isEnhancedEmbeddable,
+  embeddableEnhancedDrilldownGrouping,
+} from '../../../../../../embeddable_enhanced/public';
 import { StartDependencies } from '../../../../plugin';
 import { StartServicesGetter } from '../../../../../../../../src/plugins/kibana_utils/public';
-import { ensureNestedTriggers } from '../drilldown_shared';
+import { ensureNestedTriggers, createDrilldownTemplatesFromSiblings } from '../drilldown_shared';
 
 export const OPEN_FLYOUT_ADD_DRILLDOWN = 'OPEN_FLYOUT_ADD_DRILLDOWN';
 
@@ -81,14 +81,18 @@ export class FlyoutCreateDrilldownAction implements Action<EmbeddableContext> {
       );
     }
 
+    const templates = createDrilldownTemplatesFromSiblings(embeddable);
+
     const handle = core.overlays.openFlyout(
       toMountPoint(
-        <plugins.uiActionsEnhanced.FlyoutManageDrilldowns
-          onClose={() => handle.close()}
-          viewMode={'create'}
+        <plugins.uiActionsEnhanced.DrilldownManager
+          closeAfterCreate
+          initialRoute={'/new'}
           dynamicActionManager={embeddable.enhancements.dynamicActions}
           triggers={[...ensureNestedTriggers(embeddable.supportedTriggers()), CONTEXT_MENU_TRIGGER]}
           placeContext={{ embeddable }}
+          templates={templates}
+          onClose={() => handle.close()}
         />
       ),
       {
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx
index e3a4ef7ac0830e..44eb63bbc504b1 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/flyout_edit_drilldown.tsx
@@ -24,7 +24,7 @@ import {
 } from '../../../../../../embeddable_enhanced/public';
 import { StartDependencies } from '../../../../plugin';
 import { StartServicesGetter } from '../../../../../../../../src/plugins/kibana_utils/public';
-import { ensureNestedTriggers } from '../drilldown_shared';
+import { createDrilldownTemplatesFromSiblings, ensureNestedTriggers } from '../drilldown_shared';
 
 export const OPEN_FLYOUT_EDIT_DRILLDOWN = 'OPEN_FLYOUT_EDIT_DRILLDOWN';
 
@@ -66,14 +66,17 @@ export class FlyoutEditDrilldownAction implements Action<EmbeddableContext> {
       );
     }
 
+    const templates = createDrilldownTemplatesFromSiblings(embeddable);
+
     const handle = core.overlays.openFlyout(
       toMountPoint(
-        <plugins.uiActionsEnhanced.FlyoutManageDrilldowns
-          onClose={() => handle.close()}
-          viewMode={'manage'}
+        <plugins.uiActionsEnhanced.DrilldownManager
+          initialRoute={'/manage'}
           dynamicActionManager={embeddable.enhancements.dynamicActions}
           triggers={[...ensureNestedTriggers(embeddable.supportedTriggers()), CONTEXT_MENU_TRIGGER]}
           placeContext={{ embeddable }}
+          templates={templates}
+          onClose={() => handle.close()}
         />
       ),
       {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_nav.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_nav.tsx
index 2d7e3438d4c02b..dfca497807718f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_nav.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_nav.tsx
@@ -211,8 +211,7 @@ export const EngineNav: React.FC = () => {
       )}
       {canManageEngineSynonyms && (
         <SideNavLink
-          isExternal
-          to={getAppSearchUrl(generateEnginePath(ENGINE_SYNONYMS_PATH))}
+          to={generateEnginePath(ENGINE_SYNONYMS_PATH)}
           data-test-subj="EngineSynonymsLink"
         >
           {SYNONYMS_TITLE}
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.test.tsx
index 27ef42e72764cd..d01958942e0a17 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.test.tsx
@@ -22,6 +22,7 @@ import { CurationsRouter } from '../curations';
 import { EngineOverview } from '../engine_overview';
 import { RelevanceTuning } from '../relevance_tuning';
 import { ResultSettings } from '../result_settings';
+import { Synonyms } from '../synonyms';
 
 import { EngineRouter } from './engine_router';
 
@@ -100,6 +101,13 @@ describe('EngineRouter', () => {
     expect(wrapper.find(AnalyticsRouter)).toHaveLength(1);
   });
 
+  it('renders a synonyms view', () => {
+    setMockValues({ ...values, myRole: { canManageEngineSynonyms: true } });
+    const wrapper = shallow(<EngineRouter />);
+
+    expect(wrapper.find(Synonyms)).toHaveLength(1);
+  });
+
   it('renders a curations view', () => {
     setMockValues({ ...values, myRole: { canManageEngineCurations: true } });
     const wrapper = shallow(<EngineRouter />);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.tsx
index 8c6f248e9ce8e5..c246af36115637 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_router.tsx
@@ -27,7 +27,7 @@ import {
   // ENGINE_CRAWLER_PATH,
   // META_ENGINE_SOURCE_ENGINES_PATH,
   ENGINE_RELEVANCE_TUNING_PATH,
-  // ENGINE_SYNONYMS_PATH,
+  ENGINE_SYNONYMS_PATH,
   ENGINE_CURATIONS_PATH,
   ENGINE_RESULT_SETTINGS_PATH,
   // ENGINE_SEARCH_UI_PATH,
@@ -39,8 +39,8 @@ import { CurationsRouter } from '../curations';
 import { DocumentDetail, Documents } from '../documents';
 import { EngineOverview } from '../engine_overview';
 import { RelevanceTuning } from '../relevance_tuning';
-
 import { ResultSettings } from '../result_settings';
+import { Synonyms } from '../synonyms';
 
 import { EngineLogic, getEngineBreadcrumbs } from './';
 
@@ -53,7 +53,7 @@ export const EngineRouter: React.FC = () => {
       // canViewEngineCrawler,
       // canViewMetaEngineSourceEngines,
       canManageEngineRelevanceTuning,
-      // canManageEngineSynonyms,
+      canManageEngineSynonyms,
       canManageEngineCurations,
       canManageEngineResultSettings,
       // canManageEngineSearchUi,
@@ -107,6 +107,11 @@ export const EngineRouter: React.FC = () => {
           <RelevanceTuning />
         </Route>
       )}
+      {canManageEngineSynonyms && (
+        <Route path={ENGINE_SYNONYMS_PATH}>
+          <Synonyms />
+        </Route>
+      )}
       {canManageEngineResultSettings && (
         <Route path={ENGINE_RESULT_SETTINGS_PATH}>
           <ResultSettings />
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.test.tsx
index e5a901f8d07790..70bc49421a4f1f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.test.tsx
@@ -15,6 +15,8 @@ import { shallow, ShallowWrapper } from 'enzyme';
 
 import { EuiPageHeader, EuiEmptyPrompt } from '@elastic/eui';
 
+import { UnsavedChangesPrompt } from '../../../shared/unsaved_changes_prompt';
+
 import { ResultSettings } from './result_settings';
 import { ResultSettingsTable } from './result_settings_table';
 import { SampleResponse } from './sample_response';
@@ -110,6 +112,14 @@ describe('ResultSettings', () => {
     expect(actions.clearAllFields).toHaveBeenCalled();
   });
 
+  it('will prevent user from leaving the page if there are unsaved changes', () => {
+    setMockValues({
+      ...values,
+      stagedUpdates: true,
+    });
+    expect(subject().find(UnsavedChangesPrompt).prop('hasUnsavedChanges')).toBe(true);
+  });
+
   describe('when there is no schema yet', () => {
     let wrapper: ShallowWrapper;
     beforeAll(() => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx
index 285d8fef357703..bea5bcc548fab5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx
@@ -25,6 +25,7 @@ import { SAVE_BUTTON_LABEL } from '../../../shared/constants';
 import { FlashMessages } from '../../../shared/flash_messages';
 import { SetAppSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
 import { Loading } from '../../../shared/loading';
+import { UnsavedChangesPrompt } from '../../../shared/unsaved_changes_prompt';
 import { RESTORE_DEFAULTS_BUTTON_LABEL } from '../../constants';
 import { getEngineBreadcrumbs } from '../engine';
 
@@ -39,6 +40,11 @@ const CLEAR_BUTTON_LABEL = i18n.translate(
   { defaultMessage: 'Clear all values' }
 );
 
+const UNSAVED_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.appSearch.engine.resultSettings.unsavedChangesMessage',
+  { defaultMessage: 'Result Settings have not been saved. Are you sure you want to leave?' }
+);
+
 export const ResultSettings: React.FC = () => {
   const { dataLoading, schema, stagedUpdates, resultFieldsAtDefaultSettings } = useValues(
     ResultSettingsLogic
@@ -60,6 +66,7 @@ export const ResultSettings: React.FC = () => {
   return (
     <>
       <SetPageChrome trail={getEngineBreadcrumbs([RESULT_SETTINGS_TITLE])} />
+      <UnsavedChangesPrompt hasUnsavedChanges={stagedUpdates} messageText={UNSAVED_MESSAGE} />
       <EuiPageHeader
         pageTitle={RESULT_SETTINGS_TITLE}
         description={i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts
index 79379306c1618b..11f8a1089af9b5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts
@@ -197,18 +197,6 @@ describe('SampleResponseLogic', () => {
           'An error occured.'
         );
       });
-
-      it('does nothing if an empty object is passed for the resultFields parameter', async () => {
-        mount();
-        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsSuccess');
-
-        SampleResponseLogic.actions.getSearchResults('foo', {});
-
-        jest.runAllTimers();
-        await nextTick();
-
-        expect(SampleResponseLogic.actions.getSearchResultsSuccess).not.toHaveBeenCalled();
-      });
     });
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts
index 808a7ec9c65dce..c64cb3465b3117 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts
@@ -63,7 +63,6 @@ export const SampleResponseLogic = kea<MakeLogicType<SampleResponseValues, Sampl
   },
   listeners: ({ actions }) => ({
     getSearchResults: async ({ query, resultFields }, breakpoint) => {
-      if (Object.keys(resultFields).length < 1) return;
       await breakpoint(250);
 
       const { http } = HttpLogic.values;
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/index.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/index.ts
index 5b0fde246ed44a..177bc5eade0f67 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/index.ts
@@ -6,3 +6,4 @@
  */
 
 export { SYNONYMS_TITLE } from './constants';
+export { Synonyms } from './synonyms';
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/synonyms.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/synonyms.test.tsx
new file mode 100644
index 00000000000000..e093442f77b773
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/synonyms.test.tsx
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import '../../__mocks__/engine_logic.mock';
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { Synonyms } from './';
+
+describe('Synonyms', () => {
+  it('renders', () => {
+    shallow(<Synonyms />);
+    // TODO: Check for Synonym cards, Synonym modal
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/synonyms.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/synonyms.tsx
new file mode 100644
index 00000000000000..0b18271660911f
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/synonyms/synonyms.tsx
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { EuiPageHeader, EuiPageContentBody } from '@elastic/eui';
+
+import { FlashMessages } from '../../../shared/flash_messages';
+import { SetAppSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
+import { getEngineBreadcrumbs } from '../engine';
+
+import { SYNONYMS_TITLE } from './constants';
+
+export const Synonyms: React.FC = () => {
+  return (
+    <>
+      <SetPageChrome trail={getEngineBreadcrumbs([SYNONYMS_TITLE])} />
+      <EuiPageHeader pageTitle={SYNONYMS_TITLE} />
+      <FlashMessages />
+      <EuiPageContentBody>TODO</EuiPageContentBody>
+    </>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts
index e08050335671e5..59e43b103db40b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/routes.ts
@@ -19,9 +19,10 @@ export const LEAVE_FEEDBACK_EMAIL = 'support@elastic.co';
 export const LEAVE_FEEDBACK_URL = `mailto:${LEAVE_FEEDBACK_EMAIL}?Subject=Elastic%20Workplace%20Search%20Feedback`;
 
 export const DOCS_PREFIX = docLinks.workplaceSearchBase;
+export const PERMISSIONS_DOCS_URL = `${DOCS_PREFIX}/workplace-search-permissions.html`;
 export const DOCUMENT_PERMISSIONS_DOCS_URL = `${DOCS_PREFIX}/workplace-search-sources-document-permissions.html`;
 export const DOCUMENT_PERMISSIONS_SYNC_DOCS_URL = `${DOCUMENT_PERMISSIONS_DOCS_URL}#sources-permissions-synchronizing`;
-export const PRIVATE_SOURCES_DOCS_URL = `${DOCUMENT_PERMISSIONS_DOCS_URL}#sources-permissions-org-private`;
+export const PRIVATE_SOURCES_DOCS_URL = `${PERMISSIONS_DOCS_URL}#organizational-sources-private-sources`;
 export const EXTERNAL_IDENTITIES_DOCS_URL = `${DOCS_PREFIX}/workplace-search-external-identities-api.html`;
 export const SECURITY_DOCS_URL = `${DOCS_PREFIX}/workplace-search-security.html`;
 export const SMTP_DOCS_URL = `${DOCS_PREFIX}/workplace-search-smtp-mailer.html`;
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx
index 8819367cacd1fc..80d35553bb8bb4 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_list.tsx
@@ -126,7 +126,7 @@ export const AddSourceList: React.FC = () => {
           <EuiFlexGroup justifyContent="center" alignItems="stretch">
             <EuiFlexItem>
               <EuiSpacer size="xl" />
-              <EuiPanel>
+              <EuiPanel hasShadow={false} color="subdued">
                 <EuiSpacer size="s" />
                 <EuiSpacer size="xxl" />
                 <EuiEmptyPrompt
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings.tsx
index 3441e5fcbaf82c..d923fbe7a1a8e8 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/display_settings/display_settings.tsx
@@ -113,7 +113,7 @@ export const DisplaySettings: React.FC<DisplaySettingsProps> = ({ tabId }) => {
             onTabClick={onSelectedTabChanged}
           />
         ) : (
-          <EuiPanel>
+          <EuiPanel hasShadow={false} color="subdued">
             <EuiEmptyPrompt
               iconType="indexRollupApp"
               title={<h2>{DISPLAY_SETTINGS_EMPTY_TITLE}</h2>}
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
index a5a2d8ab73d94d..86c911e7e0b00a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/overview.tsx
@@ -116,7 +116,12 @@ export const Overview: React.FC = () => {
     const emptyState = (
       <>
         <EuiSpacer size="s" />
-        <EuiPanel paddingSize="l" data-test-subj="EmptyDocumentSummary">
+        <EuiPanel
+          hasShadow={false}
+          color="subdued"
+          paddingSize="l"
+          data-test-subj="EmptyDocumentSummary"
+        >
           <EuiEmptyPrompt
             title={<h2>{SOURCES_NO_CONTENT_TITLE}</h2>}
             iconType="documents"
@@ -163,7 +168,12 @@ export const Overview: React.FC = () => {
     const emptyState = (
       <>
         <EuiSpacer size="s" />
-        <EuiPanel paddingSize="l" data-test-subj="EmptyActivitySummary">
+        <EuiPanel
+          paddingSize="l"
+          hasShadow={false}
+          color="subdued"
+          data-test-subj="EmptyActivitySummary"
+        >
           <EuiEmptyPrompt
             title={<h2>{EMPTY_ACTIVITY_TITLE}</h2>}
             iconType="clock"
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/schema/schema.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/schema/schema.tsx
index f31f7049ebf36b..72a3804c4443b9 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/schema/schema.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/schema/schema.tsx
@@ -140,7 +140,7 @@ export const Schema: React.FC = () => {
             <SchemaFieldsTable />
           </>
         ) : (
-          <EuiPanel>
+          <EuiPanel hasShadow={false} color="subdued">
             <EuiEmptyPrompt
               iconType="managementApp"
               title={<h2>{SCHEMA_EMPTY_SCHEMA_TITLE}</h2>}
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.test.tsx
index 12399d4822a132..8aa644827709aa 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.test.tsx
@@ -34,7 +34,6 @@ import { SourceContent } from './source_content';
 describe('SourceContent', () => {
   const setActivePage = jest.fn();
   const searchContentSourceDocuments = jest.fn();
-  const resetSourceState = jest.fn();
   const setContentFilterValue = jest.fn();
 
   const mockValues = {
@@ -51,7 +50,6 @@ describe('SourceContent', () => {
     setMockActions({
       setActivePage,
       searchContentSourceDocuments,
-      resetSourceState,
       setContentFilterValue,
     });
     setMockValues({ ...mockValues });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx
index cc086f9c829d9f..fbafe54df7493c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_content.tsx
@@ -56,12 +56,9 @@ const MAX_LENGTH = 28;
 export const SourceContent: React.FC = () => {
   const [searchTerm, setSearchTerm] = useState('');
 
-  const {
-    setActivePage,
-    searchContentSourceDocuments,
-    resetSourceState,
-    setContentFilterValue,
-  } = useActions(SourceLogic);
+  const { setActivePage, searchContentSourceDocuments, setContentFilterValue } = useActions(
+    SourceLogic
+  );
 
   const {
     contentSource: { id, serviceType, urlField, titleField, urlFieldIsLinkable, isFederatedSource },
@@ -74,10 +71,6 @@ export const SourceContent: React.FC = () => {
     sectionLoading,
   } = useValues(SourceLogic);
 
-  useEffect(() => {
-    return resetSourceState;
-  }, []);
-
   useEffect(() => {
     searchContentSourceDocuments(id);
   }, [contentFilterValue, activePage]);
@@ -106,7 +99,7 @@ export const SourceContent: React.FC = () => {
   const isCustomSource = serviceType === CUSTOM_SERVICE_TYPE;
 
   const emptyState = (
-    <EuiPanel>
+    <EuiPanel hasShadow={false} color="subdued">
       <EuiEmptyPrompt
         title={<h2>{emptyMessage}</h2>}
         iconType="documents"
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.test.tsx
index c6cefba317cce9..b2a4488b04107c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.test.tsx
@@ -23,7 +23,6 @@ import { SourceSettings } from './source_settings';
 describe('SourceSettings', () => {
   const updateContentSource = jest.fn();
   const removeContentSource = jest.fn();
-  const resetSourceState = jest.fn();
   const getSourceConfigData = jest.fn();
   const contentSource = fullContentSources[0];
   const buttonLoading = false;
@@ -41,7 +40,6 @@ describe('SourceSettings', () => {
     setMockActions({
       updateContentSource,
       removeContentSource,
-      resetSourceState,
       getSourceConfigData,
     });
   });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.tsx
index 7ba53822534cfa..4bc623ac9fdf8c 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_settings.tsx
@@ -52,7 +52,7 @@ import { staticSourceData } from '../source_data';
 import { SourceLogic } from '../source_logic';
 
 export const SourceSettings: React.FC = () => {
-  const { updateContentSource, removeContentSource, resetSourceState } = useActions(SourceLogic);
+  const { updateContentSource, removeContentSource } = useActions(SourceLogic);
   const { getSourceConfigData } = useActions(AddSourceLogic);
 
   const {
@@ -68,7 +68,6 @@ export const SourceSettings: React.FC = () => {
 
   useEffect(() => {
     getSourceConfigData(serviceType);
-    return resetSourceState;
   }, []);
 
   const {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources.tsx
index 114df3cf41e399..128c65eeb95daa 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources.tsx
@@ -81,7 +81,7 @@ export const PrivateSources: React.FC = () => {
   );
 
   const privateSourcesEmptyState = (
-    <EuiPanel>
+    <EuiPanel hasShadow={false} color="subdued">
       <EuiSpacer size="xxl" />
       <EuiEmptyPrompt iconType="lock" title={<h2>{PRIVATE_EMPTY_TITLE}</h2>} />
       <EuiSpacer size="xxl" />
@@ -107,7 +107,7 @@ export const PrivateSources: React.FC = () => {
   );
 
   const sharedSourcesEmptyState = (
-    <EuiPanel>
+    <EuiPanel hasShadow={false} color="subdued">
       <EuiSpacer size="xxl" />
       <EuiEmptyPrompt
         iconType={noSharedSourcesIcon}
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
index 3da90c4fc77392..ff3e1e83925d03 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
@@ -88,13 +88,14 @@ export const SourceLogic = kea<MakeLogicType<SourceValues, SourceActions>>({
           ...contentSource,
           summary,
         }),
+        resetSourceState: () => ({} as ContentSourceFullData),
       },
     ],
     dataLoading: [
       true,
       {
         onInitializeSource: () => false,
-        resetSourceState: () => false,
+        resetSourceState: () => true,
       },
     ],
     buttonLoading: [
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_router.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_router.tsx
index b844c86abb9196..b14ea4ebd7a736 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_router.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_router.tsx
@@ -47,12 +47,13 @@ import { SourceLogic } from './source_logic';
 
 export const SourceRouter: React.FC = () => {
   const { sourceId } = useParams() as { sourceId: string };
-  const { initializeSource } = useActions(SourceLogic);
+  const { initializeSource, resetSourceState } = useActions(SourceLogic);
   const { contentSource, dataLoading } = useValues(SourceLogic);
   const { isOrganization } = useValues(AppLogic);
 
   useEffect(() => {
     initializeSource(sourceId);
+    return resetSourceState;
   }, []);
 
   if (dataLoading) return <Loading />;
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/constants.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/constants.ts
index a44144666d139a..b4355ba7aa5863 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/constants.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/constants.ts
@@ -15,6 +15,27 @@ export const DELETE_ROLE_MAPPING_MESSAGE = i18n.translate(
   }
 );
 
+export const ROLE_MAPPING_DELETED_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.roleMappingDeletedMessage',
+  {
+    defaultMessage: 'Successfully deleted role mapping',
+  }
+);
+
+export const ROLE_MAPPING_CREATED_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.roleMappingCreatedMessage',
+  {
+    defaultMessage: 'Role mapping successfully created.',
+  }
+);
+
+export const ROLE_MAPPING_UPDATED_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.workplaceSearch.roleMappingUpdatedMessage',
+  {
+    defaultMessage: 'Role mapping successfully updated.',
+  }
+);
+
 export const DEFAULT_GROUP_NAME = i18n.translate(
   'xpack.enterpriseSearch.workplaceSearch.roleMapping.defaultGroupName',
   {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/role_mappings_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/role_mappings_logic.ts
index b43bda3bb228e5..6e3b74f95f7076 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/role_mappings_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/role_mappings/role_mappings_logic.ts
@@ -7,7 +7,11 @@
 
 import { kea, MakeLogicType } from 'kea';
 
-import { clearFlashMessages, flashAPIErrors } from '../../../shared/flash_messages';
+import {
+  clearFlashMessages,
+  flashAPIErrors,
+  setSuccessMessage,
+} from '../../../shared/flash_messages';
 import { HttpLogic } from '../../../shared/http';
 import { KibanaLogic } from '../../../shared/kibana';
 import { ANY_AUTH_PROVIDER } from '../../../shared/role_mapping/constants';
@@ -15,7 +19,13 @@ import { AttributeName } from '../../../shared/types';
 import { ROLE_MAPPINGS_PATH } from '../../routes';
 import { RoleGroup, WSRoleMapping, Role } from '../../types';
 
-import { DELETE_ROLE_MAPPING_MESSAGE, DEFAULT_GROUP_NAME } from './constants';
+import {
+  DELETE_ROLE_MAPPING_MESSAGE,
+  ROLE_MAPPING_DELETED_MESSAGE,
+  ROLE_MAPPING_CREATED_MESSAGE,
+  ROLE_MAPPING_UPDATED_MESSAGE,
+  DEFAULT_GROUP_NAME,
+} from './constants';
 
 interface RoleMappingsServerDetails {
   multipleAuthProvidersConfig: boolean;
@@ -265,6 +275,7 @@ export const RoleMappingsLogic = kea<MakeLogicType<RoleMappingsValues, RoleMappi
         try {
           await http.delete(route);
           navigateToUrl(ROLE_MAPPINGS_PATH);
+          setSuccessMessage(ROLE_MAPPING_DELETED_MESSAGE);
         } catch (e) {
           flashAPIErrors(e);
         }
@@ -297,9 +308,14 @@ export const RoleMappingsLogic = kea<MakeLogicType<RoleMappingsValues, RoleMappi
         ? http.post('/api/workplace_search/org/role_mappings', { body })
         : http.put(`/api/workplace_search/org/role_mappings/${roleMapping.id}`, { body });
 
+      const SUCCESS_MESSAGE = !roleMapping
+        ? ROLE_MAPPING_CREATED_MESSAGE
+        : ROLE_MAPPING_UPDATED_MESSAGE;
+
       try {
         await request;
         navigateToUrl(ROLE_MAPPINGS_PATH);
+        setSuccessMessage(SUCCESS_MESSAGE);
       } catch (e) {
         flashAPIErrors(e);
       }
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/synonyms.test.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/synonyms.test.ts
new file mode 100644
index 00000000000000..26b44b5ad88896
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/synonyms.test.ts
@@ -0,0 +1,207 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { MockRouter, mockRequestHandler, mockDependencies } from '../../__mocks__';
+
+import { registerSynonymsRoutes } from './synonyms';
+
+describe('synonyms routes', () => {
+  describe('GET /api/app_search/engines/{engineName}/synonyms', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/app_search/engines/{engineName}/synonyms',
+      });
+
+      registerSynonymsRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/as/engines/:engineName/synonyms/collection',
+      });
+    });
+
+    describe('validates', () => {
+      it('with pagination query params', () => {
+        const request = {
+          query: {
+            'page[current]': 1,
+            'page[size]': 10,
+          },
+        };
+        mockRouter.shouldValidate(request);
+      });
+
+      it('missing query params', () => {
+        const request = { query: {} };
+        mockRouter.shouldThrow(request);
+      });
+    });
+  });
+
+  describe('POST /api/app_search/engines/{engineName}/synonyms', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/app_search/engines/{engineName}/synonyms',
+      });
+
+      registerSynonymsRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/as/engines/:engineName/synonyms/collection',
+      });
+    });
+
+    describe('validates', () => {
+      it('with synonyms', () => {
+        const request = {
+          body: {
+            synonyms: ['a', 'b', 'c'],
+          },
+        };
+        mockRouter.shouldValidate(request);
+      });
+
+      it('empty synonyms array', () => {
+        const request = {
+          body: {
+            queries: [],
+          },
+        };
+        mockRouter.shouldThrow(request);
+      });
+
+      it('only one synonym', () => {
+        const request = {
+          body: {
+            queries: ['a'],
+          },
+        };
+        mockRouter.shouldThrow(request);
+      });
+
+      it('empty synonym strings', () => {
+        const request = {
+          body: {
+            queries: ['', '', ''],
+          },
+        };
+        mockRouter.shouldThrow(request);
+      });
+
+      it('missing synonyms', () => {
+        const request = { body: {} };
+        mockRouter.shouldThrow(request);
+      });
+    });
+  });
+
+  describe('PUT /api/app_search/engines/{engineName}/synonyms/{synonymId}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'put',
+        path: '/api/app_search/engines/{engineName}/synonyms/{synonymId}',
+      });
+
+      registerSynonymsRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/as/engines/:engineName/synonyms/:synonymId',
+      });
+    });
+
+    describe('validates', () => {
+      it('with synonyms', () => {
+        const request = {
+          body: {
+            synonyms: ['a', 'b', 'c'],
+          },
+        };
+        mockRouter.shouldValidate(request);
+      });
+
+      it('empty synonyms array', () => {
+        const request = {
+          body: {
+            queries: [],
+          },
+        };
+        mockRouter.shouldThrow(request);
+      });
+
+      it('only one synonym', () => {
+        const request = {
+          body: {
+            queries: ['a'],
+          },
+        };
+        mockRouter.shouldThrow(request);
+      });
+
+      it('empty synonym strings', () => {
+        const request = {
+          body: {
+            queries: ['', '', ''],
+          },
+        };
+        mockRouter.shouldThrow(request);
+      });
+
+      it('missing synonyms', () => {
+        const request = { body: {} };
+        mockRouter.shouldThrow(request);
+      });
+    });
+  });
+
+  describe('DELETE /api/app_search/engines/{engineName}/synonyms/{synonymId}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'delete',
+        path: '/api/app_search/engines/{engineName}/synonyms/{synonymId}',
+      });
+
+      registerSynonymsRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/as/engines/:engineName/synonyms/:synonymId',
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/synonyms.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/synonyms.ts
new file mode 100644
index 00000000000000..1be58f00c476a4
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/synonyms.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { RouteDependencies } from '../../plugin';
+
+const synonymsSchema = schema.arrayOf(schema.string({ minLength: 1 }), { minSize: 2 });
+
+export function registerSynonymsRoutes({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/app_search/engines/{engineName}/synonyms',
+      validate: {
+        params: schema.object({
+          engineName: schema.string(),
+        }),
+        query: schema.object({
+          'page[current]': schema.number(),
+          'page[size]': schema.number(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/as/engines/:engineName/synonyms/collection',
+    })
+  );
+
+  router.post(
+    {
+      path: '/api/app_search/engines/{engineName}/synonyms',
+      validate: {
+        params: schema.object({
+          engineName: schema.string(),
+        }),
+        body: schema.object({
+          synonyms: synonymsSchema,
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/as/engines/:engineName/synonyms/collection',
+    })
+  );
+
+  router.put(
+    {
+      path: '/api/app_search/engines/{engineName}/synonyms/{synonymId}',
+      validate: {
+        params: schema.object({
+          engineName: schema.string(),
+          synonymId: schema.string(),
+        }),
+        body: schema.object({
+          synonyms: synonymsSchema,
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/as/engines/:engineName/synonyms/:synonymId',
+    })
+  );
+
+  router.delete(
+    {
+      path: '/api/app_search/engines/{engineName}/synonyms/{synonymId}',
+      validate: {
+        params: schema.object({
+          engineName: schema.string(),
+          synonymId: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/as/engines/:engineName/synonyms/:synonymId',
+    })
+  );
+}
diff --git a/x-pack/plugins/fleet/common/types/models/epm.ts b/x-pack/plugins/fleet/common/types/models/epm.ts
index 3bc0d97d646465..eab13fe5819f97 100644
--- a/x-pack/plugins/fleet/common/types/models/epm.ts
+++ b/x-pack/plugins/fleet/common/types/models/epm.ts
@@ -30,7 +30,12 @@ export enum InstallStatus {
   uninstalling = 'uninstalling',
 }
 
-export type InstallType = 'reinstall' | 'reupdate' | 'rollback' | 'update' | 'install';
+export interface DefaultPackagesInstallationError {
+  installType: InstallType;
+  error: Error;
+}
+
+export type InstallType = 'reinstall' | 'reupdate' | 'rollback' | 'update' | 'install' | 'unknown';
 export type InstallSource = 'registry' | 'upload';
 
 export type EpmPackageInstallStatus = 'installed' | 'installing';
diff --git a/x-pack/plugins/fleet/common/types/models/settings.ts b/x-pack/plugins/fleet/common/types/models/settings.ts
index 2d7e90a3424d78..15d74928687977 100644
--- a/x-pack/plugins/fleet/common/types/models/settings.ts
+++ b/x-pack/plugins/fleet/common/types/models/settings.ts
@@ -9,6 +9,7 @@ import type { SavedObjectAttributes } from 'src/core/public';
 
 export interface BaseSettings {
   has_seen_add_data_notice?: boolean;
+  has_seen_fleet_migration_notice?: boolean;
   fleet_server_hosts: string[];
 }
 
diff --git a/x-pack/plugins/fleet/common/types/rest_spec/agent.ts b/x-pack/plugins/fleet/common/types/rest_spec/agent.ts
index 4616e92925b3a6..47f9112d4ab594 100644
--- a/x-pack/plugins/fleet/common/types/rest_spec/agent.ts
+++ b/x-pack/plugins/fleet/common/types/rest_spec/agent.ts
@@ -108,6 +108,7 @@ export interface PostAgentUnenrollRequest {
   };
   body: {
     force?: boolean;
+    revoke?: boolean;
   };
 }
 
@@ -118,6 +119,7 @@ export interface PostBulkAgentUnenrollRequest {
   body: {
     agents: string[] | string;
     force?: boolean;
+    revoke?: boolean;
   };
 }
 
diff --git a/x-pack/plugins/fleet/common/types/rest_spec/epm.ts b/x-pack/plugins/fleet/common/types/rest_spec/epm.ts
index 3c7a32265d20a6..e5c7ace420c730 100644
--- a/x-pack/plugins/fleet/common/types/rest_spec/epm.ts
+++ b/x-pack/plugins/fleet/common/types/rest_spec/epm.ts
@@ -12,6 +12,7 @@ import type {
   RegistrySearchResult,
   PackageInfo,
   PackageUsageStats,
+  InstallType,
 } from '../models/epm';
 
 export interface GetCategoriesRequest {
@@ -83,8 +84,10 @@ export interface IBulkInstallPackageHTTPError {
 }
 
 export interface InstallResult {
-  assets: AssetReference[];
-  status: 'installed' | 'already_installed';
+  assets?: AssetReference[];
+  status?: 'installed' | 'already_installed';
+  error?: Error;
+  installType: InstallType;
 }
 
 export interface BulkInstallPackageInfo {
diff --git a/x-pack/plugins/fleet/common/types/rest_spec/ingest_setup.ts b/x-pack/plugins/fleet/common/types/rest_spec/ingest_setup.ts
index 2180b669084982..6f64f1c48336d1 100644
--- a/x-pack/plugins/fleet/common/types/rest_spec/ingest_setup.ts
+++ b/x-pack/plugins/fleet/common/types/rest_spec/ingest_setup.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+import type { DefaultPackagesInstallationError } from '../models/epm';
+
 export interface PostIngestSetupResponse {
   isInitialized: boolean;
   preconfigurationError?: { name: string; message: string };
+  nonFatalPackageUpgradeErrors?: DefaultPackagesInstallationError[];
 }
diff --git a/x-pack/plugins/fleet/public/applications/fleet/app.tsx b/x-pack/plugins/fleet/public/applications/fleet/app.tsx
index 5663bd4768d5cf..f2eee6228906a8 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/app.tsx
@@ -90,6 +90,13 @@ export const WithPermissionsAndSetup: React.FC = memo(({ children }) => {
                 }),
               });
             }
+            if (setupResponse.data.nonFatalPackageUpgradeErrors) {
+              notifications.toasts.addError(setupResponse.data.nonFatalPackageUpgradeErrors, {
+                title: i18n.translate('xpack.fleet.setup.nonFatalPackageErrorsTitle', {
+                  defaultMessage: 'One or more packages could not be successfully upgraded',
+                }),
+              });
+            }
           } catch (err) {
             setInitializationError(err);
           }
diff --git a/x-pack/plugins/fleet/public/applications/fleet/components/link_and_revision.tsx b/x-pack/plugins/fleet/public/applications/fleet/components/link_and_revision.tsx
index 071a9dc5943b2e..41ef63b23b564e 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/components/link_and_revision.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/components/link_and_revision.tsx
@@ -5,43 +5,54 @@
  * 2.0.
  */
 
-import { EuiFlexGroup, EuiFlexItem, EuiLink, EuiText } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiIconTip, EuiLink, EuiText } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import type { CSSProperties } from 'react';
 import React, { memo } from 'react';
-import type { EuiLinkProps } from '@elastic/eui/src/components/link/link';
 
+import type { AgentPolicy } from '../../../../common/types';
+import { useLink } from '../hooks';
 const MIN_WIDTH: CSSProperties = { minWidth: 0 };
 const NO_WRAP_WHITE_SPACE: CSSProperties = { whiteSpace: 'nowrap' };
 
-export type LinkAndRevisionProps = EuiLinkProps & {
-  revision?: string | number;
-};
-
-/**
- * Components shows a link for a given value along with a revision number to its right. The display
- * value is truncated if it is longer than the width of where it is displayed, while the revision
- * always remain visible
- */
-export const LinkAndRevision = memo<LinkAndRevisionProps>(
-  ({ revision, className, ...euiLinkProps }) => {
-    return (
-      <EuiFlexGroup gutterSize="s" alignItems="baseline" style={MIN_WIDTH} responsive={false}>
-        <EuiFlexItem grow={false} className="eui-textTruncate">
-          <EuiLink className={`eui-textTruncate ${className ?? ''}`} {...euiLinkProps} />
+export const AgentPolicySummaryLine = memo<{ policy: AgentPolicy }>(({ policy }) => {
+  const { getHref } = useLink();
+  const { name, id, revision, is_managed: isManaged } = policy;
+  return (
+    <EuiFlexGroup gutterSize="s" alignItems="baseline" style={MIN_WIDTH} responsive={false}>
+      <EuiFlexItem grow={false} className="eui-textTruncate">
+        <EuiLink
+          className={`eui-textTruncate`}
+          href={getHref('policy_details', { policyId: id })}
+          title={name || id}
+        >
+          {name || id}
+        </EuiLink>
+      </EuiFlexItem>
+      {isManaged && (
+        <EuiIconTip
+          title="Hosted agent policy"
+          content={i18n.translate('xpack.fleet.agentPolicySummaryLine.hostedPolicyTooltip', {
+            defaultMessage:
+              'This policy is managed outside of Fleet. Most actions related to this policy are unavailable.',
+          })}
+          type="lock"
+          size="m"
+          color="subdued"
+        />
+      )}
+      {revision && (
+        <EuiFlexItem grow={true}>
+          <EuiText color="subdued" size="xs" style={NO_WRAP_WHITE_SPACE}>
+            <FormattedMessage
+              id="xpack.fleet.agentPolicySummaryLine.revisionNumber"
+              defaultMessage="rev. {revNumber}"
+              values={{ revNumber: revision }}
+            />
+          </EuiText>
         </EuiFlexItem>
-        {revision && (
-          <EuiFlexItem grow={true}>
-            <EuiText color="subdued" size="xs" style={NO_WRAP_WHITE_SPACE}>
-              <FormattedMessage
-                id="xpack.fleet.policyNameLink.revisionNumber"
-                defaultMessage="rev. {revNumber}"
-                values={{ revNumber: revision }}
-              />
-            </EuiText>
-          </EuiFlexItem>
-        )}
-      </EuiFlexGroup>
-    );
-  }
-);
+      )}
+    </EuiFlexGroup>
+  );
+});
diff --git a/x-pack/plugins/fleet/public/applications/fleet/components/package_icon.tsx b/x-pack/plugins/fleet/public/applications/fleet/components/package_icon.tsx
index cb0b02527f756a..e7fd1da394bb32 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/components/package_icon.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/components/package_icon.tsx
@@ -14,7 +14,18 @@ import { usePackageIconType } from '../hooks';
 
 export const PackageIcon: React.FunctionComponent<
   UsePackageIconType & Omit<EuiIconProps, 'type'>
-> = ({ packageName, version, icons, tryApi, ...euiIconProps }) => {
+> = ({ size = 's', packageName, version, icons, tryApi, ...euiIconProps }) => {
   const iconType = usePackageIconType({ packageName, version, icons, tryApi });
-  return <EuiIcon size="s" type={iconType} {...euiIconProps} />;
+  return (
+    <EuiIcon
+      // when a custom SVG is used the logo is rendered with <img class="euiIcon euiIcon--small">
+      // this collides with some EuiText (+img) CSS from the EuiIcon component
+      // which  makes the button large, wide, and poorly layed out
+      // override those styles until the bug is fixed or we find a better approach
+      style={{ margin: 'unset', width: 'unset' }}
+      size={size}
+      type={iconType}
+      {...euiIconProps}
+    />
+  );
 };
diff --git a/x-pack/plugins/fleet/public/applications/fleet/hooks/use_link.ts b/x-pack/plugins/fleet/public/applications/fleet/hooks/use_link.ts
index 440cd693d7af23..5c31f6fc4158e0 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/hooks/use_link.ts
+++ b/x-pack/plugins/fleet/public/applications/fleet/hooks/use_link.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { BASE_PATH, pagePathGetters } from '../constants';
+import { BASE_PATH, pagePathGetters, PLUGIN_ID } from '../constants';
 import type { StaticPage, DynamicPage, DynamicPagePathValues } from '../constants';
 
 import { useStartServices } from './';
@@ -18,6 +18,8 @@ export const useLink = () => {
   const core = useStartServices();
   return {
     getPath,
+    getAssetsPath: (path: string) =>
+      core.http.basePath.prepend(`/plugins/${PLUGIN_ID}/assets/${path}`),
     getHref: (page: StaticPage | DynamicPage, values?: DynamicPagePathValues) => {
       const path = getPath(page, values);
       return core.http.basePath.prepend(`${BASE_PATH}#${path}`);
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx
index 53fab8bda4a8c8..26d47cbff5b86c 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx
@@ -94,7 +94,11 @@ export const StepSelectAgentPolicy: React.FunctionComponent<{
     sortOrder: 'asc',
     full: true,
   });
-  const agentPolicies = useMemo(() => agentPoliciesData?.items || [], [agentPoliciesData?.items]);
+  const agentPolicies = useMemo(
+    () => agentPoliciesData?.items.filter((policy) => !policy.is_managed) || [],
+    [agentPoliciesData?.items]
+  );
+
   const agentPoliciesById = useMemo(() => {
     return agentPolicies.reduce((acc: { [key: string]: GetAgentPoliciesResponseItem }, policy) => {
       acc[policy.id] = policy;
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx
index 55788da05bcea4..48b9118d115666 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.tsx
@@ -36,7 +36,7 @@ import {
   useUrlParams,
   useBreadcrumbs,
 } from '../../../hooks';
-import { LinkAndRevision, SearchBar } from '../../../components';
+import { AgentPolicySummaryLine, SearchBar } from '../../../components';
 import { LinkedAgentCount, AgentPolicyActionMenu } from '../components';
 
 import { CreateAgentPolicyFlyout } from './components';
@@ -74,7 +74,7 @@ const AgentPolicyListPageLayout: React.FunctionComponent = ({ children }) => (
 
 export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
   useBreadcrumbs('policies_list');
-  const { getHref, getPath } = useLink();
+  const { getPath } = useLink();
   const hasWriteCapabilites = useCapabilities().write;
   const {
     agents: { enabled: isFleetEnabled },
@@ -132,13 +132,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
         }),
         width: '20%',
         render: (name: string, agentPolicy: AgentPolicy) => (
-          <LinkAndRevision
-            href={getHref('policy_details', { policyId: agentPolicy.id })}
-            title={name || agentPolicy.id}
-            revision={agentPolicy.revision}
-          >
-            {name || agentPolicy.id}
-          </LinkAndRevision>
+          <AgentPolicySummaryLine policy={agentPolicy} />
         ),
       },
       {
@@ -205,7 +199,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
     }
 
     return cols;
-  }, [getHref, isFleetEnabled, resendRequest]);
+  }, [isFleetEnabled, resendRequest]);
 
   const createAgentPolicyButton = useMemo(
     () => (
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/actions_menu.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/actions_menu.tsx
index e5ad131bd7e051..d814d2d0646a87 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/actions_menu.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/actions_menu.tsx
@@ -14,7 +14,7 @@ import { useCapabilities, useKibanaVersion } from '../../../../hooks';
 import { ContextMenuActions } from '../../../../components';
 import {
   AgentUnenrollAgentModal,
-  AgentReassignAgentPolicyFlyout,
+  AgentReassignAgentPolicyModal,
   AgentUpgradeAgentModal,
 } from '../../components';
 import { useAgentRefresh } from '../hooks';
@@ -45,7 +45,7 @@ export const AgentDetailsActionMenu: React.FunctionComponent<{
     <>
       {isReassignFlyoutOpen && (
         <EuiPortal>
-          <AgentReassignAgentPolicyFlyout agents={[agent]} onClose={onClose} />
+          <AgentReassignAgentPolicyModal agents={[agent]} onClose={onClose} />
         </EuiPortal>
       )}
       {isUnenrollModalOpen && (
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
index 482861b3db9e8b..bf8385712dd237 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
@@ -21,10 +21,10 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import type { Agent, AgentPolicy } from '../../../../../types';
-import { useKibanaVersion, useLink } from '../../../../../hooks';
+import { useKibanaVersion } from '../../../../../hooks';
 import { isAgentUpgradeable } from '../../../../../services';
 import { AgentPolicyPackageBadges } from '../../../components/agent_policy_package_badges';
-import { LinkAndRevision } from '../../../../../components';
+import { AgentPolicySummaryLine } from '../../../../../components';
 
 // Allows child text to be truncated
 const FlexItemWithMinWidth = styled(EuiFlexItem)`
@@ -35,7 +35,6 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
   agent: Agent;
   agentPolicy?: AgentPolicy;
 }> = memo(({ agent, agentPolicy }) => {
-  const { getHref } = useLink();
   const kibanaVersion = useKibanaVersion();
   return (
     <EuiPanel>
@@ -52,13 +51,7 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
               defaultMessage: 'Agent policy',
             }),
             description: agentPolicy ? (
-              <LinkAndRevision
-                href={getHref('policy_details', { policyId: agentPolicy.id })}
-                title={agentPolicy.name || agent.policy_id}
-                revision={agent.policy_revision || undefined}
-              >
-                {agentPolicy.name || agentPolicy.id}
-              </LinkAndRevision>
+              <AgentPolicySummaryLine policy={agentPolicy} />
             ) : (
               agent.policy_id || '-'
             ),
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx
index de27d5fada755e..b59ef1f749fb26 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx
@@ -22,7 +22,7 @@ import { FormattedMessage, FormattedNumber } from '@kbn/i18n/react';
 import { SO_SEARCH_LIMIT } from '../../../../constants';
 import type { Agent } from '../../../../types';
 import {
-  AgentReassignAgentPolicyFlyout,
+  AgentReassignAgentPolicyModal,
   AgentUnenrollAgentModal,
   AgentUpgradeAgentModal,
 } from '../../components';
@@ -161,7 +161,7 @@ export const AgentBulkActions: React.FunctionComponent<{
     <>
       {isReassignFlyoutOpen && (
         <EuiPortal>
-          <AgentReassignAgentPolicyFlyout
+          <AgentReassignAgentPolicyModal
             agents={agents}
             onClose={() => {
               setIsReassignFlyoutOpen(false);
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx
index 10f35aab44c5a2..88249f7f5d5ce2 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx
@@ -37,11 +37,11 @@ import {
   useKibanaVersion,
   useStartServices,
 } from '../../../hooks';
-import { ContextMenuActions } from '../../../components';
+import { AgentPolicySummaryLine, ContextMenuActions } from '../../../components';
 import { AgentStatusKueryHelper, isAgentUpgradeable } from '../../../services';
 import { AGENT_SAVED_OBJECT_TYPE } from '../../../constants';
 import {
-  AgentReassignAgentPolicyFlyout,
+  AgentReassignAgentPolicyModal,
   AgentHealth,
   AgentUnenrollAgentModal,
   AgentUpgradeAgentModal,
@@ -374,48 +374,24 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
         defaultMessage: 'Agent policy',
       }),
       render: (policyId: string, agent: Agent) => {
-        const policyName = agentPoliciesIndexedById[policyId]?.name;
+        const agentPolicy = agentPoliciesIndexedById[policyId];
+        const showWarning = agent.policy_revision && agentPolicy?.revision > agent.policy_revision;
+
         return (
           <EuiFlexGroup gutterSize="s" alignItems="center" style={{ minWidth: 0 }}>
-            <EuiFlexItem grow={false} className="eui-textTruncate">
-              <EuiLink
-                href={getHref('policy_details', { policyId })}
-                className="eui-textTruncate"
-                title={policyName || policyId}
-              >
-                {policyName || policyId}
-              </EuiLink>
-            </EuiFlexItem>
-            {agent.policy_revision && (
+            {agentPolicy && <AgentPolicySummaryLine policy={agentPolicy} />}
+            {showWarning && (
               <EuiFlexItem grow={false}>
-                <EuiText color="default" size="xs" className="eui-textNoWrap">
+                <EuiText color="subdued" size="xs" className="eui-textNoWrap">
+                  <EuiIcon size="m" type="alert" color="warning" />
+                  &nbsp;
                   <FormattedMessage
-                    id="xpack.fleet.agentList.revisionNumber"
-                    defaultMessage="rev. {revNumber}"
-                    values={{ revNumber: agent.policy_revision }}
+                    id="xpack.fleet.agentList.outOfDateLabel"
+                    defaultMessage="Out-of-date"
                   />
                 </EuiText>
               </EuiFlexItem>
             )}
-            {agent.policy_id &&
-              agent.policy_revision &&
-              agentPoliciesIndexedById[agent.policy_id] &&
-              agentPoliciesIndexedById[agent.policy_id].revision > agent.policy_revision && (
-                <EuiFlexItem grow={false}>
-                  <EuiText color="subdued" size="xs" className="eui-textNoWrap">
-                    <EuiIcon size="m" type="alert" color="warning" />
-                    &nbsp;
-                    {true && (
-                      <>
-                        <FormattedMessage
-                          id="xpack.fleet.agentList.outOfDateLabel"
-                          defaultMessage="Out-of-date"
-                        />
-                      </>
-                    )}
-                  </EuiText>
-                </EuiFlexItem>
-              )}
           </EuiFlexGroup>
         );
       },
@@ -431,7 +407,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
           <EuiFlexItem grow={false} className="eui-textNoWrap">
             {safeMetadata(version)}
           </EuiFlexItem>
-          {isAgentUpgradeable(agent, kibanaVersion) ? (
+          {isAgentSelectable(agent) && isAgentUpgradeable(agent, kibanaVersion) ? (
             <EuiFlexItem grow={false}>
               <EuiText color="subdued" size="xs" className="eui-textNoWrap">
                 <EuiIcon size="m" type="alert" color="warning" />
@@ -512,7 +488,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
       ) : null}
       {agentToReassign && (
         <EuiPortal>
-          <AgentReassignAgentPolicyFlyout
+          <AgentReassignAgentPolicyModal
             agents={[agentToReassign]}
             onClose={() => {
               setAgentToReassign(undefined);
@@ -617,7 +593,15 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
             emptyPrompt
           )
         }
-        items={totalAgents ? agents : []}
+        items={
+          totalAgents
+            ? showUpgradeable
+              ? agents.filter(
+                  (agent) => isAgentSelectable(agent) && isAgentUpgradeable(agent, kibanaVersion)
+                )
+              : agents
+            : []
+        }
         itemId="id"
         columns={columns}
         pagination={{
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_enrollment_flyout/steps.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_enrollment_flyout/steps.tsx
index 1d5e8cbfc5cd6e..faa0461ed4773e 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_enrollment_flyout/steps.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_enrollment_flyout/steps.tsx
@@ -53,13 +53,16 @@ export const AgentPolicySelectionStep = ({
   setSelectedAPIKeyId?: (key: string) => void;
   setSelectedPolicyId?: (policyId: string) => void;
 }) => {
+  const regularAgentPolicies = Array.isArray(agentPolicies)
+    ? agentPolicies.filter((policy) => policy && !policy.is_managed)
+    : [];
   return {
     title: i18n.translate('xpack.fleet.agentEnrollment.stepChooseAgentPolicyTitle', {
       defaultMessage: 'Choose an agent policy',
     }),
     children: (
       <EnrollmentStepAgentPolicy
-        agentPolicies={agentPolicies}
+        agentPolicies={regularAgentPolicies}
         withKeySelection={setSelectedAPIKeyId ? true : false}
         onKeyChange={setSelectedAPIKeyId}
         onAgentPolicyChange={setSelectedPolicyId}
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_reassign_policy_flyout/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_reassign_policy_flyout/index.tsx
deleted file mode 100644
index a23b27cf888d6a..00000000000000
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_reassign_policy_flyout/index.tsx
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState, useEffect } from 'react';
-import { i18n } from '@kbn/i18n';
-import {
-  EuiFlyout,
-  EuiFlyoutBody,
-  EuiFlyoutHeader,
-  EuiSpacer,
-  EuiTitle,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiButtonEmpty,
-  EuiButton,
-  EuiFlyoutFooter,
-  EuiSelect,
-  EuiFormRow,
-  EuiText,
-} from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-import type { Agent } from '../../../../types';
-import {
-  sendPutAgentReassign,
-  sendPostBulkAgentReassign,
-  useStartServices,
-  useGetAgentPolicies,
-} from '../../../../hooks';
-import { AgentPolicyPackageBadges } from '../agent_policy_package_badges';
-
-interface Props {
-  onClose: () => void;
-  agents: Agent[] | string;
-}
-
-export const AgentReassignAgentPolicyFlyout: React.FunctionComponent<Props> = ({
-  onClose,
-  agents,
-}) => {
-  const { notifications } = useStartServices();
-  const isSingleAgent = Array.isArray(agents) && agents.length === 1;
-
-  const [selectedAgentPolicyId, setSelectedAgentPolicyId] = useState<string | undefined>(
-    isSingleAgent ? (agents[0] as Agent).policy_id : undefined
-  );
-  const agentPoliciesRequest = useGetAgentPolicies({
-    page: 1,
-    perPage: 1000,
-  });
-  // eslint-disable-next-line react-hooks/exhaustive-deps
-  const agentPolicies = agentPoliciesRequest.data ? agentPoliciesRequest.data.items : [];
-  useEffect(() => {
-    if (!selectedAgentPolicyId && agentPolicies[0]) {
-      setSelectedAgentPolicyId(agentPolicies[0].id);
-    }
-  }, [agentPolicies, selectedAgentPolicyId]);
-
-  const [isSubmitting, setIsSubmitting] = useState(false);
-  async function onSubmit() {
-    try {
-      setIsSubmitting(true);
-      if (!selectedAgentPolicyId) {
-        throw new Error('No selected agent policy id');
-      }
-      const res = isSingleAgent
-        ? await sendPutAgentReassign((agents[0] as Agent).id, {
-            policy_id: selectedAgentPolicyId,
-          })
-        : await sendPostBulkAgentReassign({
-            policy_id: selectedAgentPolicyId,
-            agents: Array.isArray(agents) ? agents.map((agent) => agent.id) : agents,
-          });
-      if (res.error) {
-        throw res.error;
-      }
-      setIsSubmitting(false);
-      const successMessage = i18n.translate(
-        'xpack.fleet.agentReassignPolicy.successSingleNotificationTitle',
-        {
-          defaultMessage: 'Agent policy reassigned',
-        }
-      );
-      notifications.toasts.addSuccess(successMessage);
-      onClose();
-    } catch (error) {
-      setIsSubmitting(false);
-      notifications.toasts.addError(error, {
-        title: 'Unable to reassign agent policy',
-      });
-    }
-  }
-
-  return (
-    <EuiFlyout onClose={onClose} size="l" maxWidth={640}>
-      <EuiFlyoutHeader hasBorder aria-labelledby="FleetAgentReassigmentFlyoutTitle">
-        <EuiTitle size="m">
-          <h2 id="FleetAgentReassigmentFlyoutTitle">
-            <FormattedMessage
-              id="xpack.fleet.agentReassignPolicy.flyoutTitle"
-              defaultMessage="Assign new agent policy"
-            />
-          </h2>
-        </EuiTitle>
-        <EuiSpacer size="m" />
-        <EuiText size="s">
-          <FormattedMessage
-            id="xpack.fleet.agentReassignPolicy.flyoutDescription"
-            defaultMessage="Choose a new agent policy to assign the selected {count, plural, one {agent} other {agents}} to."
-            values={{
-              count: isSingleAgent ? 1 : 0,
-            }}
-          />
-        </EuiText>
-      </EuiFlyoutHeader>
-      <EuiFlyoutBody>
-        <EuiFlexGroup>
-          <EuiFlexItem>
-            <EuiFormRow
-              fullWidth
-              label={i18n.translate('xpack.fleet.agentReassignPolicy.selectPolicyLabel', {
-                defaultMessage: 'Agent policy',
-              })}
-            >
-              <EuiSelect
-                fullWidth
-                isLoading={agentPoliciesRequest.isLoading}
-                options={agentPolicies.map((agentPolicy) => ({
-                  value: agentPolicy.id,
-                  text: agentPolicy.name,
-                }))}
-                value={selectedAgentPolicyId}
-                onChange={(e) => setSelectedAgentPolicyId(e.target.value)}
-              />
-            </EuiFormRow>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-        <EuiSpacer size="l" />
-
-        {selectedAgentPolicyId && (
-          <AgentPolicyPackageBadges agentPolicyId={selectedAgentPolicyId} />
-        )}
-      </EuiFlyoutBody>
-      <EuiFlyoutFooter>
-        <EuiFlexGroup justifyContent="spaceBetween">
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty onClick={onClose} flush="left">
-              <FormattedMessage
-                id="xpack.fleet.agentReassignPolicy.cancelButtonLabel"
-                defaultMessage="Cancel"
-              />
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              disabled={isSingleAgent && selectedAgentPolicyId === (agents[0] as Agent).policy_id}
-              fill
-              onClick={onSubmit}
-              isLoading={isSubmitting}
-            >
-              <FormattedMessage
-                id="xpack.fleet.agentReassignPolicy.continueButtonLabel"
-                defaultMessage="Assign policy"
-              />
-            </EuiButton>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiFlyoutFooter>
-    </EuiFlyout>
-  );
-};
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_reassign_policy_modal/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_reassign_policy_modal/index.tsx
new file mode 100644
index 00000000000000..8ee401d3c4ddf7
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_reassign_policy_modal/index.tsx
@@ -0,0 +1,159 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState, useEffect, useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiConfirmModal,
+  EuiSpacer,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSelect,
+  EuiFormRow,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import type { Agent } from '../../../../types';
+import {
+  sendPutAgentReassign,
+  sendPostBulkAgentReassign,
+  useStartServices,
+  useGetAgentPolicies,
+} from '../../../../hooks';
+import { AgentPolicyPackageBadges } from '../agent_policy_package_badges';
+
+interface Props {
+  onClose: () => void;
+  agents: Agent[] | string;
+}
+
+export const AgentReassignAgentPolicyModal: React.FunctionComponent<Props> = ({
+  onClose,
+  agents,
+}) => {
+  const { notifications } = useStartServices();
+  const isSingleAgent = Array.isArray(agents) && agents.length === 1;
+
+  const [selectedAgentPolicyId, setSelectedAgentPolicyId] = useState<string | undefined>(
+    isSingleAgent ? (agents[0] as Agent).policy_id : undefined
+  );
+  const agentPoliciesRequest = useGetAgentPolicies({
+    page: 1,
+    perPage: 1000,
+  });
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  const agentPolicies = agentPoliciesRequest.data ? agentPoliciesRequest.data.items : [];
+  useEffect(() => {
+    if (!selectedAgentPolicyId && agentPolicies[0]) {
+      setSelectedAgentPolicyId(agentPolicies[0].id);
+    }
+  }, [agentPolicies, selectedAgentPolicyId]);
+
+  const policySelectOptions = useMemo(() => {
+    return agentPolicies
+      .filter((policy) => policy && !policy.is_managed)
+      .map((agentPolicy) => ({
+        value: agentPolicy.id,
+        text: agentPolicy.name,
+      }));
+  }, [agentPolicies]);
+
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  async function onSubmit() {
+    try {
+      setIsSubmitting(true);
+      if (!selectedAgentPolicyId) {
+        throw new Error('No selected agent policy id');
+      }
+      const res = isSingleAgent
+        ? await sendPutAgentReassign((agents[0] as Agent).id, {
+            policy_id: selectedAgentPolicyId,
+          })
+        : await sendPostBulkAgentReassign({
+            policy_id: selectedAgentPolicyId,
+            agents: Array.isArray(agents) ? agents.map((agent) => agent.id) : agents,
+          });
+      if (res.error) {
+        throw res.error;
+      }
+      setIsSubmitting(false);
+      const successMessage = i18n.translate(
+        'xpack.fleet.agentReassignPolicy.successSingleNotificationTitle',
+        {
+          defaultMessage: 'Agent policy reassigned',
+        }
+      );
+      notifications.toasts.addSuccess(successMessage);
+      onClose();
+    } catch (error) {
+      setIsSubmitting(false);
+      notifications.toasts.addError(error, {
+        title: 'Unable to reassign agent policy',
+      });
+    }
+  }
+
+  return (
+    <EuiConfirmModal
+      title={
+        <FormattedMessage
+          id="xpack.fleet.agentReassignPolicy.flyoutTitle"
+          defaultMessage="Assign new agent policy"
+        />
+      }
+      onCancel={onClose}
+      onConfirm={onSubmit}
+      cancelButtonText={
+        <FormattedMessage
+          id="xpack.fleet.agentReassignPolicy.cancelButtonLabel"
+          defaultMessage="Cancel"
+        />
+      }
+      confirmButtonDisabled={
+        isSubmitting || (isSingleAgent && selectedAgentPolicyId === (agents[0] as Agent).policy_id)
+      }
+      confirmButtonText={
+        <FormattedMessage
+          id="xpack.fleet.agentReassignPolicy.continueButtonLabel"
+          defaultMessage="Assign policy"
+        />
+      }
+      buttonColor="danger"
+    >
+      <p>
+        <FormattedMessage
+          id="xpack.fleet.agentReassignPolicy.flyoutDescription"
+          defaultMessage="Choose a new agent policy to assign the selected {count, plural, one {agent} other {agents}} to."
+          values={{
+            count: isSingleAgent ? 1 : 0,
+          }}
+        />
+      </p>
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiFormRow
+            fullWidth
+            label={i18n.translate('xpack.fleet.agentReassignPolicy.selectPolicyLabel', {
+              defaultMessage: 'Agent policy',
+            })}
+          >
+            <EuiSelect
+              fullWidth
+              isLoading={agentPoliciesRequest.isLoading}
+              options={policySelectOptions}
+              value={selectedAgentPolicyId}
+              onChange={(e) => setSelectedAgentPolicyId(e.target.value)}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="l" />
+
+      {selectedAgentPolicyId && <AgentPolicyPackageBadges agentPolicyId={selectedAgentPolicyId} />}
+    </EuiConfirmModal>
+  );
+};
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
index 696acb49abef3d..5507fd6395c6ff 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
@@ -40,11 +40,11 @@ export const AgentUnenrollAgentModal: React.FunctionComponent<Props> = ({
       setIsSubmitting(true);
       const { error } = isSingleAgent
         ? await sendPostAgentUnenroll((agents[0] as Agent).id, {
-            force: forceUnenroll,
+            revoke: forceUnenroll,
           })
         : await sendPostBulkAgentUnenroll({
             agents: Array.isArray(agents) ? agents.map((agent) => agent.id) : agents,
-            force: forceUnenroll,
+            revoke: forceUnenroll,
           });
       if (error) {
         throw error;
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/fleet_server_upgrade_modal.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/fleet_server_upgrade_modal.tsx
new file mode 100644
index 00000000000000..4d6ac864ee8b51
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/fleet_server_upgrade_modal.tsx
@@ -0,0 +1,167 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useState } from 'react';
+import {
+  EuiButton,
+  EuiCheckbox,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiImage,
+  EuiLink,
+  EuiModal,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+
+import { sendPutSettings, useLink, useStartServices } from '../../../hooks';
+
+interface Props {
+  onClose: () => void;
+}
+
+export const FleetServerUpgradeModal: React.FunctionComponent<Props> = ({ onClose }) => {
+  const { getAssetsPath } = useLink();
+  const { notifications, cloud } = useStartServices();
+
+  const isCloud = !!cloud?.cloudId;
+
+  const [checked, setChecked] = useState(false);
+  const onChange = useCallback(async () => {
+    try {
+      setChecked(!checked);
+      await sendPutSettings({
+        has_seen_fleet_migration_notice: !checked,
+      });
+    } catch (error) {
+      notifications.toasts.addError(error, {
+        title: i18n.translate('xpack.fleet.fleetServerUpgradeModal.failedUpdateTitle', {
+          defaultMessage: `Error saving settings`,
+        }),
+      });
+    }
+  }, [checked, setChecked, notifications]);
+
+  return (
+    <EuiModal onClose={onClose}>
+      <EuiModalHeader>
+        <EuiModalHeaderTitle>
+          <FormattedMessage
+            id="xpack.fleet.fleetServerUpgradeModal.modalTitle"
+            defaultMessage="This version of Fleet requires a Fleet Server"
+          />
+        </EuiModalHeaderTitle>
+      </EuiModalHeader>
+      <EuiModalBody>
+        <EuiImage
+          src={getAssetsPath('./announcement.jpg')}
+          alt={i18n.translate('xpack.fleet.fleetServerUpgradeModal.announcementImageAlt', {
+            defaultMessage: 'Fleet Server upgrade announcement',
+          })}
+        />
+        <EuiSpacer size="m" />
+        <EuiText>
+          {isCloud ? (
+            <FormattedMessage
+              id="xpack.fleet.fleetServerUpgradeModal.cloudDescriptionMessage"
+              defaultMessage="Fleet Server is now available and it provides improved scalability and security. If you already had APM on Elastic Cloud, we've upgraded it to APM & Fleet. {existingAgentsMessage} To continue using Fleet, you must install a Fleet Server and the new version of Elastic Agent on each host. Learn more in our {link}."
+              values={{
+                existingAgentsMessage: (
+                  <strong>
+                    <FormattedMessage
+                      id="xpack.fleet.fleetServerUpgradeModal.existingAgentText"
+                      defaultMessage="Your existing Elastic Agents have been automatically unenrolled and have stopped sending data."
+                    />
+                  </strong>
+                ),
+                link: (
+                  <EuiLink
+                    href="https://www.elastic.co/guide/en/fleet/current/upgrade-elastic-agent.html"
+                    external={true}
+                  >
+                    <FormattedMessage
+                      id="xpack.fleet.fleetServerUpgradeModal.fleetServerMigrationGuide"
+                      defaultMessage="Fleet Server migration guide"
+                    />
+                  </EuiLink>
+                ),
+              }}
+            />
+          ) : (
+            <FormattedMessage
+              id="xpack.fleet.fleetServerUpgradeModal.onPremDescriptionMessage"
+              defaultMessage="Fleet Server is now available and it provides improved scalability and security. {existingAgentsMessage} To continue using Fleet, you must install a Fleet Server and the new version of Elastic Agent on each host. Learn more in our {link}."
+              values={{
+                existingAgentsMessage: (
+                  <strong>
+                    <FormattedMessage
+                      id="xpack.fleet.fleetServerUpgradeModal.existingAgentText"
+                      defaultMessage="Your existing Elastic Agents have been automatically unenrolled and have stopped sending data."
+                    />
+                  </strong>
+                ),
+                link: (
+                  <EuiLink href="https://ela.st/add-fleet-server" external={true} target="_blank">
+                    <FormattedMessage
+                      id="xpack.fleet.fleetServerUpgradeModal.fleetServerMigrationGuide"
+                      defaultMessage="Fleet Server migration guide"
+                    />
+                  </EuiLink>
+                ),
+              }}
+            />
+          )}
+        </EuiText>
+        <EuiSpacer size="l" />
+        <EuiText>
+          <FormattedMessage
+            id="xpack.fleet.fleetServerUpgradeModal.breakingChangeMessage"
+            defaultMessage="This is a breaking change, which is why we are making it in a beta release. We are sorry for the inconvenience. Please share {link} if you have questions or need help."
+            values={{
+              link: (
+                <EuiLink href="https://ela.st/fleet-feedback" target="_blank">
+                  <FormattedMessage
+                    id="xpack.fleet.fleetServerUpgradeModal.fleetFeedbackLink"
+                    defaultMessage="feedback"
+                  />
+                </EuiLink>
+              ),
+            }}
+          />
+        </EuiText>
+      </EuiModalBody>
+      <EuiModalFooter>
+        <EuiFlexGroup justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiCheckbox
+              id="fleetServerModalCheckbox"
+              label={i18n.translate('xpack.fleet.fleetServerUpgradeModal.checkboxLabel', {
+                defaultMessage: 'Do not show this message again',
+              })}
+              checked={checked}
+              onChange={onChange}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButton fill onClick={onClose}>
+              <FormattedMessage
+                id="xpack.fleet.fleetServerUpgradeModal.closeButton"
+                defaultMessage="Close and get started"
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiModalFooter>
+    </EuiModal>
+  );
+};
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/index.tsx
index 93425ba10413cc..45f09c79d55337 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/index.tsx
@@ -6,7 +6,7 @@
  */
 
 export * from './loading';
-export * from './agent_reassign_policy_flyout';
+export * from './agent_reassign_policy_modal';
 export * from './agent_enrollment_flyout';
 export * from './agent_health';
 export * from './agent_unenroll_modal';
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.tsx
index b8c9ead6773f57..56eb4072c38478 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.tsx
@@ -5,13 +5,19 @@
  * 2.0.
  */
 
-import React, { useEffect } from 'react';
+import React, { useCallback, useEffect, useState } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { HashRouter as Router, Route, Switch, Redirect } from 'react-router-dom';
 
 import { PAGE_ROUTING_PATHS } from '../../constants';
 import { Loading, Error } from '../../components';
-import { useConfig, useFleetStatus, useBreadcrumbs, useCapabilities } from '../../hooks';
+import {
+  useConfig,
+  useFleetStatus,
+  useBreadcrumbs,
+  useCapabilities,
+  useGetSettings,
+} from '../../hooks';
 import { WithoutHeaderLayout } from '../../layouts';
 
 import { AgentListPage } from './agent_list_page';
@@ -20,6 +26,7 @@ import { AgentDetailsPage } from './agent_details_page';
 import { NoAccessPage } from './error_pages/no_access';
 import { EnrollmentTokenListPage } from './enrollment_token_list_page';
 import { ListLayout } from './components/list_layout';
+import { FleetServerUpgradeModal } from './components/fleet_server_upgrade_modal';
 
 const REFRESH_INTERVAL_MS = 30000;
 
@@ -31,6 +38,20 @@ export const FleetApp: React.FunctionComponent = () => {
 
   const fleetStatus = useFleetStatus();
 
+  const settings = useGetSettings();
+
+  const [fleetServerModalVisible, setFleetServerModalVisible] = useState(false);
+  const onCloseFleetServerModal = useCallback(() => {
+    setFleetServerModalVisible(false);
+  }, [setFleetServerModalVisible]);
+
+  useEffect(() => {
+    // if it's undefined do not show the modal
+    if (settings.data && settings.data?.item.has_seen_fleet_migration_notice === false) {
+      setFleetServerModalVisible(true);
+    }
+  }, [settings.data]);
+
   useEffect(() => {
     if (
       !agents.enabled ||
@@ -99,6 +120,9 @@ export const FleetApp: React.FunctionComponent = () => {
         </Route>
         <Route path={PAGE_ROUTING_PATHS.fleet_agent_list}>
           <ListLayout>
+            {fleetServerModalVisible && (
+              <FleetServerUpgradeModal onClose={onCloseFleetServerModal} />
+            )}
             {hasOnlyFleetServerMissingRequirement ? (
               <FleetServerRequirementPage />
             ) : (
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/epm/screens/detail/policies/package_policies.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/epm/screens/detail/policies/package_policies.tsx
index 94b4b748cb1bd7..b14551098e688a 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/epm/screens/detail/policies/package_policies.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/epm/screens/detail/policies/package_policies.tsx
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import type { ReactNode } from 'react';
 import React, { memo, useCallback, useMemo } from 'react';
 import { Redirect } from 'react-router-dom';
 import type { CriteriaWithPagination, EuiTableFieldDataColumnType } from '@elastic/eui';
@@ -16,8 +15,7 @@ import { FormattedRelative, FormattedMessage } from '@kbn/i18n/react';
 import { InstallStatus } from '../../../../../types';
 import { useLink, useUrlPagination } from '../../../../../hooks';
 import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../../../constants';
-import type { LinkAndRevisionProps } from '../../../../../components';
-import { LinkAndRevision } from '../../../../../components';
+import { AgentPolicySummaryLine } from '../../../../../components';
 import { LinkedAgentCount } from '../../../../../components/linked_agent_count';
 import { useGetPackageInstallStatus } from '../../../hooks';
 
@@ -42,27 +40,6 @@ const IntegrationDetailsLink = memo<{
     </EuiLink>
   );
 });
-
-const AgentPolicyDetailLink = memo<{
-  agentPolicyId: string;
-  revision: LinkAndRevisionProps['revision'];
-  children: ReactNode;
-}>(({ agentPolicyId, revision, children }) => {
-  const { getHref } = useLink();
-
-  return (
-    <LinkAndRevision
-      className="eui-textTruncate"
-      revision={revision}
-      href={getHref('policy_details', {
-        policyId: agentPolicyId,
-      })}
-    >
-      {children}
-    </LinkAndRevision>
-  );
-});
-
 interface PackagePoliciesPanelProps {
   name: string;
   version: string;
@@ -112,11 +89,7 @@ export const PackagePoliciesPage = ({ name, version }: PackagePoliciesPanelProps
         }),
         truncateText: true,
         render(id, { agentPolicy }) {
-          return (
-            <AgentPolicyDetailLink agentPolicyId={id} revision={agentPolicy.revision}>
-              {agentPolicy.name ?? id}
-            </AgentPolicyDetailLink>
-          );
+          return <AgentPolicySummaryLine policy={agentPolicy} />;
         },
       },
       {
diff --git a/x-pack/plugins/fleet/public/assets/announcement.jpg b/x-pack/plugins/fleet/public/assets/announcement.jpg
new file mode 100644
index 00000000000000..65191f1da6c539
Binary files /dev/null and b/x-pack/plugins/fleet/public/assets/announcement.jpg differ
diff --git a/x-pack/plugins/fleet/server/index.ts b/x-pack/plugins/fleet/server/index.ts
index c1baa43f4d5881..25298d991230de 100644
--- a/x-pack/plugins/fleet/server/index.ts
+++ b/x-pack/plugins/fleet/server/index.ts
@@ -34,8 +34,7 @@ export const config: PluginConfigDescriptor = {
   deprecations: ({ renameFromRoot, unused }) => [
     renameFromRoot('xpack.ingestManager', 'xpack.fleet'),
     renameFromRoot('xpack.fleet.fleet', 'xpack.fleet.agents'),
-    unused('agents.kibana.ca_sha256'),
-    unused('agents.kibana.host'),
+    unused('agents.kibana'),
     unused('agents.maxConcurrentConnections'),
     unused('agents.agentPolicyRolloutRateLimitIntervalMs'),
     unused('agents.agentPolicyRolloutRateLimitRequestPerInterval'),
diff --git a/x-pack/plugins/fleet/server/routes/epm/handlers.ts b/x-pack/plugins/fleet/server/routes/epm/handlers.ts
index f0d6e684273614..16d583f8a8d1f3 100644
--- a/x-pack/plugins/fleet/server/routes/epm/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/epm/handlers.ts
@@ -226,20 +226,21 @@ export const installPackageFromRegistryHandler: RequestHandler<
   const savedObjectsClient = context.core.savedObjects.client;
   const esClient = context.core.elasticsearch.client.asCurrentUser;
   const { pkgkey } = request.params;
-  try {
-    const res = await installPackage({
-      installSource: 'registry',
-      savedObjectsClient,
-      pkgkey,
-      esClient,
-      force: request.body?.force,
-    });
+
+  const res = await installPackage({
+    installSource: 'registry',
+    savedObjectsClient,
+    pkgkey,
+    esClient,
+    force: request.body?.force,
+  });
+  if (!res.error) {
     const body: InstallPackageResponse = {
-      response: res.assets,
+      response: res.assets || [],
     };
     return response.ok({ body });
-  } catch (e) {
-    return await defaultIngestErrorHandler({ error: e, response });
+  } else {
+    return await defaultIngestErrorHandler({ error: res.error, response });
   }
 };
 
@@ -292,20 +293,21 @@ export const installPackageByUploadHandler: RequestHandler<
   const esClient = context.core.elasticsearch.client.asCurrentUser;
   const contentType = request.headers['content-type'] as string; // from types it could also be string[] or undefined but this is checked later
   const archiveBuffer = Buffer.from(request.body);
-  try {
-    const res = await installPackage({
-      installSource: 'upload',
-      savedObjectsClient,
-      esClient,
-      archiveBuffer,
-      contentType,
-    });
+
+  const res = await installPackage({
+    installSource: 'upload',
+    savedObjectsClient,
+    esClient,
+    archiveBuffer,
+    contentType,
+  });
+  if (!res.error) {
     const body: InstallPackageResponse = {
-      response: res.assets,
+      response: res.assets || [],
     };
     return response.ok({ body });
-  } catch (error) {
-    return defaultIngestErrorHandler({ error, response });
+  } else {
+    return defaultIngestErrorHandler({ error: res.error, response });
   }
 };
 
diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts
index 2cf9bbc3b91e3d..fd32d699ae45e2 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.test.ts
@@ -46,7 +46,11 @@ describe('FleetSetupHandler', () => {
 
   it('POST /setup succeeds w/200 and body of resolved value', async () => {
     mockSetupIngestManager.mockImplementation(() =>
-      Promise.resolve({ isInitialized: true, preconfigurationError: undefined })
+      Promise.resolve({
+        isInitialized: true,
+        preconfigurationError: undefined,
+        nonFatalPackageUpgradeErrors: [],
+      })
     );
     await fleetSetupHandler(context, request, response);
 
diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
index b6aa9e29de9ee4..a6d7acccfb4fe5 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
@@ -46,8 +46,14 @@ export const fleetSetupHandler: RequestHandler = async (context, request, respon
   try {
     const soClient = context.core.savedObjects.client;
     const esClient = context.core.elasticsearch.client.asCurrentUser;
-    const body: PostIngestSetupResponse = { isInitialized: true };
-    await setupIngestManager(soClient, esClient);
+    const setupStatus = await setupIngestManager(soClient, esClient);
+    const body: PostIngestSetupResponse = {
+      isInitialized: true,
+    };
+
+    if (setupStatus.nonFatalPackageUpgradeErrors.length > 0) {
+      body.nonFatalPackageUpgradeErrors = setupStatus.nonFatalPackageUpgradeErrors;
+    }
 
     return response.ok({
       body,
diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts
index 27725bfc637ee1..f55de4b691999c 100644
--- a/x-pack/plugins/fleet/server/saved_objects/index.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/index.ts
@@ -61,6 +61,7 @@ const getSavedObjectTypes = (
       properties: {
         fleet_server_hosts: { type: 'keyword' },
         has_seen_add_data_notice: { type: 'boolean', index: false },
+        has_seen_fleet_migration_notice: { type: 'boolean', index: false },
       },
     },
     migrations: {
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/bulk_install_packages.ts b/x-pack/plugins/fleet/server/services/epm/packages/bulk_install_packages.ts
index 7323263d4a70f5..2c5b072aa39796 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/bulk_install_packages.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/bulk_install_packages.ts
@@ -32,22 +32,31 @@ export async function bulkInstallPackages({
   );
 
   logger.debug(`kicking off bulk install of ${packagesToInstall.join(', ')} from registry`);
-  const installResults = await Promise.allSettled(
+  const bulkInstallResults = await Promise.allSettled(
     latestPackagesResults.map(async (result, index) => {
       const packageName = packagesToInstall[index];
       if (result.status === 'fulfilled') {
         const latestPackage = result.value;
-        return {
-          name: packageName,
-          version: latestPackage.version,
-          result: await installPackage({
-            savedObjectsClient,
-            esClient,
-            pkgkey: Registry.pkgToPkgKey(latestPackage),
-            installSource,
-            skipPostInstall: true,
-          }),
-        };
+        const installResult = await installPackage({
+          savedObjectsClient,
+          esClient,
+          pkgkey: Registry.pkgToPkgKey(latestPackage),
+          installSource,
+          skipPostInstall: true,
+        });
+        if (installResult.error) {
+          return {
+            name: packageName,
+            error: installResult.error,
+            installType: installResult.installType,
+          };
+        } else {
+          return {
+            name: packageName,
+            version: latestPackage.version,
+            result: installResult,
+          };
+        }
       }
       return { name: packageName, error: result.reason };
     })
@@ -56,18 +65,31 @@ export async function bulkInstallPackages({
   // only install index patterns if we completed install for any package-version for the
   // first time, aka fresh installs or upgrades
   if (
-    installResults.find(
-      (result) => result.status === 'fulfilled' && result.value.result?.status === 'installed'
+    bulkInstallResults.find(
+      (result) =>
+        result.status === 'fulfilled' &&
+        !result.value.result?.error &&
+        result.value.result?.status === 'installed'
     )
   ) {
     await installIndexPatterns({ savedObjectsClient, esClient, installSource });
   }
 
-  return installResults.map((result, index) => {
+  return bulkInstallResults.map((result, index) => {
     const packageName = packagesToInstall[index];
-    return result.status === 'fulfilled'
-      ? result.value
-      : { name: packageName, error: result.reason };
+    if (result.status === 'fulfilled') {
+      if (result.value && result.value.error) {
+        return {
+          name: packageName,
+          error: result.value.error,
+          installType: result.value.installType,
+        };
+      } else {
+        return result.value;
+      }
+    } else {
+      return { name: packageName, error: result.reason };
+    }
   });
 }
 
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/ensure_installed_default_packages.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/ensure_installed_default_packages.test.ts
index fa2ea9e2209edf..60e2e5ea2cbf8b 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/ensure_installed_default_packages.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/ensure_installed_default_packages.test.ts
@@ -77,14 +77,14 @@ describe('ensureInstalledDefaultPackages', () => {
       return [
         {
           name: mockInstallation.attributes.name,
-          result: { assets: [], status: 'installed' },
+          result: { assets: [], status: 'installed', installType: 'install' },
           version: '',
           statusCode: 200,
         },
       ];
     });
     const resp = await ensureInstalledDefaultPackages(soClient, jest.fn());
-    expect(resp).toEqual([mockInstallation.attributes]);
+    expect(resp.installations).toEqual([mockInstallation.attributes]);
   });
   it('should throw the first Error it finds', async () => {
     class SomeCustomError extends Error {}
@@ -95,13 +95,13 @@ describe('ensureInstalledDefaultPackages', () => {
       return [
         {
           name: 'success one',
-          result: { assets: [], status: 'installed' },
+          result: { assets: [], status: 'installed', installType: 'install' },
           version: '',
           statusCode: 200,
         },
         {
           name: 'success two',
-          result: { assets: [], status: 'installed' },
+          result: { assets: [], status: 'installed', installType: 'install' },
           version: '',
           statusCode: 200,
         },
@@ -111,7 +111,7 @@ describe('ensureInstalledDefaultPackages', () => {
         },
         {
           name: 'success three',
-          result: { assets: [], status: 'installed' },
+          result: { assets: [], status: 'installed', installType: 'install' },
           version: '',
           statusCode: 200,
         },
@@ -134,7 +134,7 @@ describe('ensureInstalledDefaultPackages', () => {
       return [
         {
           name: 'undefined package',
-          result: { assets: [], status: 'installed' },
+          result: { assets: [], status: 'installed', installType: 'install' },
           version: '',
           statusCode: 200,
         },
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
index 4373251a969bc4..ec1cc322475b03 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
@@ -12,7 +12,12 @@ import type { ElasticsearchClient, SavedObject, SavedObjectsClientContract } fro
 import { generateESIndexPatterns } from '../elasticsearch/template/template';
 
 import { defaultPackages } from '../../../../common';
-import type { BulkInstallPackageInfo, InstallablePackage, InstallSource } from '../../../../common';
+import type {
+  BulkInstallPackageInfo,
+  InstallablePackage,
+  InstallSource,
+  DefaultPackagesInstallationError,
+} from '../../../../common';
 import {
   IngestManagerError,
   PackageOperationNotSupportedError,
@@ -45,11 +50,17 @@ import { removeInstallation } from './remove';
 import { getPackageSavedObjects } from './get';
 import { _installPackage } from './_install_package';
 
+export interface DefaultPackagesInstallationResult {
+  installations: Installation[];
+  nonFatalPackageUpgradeErrors: DefaultPackagesInstallationError[];
+}
+
 export async function ensureInstalledDefaultPackages(
   savedObjectsClient: SavedObjectsClientContract,
   esClient: ElasticsearchClient
-): Promise<Installation[]> {
+): Promise<DefaultPackagesInstallationResult> {
   const installations = [];
+  const nonFatalPackageUpgradeErrors = [];
   const bulkResponse = await bulkInstallPackages({
     savedObjectsClient,
     packagesToInstall: Object.values(defaultPackages),
@@ -58,19 +69,27 @@ export async function ensureInstalledDefaultPackages(
 
   for (const resp of bulkResponse) {
     if (isBulkInstallError(resp)) {
-      throw resp.error;
+      if (resp.installType && (resp.installType === 'update' || resp.installType === 'reupdate')) {
+        nonFatalPackageUpgradeErrors.push({ installType: resp.installType, error: resp.error });
+      } else {
+        throw resp.error;
+      }
     } else {
       installations.push(getInstallation({ savedObjectsClient, pkgName: resp.name }));
     }
   }
 
   const retrievedInstallations = await Promise.all(installations);
-  return retrievedInstallations.map((installation, index) => {
+  const verifiedInstallations = retrievedInstallations.map((installation, index) => {
     if (!installation) {
       throw new Error(`could not get installation ${bulkResponse[index].name}`);
     }
     return installation;
   });
+  return {
+    installations: verifiedInstallations,
+    nonFatalPackageUpgradeErrors,
+  };
 }
 
 async function isPackageVersionOrLaterInstalled(options: {
@@ -181,6 +200,7 @@ export async function handleInstallPackageFailure({
 export interface IBulkInstallPackageError {
   name: string;
   error: Error;
+  installType?: InstallType;
 }
 export type BulkInstallResponse = BulkInstallPackageInfo | IBulkInstallPackageError;
 
@@ -201,54 +221,62 @@ async function installPackageFromRegistry({
   // TODO: change epm API to /packageName/version so we don't need to do this
   const { pkgName, pkgVersion } = Registry.splitPkgKey(pkgkey);
 
-  // get the currently installed package
-  const installedPkg = await getInstallationObject({ savedObjectsClient, pkgName });
-  const installType = getInstallType({ pkgVersion, installedPkg });
-
-  // get latest package version
-  const latestPackage = await Registry.fetchFindLatestPackage(pkgName);
-
-  // let the user install if using the force flag or needing to reinstall or install a previous version due to failed update
-  const installOutOfDateVersionOk =
-    force || ['reinstall', 'reupdate', 'rollback'].includes(installType);
+  // if an error happens during getInstallType, report that we don't know
+  let installType: InstallType = 'unknown';
 
-  // if the requested version is the same as installed version, check if we allow it based on
-  // current installed package status and force flag, if we don't allow it,
-  // just return the asset references from the existing installation
-  if (
-    installedPkg?.attributes.version === pkgVersion &&
-    installedPkg?.attributes.install_status === 'installed'
-  ) {
-    if (!force) {
-      logger.debug(`${pkgkey} is already installed, skipping installation`);
-      return {
-        assets: [
-          ...installedPkg.attributes.installed_es,
-          ...installedPkg.attributes.installed_kibana,
-        ],
-        status: 'already_installed',
-      };
+  try {
+    // get the currently installed package
+    const installedPkg = await getInstallationObject({ savedObjectsClient, pkgName });
+    installType = getInstallType({ pkgVersion, installedPkg });
+
+    // get latest package version
+    const latestPackage = await Registry.fetchFindLatestPackage(pkgName);
+
+    // let the user install if using the force flag or needing to reinstall or install a previous version due to failed update
+    const installOutOfDateVersionOk =
+      force || ['reinstall', 'reupdate', 'rollback'].includes(installType);
+
+    // if the requested version is the same as installed version, check if we allow it based on
+    // current installed package status and force flag, if we don't allow it,
+    // just return the asset references from the existing installation
+    if (
+      installedPkg?.attributes.version === pkgVersion &&
+      installedPkg?.attributes.install_status === 'installed'
+    ) {
+      if (!force) {
+        logger.debug(`${pkgkey} is already installed, skipping installation`);
+        return {
+          assets: [
+            ...installedPkg.attributes.installed_es,
+            ...installedPkg.attributes.installed_kibana,
+          ],
+          status: 'already_installed',
+          installType,
+        };
+      }
     }
-  }
 
-  // if the requested version is out-of-date of the latest package version, check if we allow it
-  // if we don't allow it, return an error
-  if (semverLt(pkgVersion, latestPackage.version)) {
-    if (!installOutOfDateVersionOk) {
-      throw new PackageOutdatedError(`${pkgkey} is out-of-date and cannot be installed or updated`);
+    // if the requested version is out-of-date of the latest package version, check if we allow it
+    // if we don't allow it, return an error
+    if (semverLt(pkgVersion, latestPackage.version)) {
+      if (!installOutOfDateVersionOk) {
+        throw new PackageOutdatedError(
+          `${pkgkey} is out-of-date and cannot be installed or updated`
+        );
+      }
+      logger.debug(
+        `${pkgkey} is out-of-date, installing anyway due to ${
+          force ? 'force flag' : `install type ${installType}`
+        }`
+      );
     }
-    logger.debug(
-      `${pkgkey} is out-of-date, installing anyway due to ${
-        force ? 'force flag' : `install type ${installType}`
-      }`
-    );
-  }
 
-  // get package info
-  const { paths, packageInfo } = await Registry.getRegistryPackage(pkgName, pkgVersion);
+    // get package info
+    const { paths, packageInfo } = await Registry.getRegistryPackage(pkgName, pkgVersion);
 
-  // try installing the package, if there was an error, call error handler and rethrow
-  try {
+    // try installing the package, if there was an error, call error handler and rethrow
+    // TODO: without the ts-ignore, TS complains about the type of the value of the returned InstallResult.status
+    // @ts-ignore
     return _installPackage({
       savedObjectsClient,
       esClient,
@@ -257,19 +285,26 @@ async function installPackageFromRegistry({
       packageInfo,
       installType,
       installSource: 'registry',
-    }).then((assets) => {
-      return { assets, status: 'installed' };
-    });
+    })
+      .then((assets) => {
+        return { assets, status: 'installed', installType };
+      })
+      .catch(async (err: Error) => {
+        await handleInstallPackageFailure({
+          savedObjectsClient,
+          error: err,
+          pkgName,
+          pkgVersion,
+          installedPkg,
+          esClient,
+        });
+        return { error: err, installType };
+      });
   } catch (e) {
-    await handleInstallPackageFailure({
-      savedObjectsClient,
+    return {
       error: e,
-      pkgName,
-      pkgVersion,
-      installedPkg,
-      esClient,
-    });
-    throw e;
+      installType,
+    };
   }
 }
 
@@ -286,46 +321,57 @@ async function installPackageByUpload({
   archiveBuffer,
   contentType,
 }: InstallUploadedArchiveParams): Promise<InstallResult> {
-  const { packageInfo } = await parseAndVerifyArchiveEntries(archiveBuffer, contentType);
-
-  const installedPkg = await getInstallationObject({
-    savedObjectsClient,
-    pkgName: packageInfo.name,
-  });
+  // if an error happens during getInstallType, report that we don't know
+  let installType: InstallType = 'unknown';
+  try {
+    const { packageInfo } = await parseAndVerifyArchiveEntries(archiveBuffer, contentType);
 
-  const installType = getInstallType({ pkgVersion: packageInfo.version, installedPkg });
-  if (installType !== 'install') {
-    throw new PackageOperationNotSupportedError(
-      `Package upload only supports fresh installations. Package ${packageInfo.name} is already installed, please uninstall first.`
-    );
-  }
+    const installedPkg = await getInstallationObject({
+      savedObjectsClient,
+      pkgName: packageInfo.name,
+    });
 
-  const installSource = 'upload';
-  const paths = await unpackBufferToCache({
-    name: packageInfo.name,
-    version: packageInfo.version,
-    installSource,
-    archiveBuffer,
-    contentType,
-  });
+    installType = getInstallType({ pkgVersion: packageInfo.version, installedPkg });
+    if (installType !== 'install') {
+      throw new PackageOperationNotSupportedError(
+        `Package upload only supports fresh installations. Package ${packageInfo.name} is already installed, please uninstall first.`
+      );
+    }
 
-  setPackageInfo({
-    name: packageInfo.name,
-    version: packageInfo.version,
-    packageInfo,
-  });
+    const installSource = 'upload';
+    const paths = await unpackBufferToCache({
+      name: packageInfo.name,
+      version: packageInfo.version,
+      installSource,
+      archiveBuffer,
+      contentType,
+    });
 
-  return _installPackage({
-    savedObjectsClient,
-    esClient,
-    installedPkg,
-    paths,
-    packageInfo,
-    installType,
-    installSource,
-  }).then((assets) => {
-    return { assets, status: 'installed' };
-  });
+    setPackageInfo({
+      name: packageInfo.name,
+      version: packageInfo.version,
+      packageInfo,
+    });
+    // TODO: without the ts-ignore, TS complains about the type of the value of the returned InstallResult.status
+    // @ts-ignore
+    return _installPackage({
+      savedObjectsClient,
+      esClient,
+      installedPkg,
+      paths,
+      packageInfo,
+      installType,
+      installSource,
+    })
+      .then((assets) => {
+        return { assets, status: 'installed', installType };
+      })
+      .catch(async (err: Error) => {
+        return { error: err, installType };
+      });
+  } catch (e) {
+    return { error: e, installType };
+  }
 }
 
 export type InstallPackageParams = {
@@ -352,7 +398,7 @@ export async function installPackage(args: InstallPackageParams) {
       esClient,
       force,
     }).then(async (installResult) => {
-      if (skipPostInstall) {
+      if (skipPostInstall || installResult.error) {
         return installResult;
       }
       logger.debug(`install of ${pkgkey} finished, running post-install`);
@@ -374,7 +420,7 @@ export async function installPackage(args: InstallPackageParams) {
       archiveBuffer,
       contentType,
     }).then(async (installResult) => {
-      if (skipPostInstall) {
+      if (skipPostInstall || installResult.error) {
         return installResult;
       }
       logger.debug(`install of uploaded package finished, running post-install`);
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/remove.ts b/x-pack/plugins/fleet/server/services/epm/packages/remove.ts
index de798e822b0298..706f1bbbaaf35b 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/remove.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/remove.ts
@@ -79,6 +79,7 @@ export async function removeInstallation(options: {
   return installedAssets;
 }
 
+// TODO: this is very much like deleteKibanaSavedObjectsAssets below
 function deleteKibanaAssets(
   installedObjects: KibanaAssetReference[],
   savedObjectsClient: SavedObjectsClientContract
@@ -136,6 +137,7 @@ async function deleteTemplate(esClient: ElasticsearchClient, name: string): Prom
   }
 }
 
+// TODO: this is very much like deleteKibanaAssets above
 export async function deleteKibanaSavedObjectsAssets(
   savedObjectsClient: SavedObjectsClientContract,
   installedRefs: AssetReference[]
@@ -153,6 +155,9 @@ export async function deleteKibanaSavedObjectsAssets(
   try {
     await Promise.all(deletePromises);
   } catch (err) {
-    logger.warn(err);
+    // in the rollback case, partial installs are likely, so missing assets are not an error
+    if (!savedObjectsClient.errors.isNotFoundError(err)) {
+      logger.error(err);
+    }
   }
 }
diff --git a/x-pack/plugins/fleet/server/services/fleet_server/saved_object_migrations.ts b/x-pack/plugins/fleet/server/services/fleet_server/saved_object_migrations.ts
index 7ccee39aa815cc..82fd937092477d 100644
--- a/x-pack/plugins/fleet/server/services/fleet_server/saved_object_migrations.ts
+++ b/x-pack/plugins/fleet/server/services/fleet_server/saved_object_migrations.ts
@@ -25,6 +25,7 @@ import { listEnrollmentApiKeys, getEnrollmentAPIKey } from '../api_keys/enrollme
 import { appContextService } from '../app_context';
 import { agentPolicyService } from '../agent_policy';
 import { invalidateAPIKeys } from '../api_keys';
+import { settingsService } from '..';
 
 export async function runFleetServerMigration() {
   await Promise.all([migrateEnrollmentApiKeys(), migrateAgentPolicies(), migrateAgents()]);
@@ -54,6 +55,9 @@ async function migrateAgents() {
   const soClient = getInternalUserSOClient();
   const logger = appContextService.getLogger();
   let hasMore = true;
+
+  let hasAgents = false;
+
   while (hasMore) {
     const res = await soClient.find({
       type: AGENT_SAVED_OBJECT_TYPE,
@@ -63,7 +67,10 @@ async function migrateAgents() {
 
     if (res.total === 0) {
       hasMore = false;
+    } else {
+      hasAgents = true;
     }
+
     for (const so of res.saved_objects) {
       try {
         const {
@@ -115,6 +122,13 @@ async function migrateAgents() {
       }
     }
   }
+
+  // Update settings to show migration modal
+  if (hasAgents) {
+    await settingsService.saveSettings(soClient, {
+      has_seen_fleet_migration_notice: false,
+    });
+  }
 }
 
 async function migrateEnrollmentApiKeys() {
diff --git a/x-pack/plugins/fleet/server/services/setup.ts b/x-pack/plugins/fleet/server/services/setup.ts
index c906dc73e6df24..de6876c7f6fda8 100644
--- a/x-pack/plugins/fleet/server/services/setup.ts
+++ b/x-pack/plugins/fleet/server/services/setup.ts
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 
 import { DEFAULT_AGENT_POLICIES_PACKAGES, FLEET_SERVER_PACKAGE } from '../../common';
 
-import type { PackagePolicy } from '../../common';
+import type { PackagePolicy, DefaultPackagesInstallationError } from '../../common';
 
 import { SO_SEARCH_LIMIT } from '../constants';
 
@@ -33,6 +33,7 @@ import { awaitIfFleetServerSetupPending } from './fleet_server';
 export interface SetupStatus {
   isInitialized: boolean;
   preconfigurationError: { name: string; message: string } | undefined;
+  nonFatalPackageUpgradeErrors: DefaultPackagesInstallationError[];
 }
 
 export async function setupIngestManager(
@@ -46,7 +47,7 @@ async function createSetupSideEffects(
   soClient: SavedObjectsClientContract,
   esClient: ElasticsearchClient
 ): Promise<SetupStatus> {
-  const [installedPackages, defaultOutput] = await Promise.all([
+  const [defaultPackagesResult, defaultOutput] = await Promise.all([
     // packages installed by default
     ensureInstalledDefaultPackages(soClient, esClient),
     outputService.ensureDefaultOutput(soClient),
@@ -142,7 +143,7 @@ async function createSetupSideEffects(
       );
     }
 
-    for (const installedPackage of installedPackages) {
+    for (const installedPackage of defaultPackagesResult.installations) {
       const packageShouldBeInstalled = DEFAULT_AGENT_POLICIES_PACKAGES.some(
         (packageName) => installedPackage.name === packageName
       );
@@ -172,7 +173,11 @@ async function createSetupSideEffects(
 
   await ensureAgentActionPolicyChangeExists(soClient, esClient);
 
-  return { isInitialized: true, preconfigurationError };
+  return {
+    isInitialized: true,
+    preconfigurationError,
+    nonFatalPackageUpgradeErrors: defaultPackagesResult.nonFatalPackageUpgradeErrors,
+  };
 }
 
 export async function ensureDefaultEnrollmentAPIKeysExists(
diff --git a/x-pack/plugins/fleet/server/types/rest_spec/settings.ts b/x-pack/plugins/fleet/server/types/rest_spec/settings.ts
index 551cc37551da20..fbadac2353b029 100644
--- a/x-pack/plugins/fleet/server/types/rest_spec/settings.ts
+++ b/x-pack/plugins/fleet/server/types/rest_spec/settings.ts
@@ -23,6 +23,7 @@ export const PutSettingsRequestSchema = {
       })
     ),
     has_seen_add_data_notice: schema.maybe(schema.boolean()),
+    has_seen_fleet_migration_notice: schema.maybe(schema.boolean()),
     additional_yaml_config: schema.maybe(schema.string()),
     // Deprecated not used
     kibana_urls: schema.maybe(
diff --git a/x-pack/plugins/graph/public/components/field_manager/_field_editor.scss b/x-pack/plugins/graph/public/components/field_manager/_field_editor.scss
index 20773d98ce9c31..867899fc663914 100644
--- a/x-pack/plugins/graph/public/components/field_manager/_field_editor.scss
+++ b/x-pack/plugins/graph/public/components/field_manager/_field_editor.scss
@@ -1,11 +1,21 @@
 .gphFieldEditor__badge {
   @include gphFieldBadgeSize;
-}
 
-.gphFieldEditor__badge--disabled,
-.gphFieldEditor__badge--disabled:focus {
-  opacity: .7;
-  text-decoration: line-through;
+  &.gphFieldEditor__badge--disabled,
+  &.gphFieldEditor__badge--disabled:hover,
+  &.gphFieldEditor__badge--disabled:focus,
+  &.gphFieldEditor__badge--disabled:not(:disabled):hover
+  &.gphFieldEditor__badge--disabled:not(:disabled):focus {
+    opacity: .7;
+    text-decoration: line-through;
+  }
+
+  // Chrome fix for focus: duplicate or Safari will ignore completely the disabled rule
+  &.gphFieldEditor__badge--disabled:focus:not(:focus-visible),
+  &.gphFieldEditor__badge--disabled:hover:not(:focus-visible) {
+    opacity: .7;
+    text-decoration: line-through;
+  }
 }
 
 .gphFieldEditor__badgeIcon {
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/phases/hot_phase/components/max_index_size_field.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/phases/hot_phase/components/max_index_size_field.tsx
index 78f3c74c9cb82d..195acf35c1357e 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/phases/hot_phase/components/max_index_size_field.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/phases/hot_phase/components/max_index_size_field.tsx
@@ -40,7 +40,13 @@ export const MaxIndexSizeField: FunctionComponent = () => {
           componentProps={{
             euiFieldProps: {
               'data-test-subj': 'hot-selectedMaxSizeStored',
-              prepend: <EuiIconTip type="alert" content={i18nTexts.deprecationMessage} />,
+              prepend: (
+                <EuiIconTip
+                  type="alert"
+                  aria-label={i18nTexts.deprecationMessage}
+                  content={i18nTexts.deprecationMessage}
+                />
+              ),
               min: 1,
             },
           }}
diff --git a/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts b/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts
new file mode 100644
index 00000000000000..14215c15394730
--- /dev/null
+++ b/x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { from, of } from 'rxjs';
+import { delay } from 'rxjs/operators';
+import {
+  fieldList,
+  FieldSpec,
+  IIndexPattern,
+  IndexPattern,
+  IndexPatternsContract,
+  RuntimeField,
+} from 'src/plugins/data/common';
+
+type IndexPatternMock = Pick<
+  IndexPattern,
+  | 'fields'
+  | 'getComputedFields'
+  | 'getFieldByName'
+  | 'getTimeField'
+  | 'id'
+  | 'isTimeBased'
+  | 'title'
+  | 'type'
+>;
+type IndexPatternMockSpec = Pick<IIndexPattern, 'id' | 'title' | 'type' | 'timeFieldName'> & {
+  fields: FieldSpec[];
+};
+
+export const createIndexPatternMock = ({
+  id,
+  title,
+  type = undefined,
+  fields,
+  timeFieldName,
+}: IndexPatternMockSpec): IndexPatternMock => {
+  const indexPatternFieldList = fieldList(fields);
+
+  return {
+    id,
+    title,
+    type,
+    fields: indexPatternFieldList,
+    getTimeField: () => indexPatternFieldList.find(({ name }) => name === timeFieldName),
+    isTimeBased: () => timeFieldName != null,
+    getFieldByName: (fieldName) => indexPatternFieldList.find(({ name }) => name === fieldName),
+    getComputedFields: () => ({
+      runtimeFields: indexPatternFieldList.reduce<Record<string, RuntimeField>>(
+        (accumulatedFields, { name, runtimeField }) => ({
+          ...accumulatedFields,
+          ...(runtimeField != null
+            ? {
+                [name]: runtimeField,
+              }
+            : {}),
+        }),
+        {}
+      ),
+      scriptFields: {},
+      storedFields: [],
+      docvalueFields: [],
+    }),
+  };
+};
+
+export const createIndexPatternsMock = (
+  asyncDelay: number,
+  indexPatterns: IndexPatternMock[]
+): {
+  getIdsWithTitle: IndexPatternsContract['getIdsWithTitle'];
+  get: (...args: Parameters<IndexPatternsContract['get']>) => Promise<IndexPatternMock>;
+} => {
+  return {
+    async getIdsWithTitle(_refresh?: boolean) {
+      const indexPatterns$ = of(
+        indexPatterns.map(({ id = 'unknown_id', title }) => ({ id, title }))
+      );
+      return await indexPatterns$.pipe(delay(asyncDelay)).toPromise();
+    },
+    async get(indexPatternId: string) {
+      const indexPatterns$ = from(
+        indexPatterns.filter((indexPattern) => indexPattern.id === indexPatternId)
+      );
+      return await indexPatterns$.pipe(delay(asyncDelay)).toPromise();
+    },
+  };
+};
+
+export const createIndexPatternsStartMock = (
+  asyncDelay: number,
+  indexPatterns: IndexPatternMock[]
+): any => {
+  return {
+    indexPatternsServiceFactory: async () => createIndexPatternsMock(asyncDelay, indexPatterns),
+  };
+};
diff --git a/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts b/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts
index 83bc8743900eb0..ab98ad75b8433f 100644
--- a/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts
+++ b/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts
@@ -53,18 +53,21 @@ export const logSourceColumnConfigurationRT = rt.union([
 export type LogSourceColumnConfiguration = rt.TypeOf<typeof logSourceColumnConfigurationRT>;
 
 // Kibana index pattern
-const logIndexPatternReferenceRT = rt.type({
+export const logIndexPatternReferenceRT = rt.type({
   type: rt.literal('index_pattern'),
   indexPatternId: rt.string,
 });
+export type LogIndexPatternReference = rt.TypeOf<typeof logIndexPatternReferenceRT>;
 
 // Legacy support
-const logIndexNameReferenceRT = rt.type({
+export const logIndexNameReferenceRT = rt.type({
   type: rt.literal('index_name'),
   indexName: rt.string,
 });
+export type LogIndexNameReference = rt.TypeOf<typeof logIndexNameReferenceRT>;
 
 export const logIndexReferenceRT = rt.union([logIndexPatternReferenceRT, logIndexNameReferenceRT]);
+export type LogIndexReference = rt.TypeOf<typeof logIndexReferenceRT>;
 
 export const logSourceConfigurationPropertiesRT = rt.strict({
   name: rt.string,
diff --git a/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts b/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts
index 8bc7eee7d4eb6d..daac7f6a138eb6 100644
--- a/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts
+++ b/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
+import { estypes } from '@elastic/elasticsearch';
+import { IndexPattern, IndexPatternsContract } from '../../../../../src/plugins/data/common';
+import { ObjectEntries } from '../utility_types';
 import {
-  LogSourceConfigurationProperties,
   LogSourceColumnConfiguration,
+  LogSourceConfigurationProperties,
 } from './log_source_configuration';
-import { IndexPatternsContract, IndexPattern } from '../../../../../src/plugins/data/common';
 
 export interface ResolvedLogSourceConfiguration {
   name: string;
@@ -19,6 +21,7 @@ export interface ResolvedLogSourceConfiguration {
   tiebreakerField: string;
   messageField: string[];
   fields: IndexPattern['fields'];
+  runtimeMappings: estypes.RuntimeFields;
   columns: LogSourceColumnConfiguration[];
 }
 
@@ -52,6 +55,7 @@ const resolveLegacyReference = async (
     tiebreakerField: sourceConfiguration.fields.tiebreaker,
     messageField: sourceConfiguration.fields.message,
     fields,
+    runtimeMappings: {},
     columns: sourceConfiguration.logColumns,
     name: sourceConfiguration.name,
     description: sourceConfiguration.description,
@@ -76,8 +80,36 @@ const resolveKibanaIndexPatternReference = async (
     tiebreakerField: '_doc',
     messageField: ['message'],
     fields: indexPattern.fields,
+    runtimeMappings: resolveRuntimeMappings(indexPattern),
     columns: sourceConfiguration.logColumns,
     name: sourceConfiguration.name,
     description: sourceConfiguration.description,
   };
 };
+
+// this might take other sources of runtime fields into account in the future
+const resolveRuntimeMappings = (indexPattern: IndexPattern): estypes.RuntimeFields => {
+  const { runtimeFields } = indexPattern.getComputedFields();
+
+  const runtimeMappingsFromIndexPattern = (Object.entries(runtimeFields) as ObjectEntries<
+    typeof runtimeFields
+  >).reduce<estypes.RuntimeFields>(
+    (accumulatedMappings, [runtimeFieldName, runtimeFieldSpec]) => ({
+      ...accumulatedMappings,
+      [runtimeFieldName]: {
+        type: runtimeFieldSpec.type,
+        ...(runtimeFieldSpec.script != null
+          ? {
+              script: {
+                lang: 'painless', // required in the es types
+                source: runtimeFieldSpec.script.source,
+              },
+            }
+          : {}),
+      },
+    }),
+    {}
+  );
+
+  return runtimeMappingsFromIndexPattern;
+};
diff --git a/x-pack/plugins/infra/common/utility_types.ts b/x-pack/plugins/infra/common/utility_types.ts
index a785b4d13e557e..1f26309973f0d7 100644
--- a/x-pack/plugins/infra/common/utility_types.ts
+++ b/x-pack/plugins/infra/common/utility_types.ts
@@ -45,5 +45,7 @@ interface DeepPartialArray<T> extends Array<DeepPartial<T>> {}
 
 type DeepPartialObject<T> = { [P in keyof T]+?: DeepPartial<T[P]> };
 
+export type ObjectValues<T> = Array<T[keyof T]>;
+
 export type ObjectEntry<T> = [keyof T, T[keyof T]];
 export type ObjectEntries<T> = Array<ObjectEntry<T>>;
diff --git a/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable_factory.ts b/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable_factory.ts
index 4b9b2f99215b7a..1c7e8ceb28fb4c 100644
--- a/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable_factory.ts
+++ b/x-pack/plugins/infra/public/components/log_stream/log_stream_embeddable_factory.ts
@@ -40,6 +40,16 @@ export class LogStreamEmbeddableFactoryDefinition
     });
   }
 
+  public getDescription() {
+    return i18n.translate('xpack.infra.logStreamEmbeddable.description', {
+      defaultMessage: 'Add a table of live streaming logs.',
+    });
+  }
+
+  public getIconType() {
+    return 'logsApp';
+  }
+
   public async getExplicitInput() {
     return {
       title: i18n.translate('xpack.infra.logStreamEmbeddable.title', {
diff --git a/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.mock.tsx b/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.mock.tsx
new file mode 100644
index 00000000000000..dbf032415cb992
--- /dev/null
+++ b/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.mock.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+import { from, of } from 'rxjs';
+import { delay } from 'rxjs/operators';
+import { CoreStart } from '../../../../../src/core/public';
+import { FieldSpec } from '../../../../../src/plugins/data/common';
+import {
+  IIndexPattern,
+  IndexPattern,
+  IndexPatternField,
+  IndexPatternsContract,
+} from '../../../../../src/plugins/data/public';
+import { KibanaContextProvider } from '../../../../../src/plugins/kibana_react/public';
+import { Pick2 } from '../../common/utility_types';
+
+type MockIndexPattern = Pick<
+  IndexPattern,
+  'id' | 'title' | 'type' | 'getTimeField' | 'isTimeBased' | 'getFieldByName'
+>;
+export type MockIndexPatternSpec = Pick<
+  IIndexPattern,
+  'id' | 'title' | 'type' | 'timeFieldName'
+> & {
+  fields: FieldSpec[];
+};
+
+export const MockIndexPatternsKibanaContextProvider: React.FC<{
+  asyncDelay: number;
+  mockIndexPatterns: MockIndexPatternSpec[];
+}> = ({ asyncDelay, children, mockIndexPatterns }) => {
+  const indexPatterns = useMemo(
+    () =>
+      createIndexPatternsMock(
+        asyncDelay,
+        mockIndexPatterns.map(({ id, title, type = undefined, fields, timeFieldName }) => {
+          const indexPatternFields = fields.map((fieldSpec) => new IndexPatternField(fieldSpec));
+
+          return {
+            id,
+            title,
+            type,
+            getTimeField: () => indexPatternFields.find(({ name }) => name === timeFieldName),
+            isTimeBased: () => timeFieldName != null,
+            getFieldByName: (fieldName) =>
+              indexPatternFields.find(({ name }) => name === fieldName),
+          };
+        })
+      ),
+    [asyncDelay, mockIndexPatterns]
+  );
+
+  const core = useMemo<Pick2<CoreStart, 'application', 'getUrlForApp'>>(
+    () => ({
+      application: {
+        getUrlForApp: () => '',
+      },
+    }),
+    []
+  );
+
+  return (
+    <KibanaContextProvider services={{ ...core, data: { indexPatterns } }}>
+      {children}
+    </KibanaContextProvider>
+  );
+};
+
+const createIndexPatternsMock = (
+  asyncDelay: number,
+  indexPatterns: MockIndexPattern[]
+): {
+  getIdsWithTitle: IndexPatternsContract['getIdsWithTitle'];
+  get: (...args: Parameters<IndexPatternsContract['get']>) => Promise<MockIndexPattern>;
+} => {
+  return {
+    async getIdsWithTitle(_refresh?: boolean) {
+      const indexPatterns$ = of(
+        indexPatterns.map(({ id = 'unknown_id', title }) => ({ id, title }))
+      );
+      return await indexPatterns$.pipe(delay(asyncDelay)).toPromise();
+    },
+    async get(indexPatternId: string) {
+      const indexPatterns$ = from(
+        indexPatterns.filter((indexPattern) => indexPattern.id === indexPatternId)
+      );
+      return await indexPatterns$.pipe(delay(asyncDelay)).toPromise();
+    },
+  };
+};
diff --git a/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts b/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts
new file mode 100644
index 00000000000000..a53cbcc1704331
--- /dev/null
+++ b/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useState } from 'react';
+import { useTrackedPromise } from '../utils/use_tracked_promise';
+import { useKibanaContextForPlugin } from './use_kibana';
+
+export const useKibanaIndexPatternService = () => {
+  const {
+    services: {
+      data: { indexPatterns },
+    },
+  } = useKibanaContextForPlugin();
+
+  return indexPatterns;
+};
+
+interface IndexPatternDescriptor {
+  id: string;
+  title: string;
+}
+
+export const useKibanaIndexPatternTitles = () => {
+  const indexPatterns = useKibanaIndexPatternService();
+
+  const [indexPatternTitles, setIndexPatternTitles] = useState<IndexPatternDescriptor[]>([]);
+
+  const [indexPatternTitlesRequest, fetchIndexPatternTitles] = useTrackedPromise(
+    {
+      createPromise: () => indexPatterns.getIdsWithTitle(true),
+      onResolve: setIndexPatternTitles,
+    },
+    [indexPatterns]
+  );
+
+  return {
+    fetchIndexPatternTitles,
+    indexPatternTitles,
+    latestIndexPatternTitlesRequest: indexPatternTitlesRequest,
+  };
+};
diff --git a/x-pack/plugins/infra/public/pages/logs/page_content.tsx b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
index 648915ad4075ca..d43fe198c50770 100644
--- a/x-pack/plugins/infra/public/pages/logs/page_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
@@ -40,6 +40,7 @@ export const LogsPageContent: React.FunctionComponent = () => {
     initialize();
   });
 
+  // !! Need to be kept in sync with the searchDeepLinks in x-pack/plugins/infra/public/plugin.ts
   const streamTab = {
     app: 'logs',
     title: streamTabTitle,
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/fields_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/logs/settings/fields_configuration_panel.tsx
index 236817ce3890f7..3f8922b1871c9d 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/fields_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/settings/fields_configuration_panel.tsx
@@ -10,7 +10,6 @@ import {
   EuiCode,
   EuiDescribedFormGroup,
   EuiFieldText,
-  EuiForm,
   EuiFormRow,
   EuiLink,
   EuiSpacer,
@@ -18,27 +17,29 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import React from 'react';
-import { InputFieldProps } from '../../../components/source_configuration/input_fields';
+import React, { useMemo } from 'react';
+import { FormElement } from './form_elements';
+import { getFormRowProps, getStringInputFieldProps } from './form_field_props';
+import { FormValidationError } from './validation_errors';
 
 interface FieldsConfigurationPanelProps {
   isLoading: boolean;
-  readOnly: boolean;
-  tiebreakerFieldProps: InputFieldProps;
-  timestampFieldProps: InputFieldProps;
+  isReadOnly: boolean;
+  tiebreakerFieldFormElement: FormElement<string, FormValidationError>;
+  timestampFieldFormElement: FormElement<string, FormValidationError>;
 }
 
 export const FieldsConfigurationPanel = ({
   isLoading,
-  readOnly,
-  tiebreakerFieldProps,
-  timestampFieldProps,
+  isReadOnly,
+  tiebreakerFieldFormElement,
+  timestampFieldFormElement,
 }: FieldsConfigurationPanelProps) => {
-  const isTimestampValueDefault = timestampFieldProps.value === '@timestamp';
-  const isTiebreakerValueDefault = tiebreakerFieldProps.value === '_doc';
+  const isTimestampValueDefault = timestampFieldFormElement.value === '@timestamp';
+  const isTiebreakerValueDefault = tiebreakerFieldFormElement.value === '_doc';
 
   return (
-    <EuiForm>
+    <>
       <EuiTitle size="s">
         <h3>
           <FormattedMessage
@@ -101,7 +102,6 @@ export const FieldsConfigurationPanel = ({
         }
       >
         <EuiFormRow
-          error={timestampFieldProps.error}
           fullWidth
           helpText={
             <FormattedMessage
@@ -112,20 +112,24 @@ export const FieldsConfigurationPanel = ({
               }}
             />
           }
-          isInvalid={timestampFieldProps.isInvalid}
           label={
             <FormattedMessage
               id="xpack.infra.sourceConfiguration.timestampFieldLabel"
               defaultMessage="Timestamp"
             />
           }
+          {...useMemo(() => getFormRowProps(timestampFieldFormElement), [
+            timestampFieldFormElement,
+          ])}
         >
           <EuiFieldText
             fullWidth
             disabled={isLoading || isTimestampValueDefault}
-            readOnly={readOnly}
+            readOnly={isReadOnly}
             isLoading={isLoading}
-            {...timestampFieldProps}
+            {...useMemo(() => getStringInputFieldProps(timestampFieldFormElement), [
+              timestampFieldFormElement,
+            ])}
           />
         </EuiFormRow>
       </EuiDescribedFormGroup>
@@ -146,7 +150,6 @@ export const FieldsConfigurationPanel = ({
         }
       >
         <EuiFormRow
-          error={tiebreakerFieldProps.error}
           fullWidth
           helpText={
             <FormattedMessage
@@ -157,23 +160,27 @@ export const FieldsConfigurationPanel = ({
               }}
             />
           }
-          isInvalid={tiebreakerFieldProps.isInvalid}
           label={
             <FormattedMessage
               id="xpack.infra.sourceConfiguration.tiebreakerFieldLabel"
               defaultMessage="Tiebreaker"
             />
           }
+          {...useMemo(() => getFormRowProps(tiebreakerFieldFormElement), [
+            tiebreakerFieldFormElement,
+          ])}
         >
           <EuiFieldText
             fullWidth
             disabled={isLoading || isTiebreakerValueDefault}
-            readOnly={readOnly}
+            readOnly={isReadOnly}
             isLoading={isLoading}
-            {...tiebreakerFieldProps}
+            {...useMemo(() => getStringInputFieldProps(tiebreakerFieldFormElement), [
+              tiebreakerFieldFormElement,
+            ])}
           />
         </EuiFormRow>
       </EuiDescribedFormGroup>
-    </EuiForm>
+    </>
   );
 };
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/form_elements.tsx b/x-pack/plugins/infra/public/pages/logs/settings/form_elements.tsx
new file mode 100644
index 00000000000000..751d9762b937a3
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/form_elements.tsx
@@ -0,0 +1,243 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import equal from 'fast-deep-equal';
+import { useCallback, useMemo, useState } from 'react';
+import { useAsync } from 'react-use';
+import { ObjectEntries } from '../../../../common/utility_types';
+import { ChildFormValidationError, GenericValidationError } from './validation_errors';
+
+const unsetValue = Symbol('unset form value');
+
+type ValueUpdater<Value> = (updater: (previousValue: Value) => Value) => void;
+
+export interface FormElement<Value, InvalidReason> {
+  initialValue: Value;
+  isDirty: boolean;
+  resetValue: () => void;
+  updateValue: ValueUpdater<Value>;
+  validity: FormElementValidity<InvalidReason | GenericValidationError>;
+  value: Value;
+}
+
+type FormElementMap<FormValues extends {}> = {
+  [formElementName in keyof FormValues]: FormElement<FormValues[formElementName], any>;
+};
+
+export interface CompositeFormElement<CompositeValue extends {}, InvalidReason>
+  extends FormElement<CompositeValue, InvalidReason | ChildFormValidationError> {
+  childFormElements: FormElementMap<CompositeValue>;
+}
+
+export type FormElementValidity<InvalidReason> =
+  | { validity: 'valid' }
+  | { validity: 'invalid'; reasons: InvalidReason[] }
+  | { validity: 'pending' };
+
+export const useFormElement = <Value, InvalidReason>({
+  initialValue,
+  validate,
+}: {
+  initialValue: Value;
+  validate?: (value: Value) => Promise<InvalidReason[]>;
+}): FormElement<Value, InvalidReason> => {
+  const [changedValue, setChangedValue] = useState<Value | typeof unsetValue>(unsetValue);
+
+  const value = changedValue !== unsetValue ? changedValue : initialValue;
+
+  const updateValue = useCallback<ValueUpdater<Value>>(
+    (updater) =>
+      setChangedValue((previousValue) =>
+        previousValue === unsetValue ? updater(initialValue) : updater(previousValue)
+      ),
+    [initialValue]
+  );
+
+  const resetValue = useCallback(() => setChangedValue(unsetValue), []);
+
+  const isDirty = useMemo(() => !equal(value, initialValue), [value, initialValue]);
+
+  const validity = useValidity(value, validate);
+
+  return useMemo(
+    () => ({
+      initialValue,
+      isDirty,
+      resetValue,
+      updateValue,
+      validity,
+      value,
+    }),
+    [initialValue, isDirty, resetValue, updateValue, validity, value]
+  );
+};
+
+export const useCompositeFormElement = <FormValues extends {}, InvalidReason>({
+  childFormElements,
+  validate,
+}: {
+  childFormElements: FormElementMap<FormValues>;
+  validate?: (values: FormValues) => Promise<InvalidReason[]>;
+}): CompositeFormElement<FormValues, InvalidReason> => {
+  const childFormElementEntries = useMemo(
+    () => Object.entries(childFormElements) as ObjectEntries<typeof childFormElements>,
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    Object.entries(childFormElements).flat()
+  );
+
+  const value = useMemo(
+    () =>
+      childFormElementEntries.reduce<FormValues>(
+        (accumulatedFormValues, [formElementName, formElement]) => ({
+          ...accumulatedFormValues,
+          [formElementName]: formElement.value,
+        }),
+        {} as FormValues
+      ),
+    [childFormElementEntries]
+  );
+
+  const updateValue = useCallback(
+    (updater: (previousValues: FormValues) => FormValues) => {
+      const newValues = updater(value);
+
+      childFormElementEntries.forEach(([formElementName, formElement]) =>
+        formElement.updateValue(() => newValues[formElementName])
+      );
+    },
+    [childFormElementEntries, value]
+  );
+
+  const isDirty = useMemo(
+    () => childFormElementEntries.some(([, formElement]) => formElement.isDirty),
+    [childFormElementEntries]
+  );
+
+  const formValidity = useValidity(value, validate);
+  const childFormElementsValidity = useMemo<
+    FormElementValidity<InvalidReason | ChildFormValidationError>
+  >(() => {
+    if (
+      childFormElementEntries.some(([, formElement]) => formElement.validity.validity === 'invalid')
+    ) {
+      return {
+        validity: 'invalid',
+        reasons: [{ type: 'child' }],
+      };
+    } else if (
+      childFormElementEntries.some(([, formElement]) => formElement.validity.validity === 'pending')
+    ) {
+      return {
+        validity: 'pending',
+      };
+    } else {
+      return {
+        validity: 'valid',
+      };
+    }
+  }, [childFormElementEntries]);
+
+  const validity = useMemo(() => getCombinedValidity(formValidity, childFormElementsValidity), [
+    formValidity,
+    childFormElementsValidity,
+  ]);
+
+  const resetValue = useCallback(() => {
+    childFormElementEntries.forEach(([, formElement]) => formElement.resetValue());
+  }, [childFormElementEntries]);
+
+  const initialValue = useMemo(
+    () =>
+      childFormElementEntries.reduce<FormValues>(
+        (accumulatedFormValues, [formElementName, formElement]) => ({
+          ...accumulatedFormValues,
+          [formElementName]: formElement.initialValue,
+        }),
+        {} as FormValues
+      ),
+    [childFormElementEntries]
+  );
+
+  return useMemo(
+    () => ({
+      childFormElements,
+      initialValue,
+      isDirty,
+      resetValue,
+      updateValue,
+      validity,
+      value,
+    }),
+    [childFormElements, initialValue, isDirty, resetValue, updateValue, validity, value]
+  );
+};
+
+const useValidity = <Value, InvalidReason>(
+  value: Value,
+  validate?: (value: Value) => Promise<InvalidReason[]>
+) => {
+  const validationState = useAsync(() => validate?.(value) ?? Promise.resolve([]), [
+    validate,
+    value,
+  ]);
+
+  const validity = useMemo<FormElementValidity<InvalidReason | GenericValidationError>>(() => {
+    if (validationState.loading) {
+      return { validity: 'pending' as const };
+    } else if (validationState.error != null) {
+      return {
+        validity: 'invalid' as const,
+        reasons: [
+          {
+            type: 'generic' as const,
+            message: `${validationState.error}`,
+          },
+        ],
+      };
+    } else if (validationState.value && validationState.value.length > 0) {
+      return {
+        validity: 'invalid' as const,
+        reasons: validationState.value,
+      };
+    } else {
+      return {
+        validity: 'valid' as const,
+      };
+    }
+  }, [validationState.error, validationState.loading, validationState.value]);
+
+  return validity;
+};
+
+export const getCombinedValidity = <FirstInvalidReason, SecondInvalidReason>(
+  first: FormElementValidity<FirstInvalidReason>,
+  second: FormElementValidity<SecondInvalidReason>
+): FormElementValidity<FirstInvalidReason | SecondInvalidReason> => {
+  if (first.validity === 'invalid' || second.validity === 'invalid') {
+    return {
+      validity: 'invalid',
+      reasons: [
+        ...(first.validity === 'invalid' ? first.reasons : []),
+        ...(second.validity === 'invalid' ? second.reasons : []),
+      ],
+    };
+  } else if (first.validity === 'pending' || second.validity === 'pending') {
+    return {
+      validity: 'pending',
+    };
+  } else {
+    return {
+      validity: 'valid',
+    };
+  }
+};
+
+export const isFormElementForType = <Value extends any>(
+  isValue: (value: any) => value is Value
+) => <InvalidReason extends unknown>(
+  formElement: FormElement<any, InvalidReason>
+): formElement is FormElement<Value, InvalidReason> => isValue(formElement.value);
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/form_field_props.tsx b/x-pack/plugins/infra/public/pages/logs/settings/form_field_props.tsx
new file mode 100644
index 00000000000000..4a3927157b1365
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/form_field_props.tsx
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { FormElement } from './form_elements';
+import { LogSourceConfigurationFormError } from './source_configuration_form_errors';
+import { FormValidationError } from './validation_errors';
+
+export const getFormRowProps = (formElement: FormElement<any, FormValidationError>) => ({
+  error:
+    formElement.validity.validity === 'invalid'
+      ? formElement.validity.reasons.map((error) => (
+          <LogSourceConfigurationFormError error={error} />
+        ))
+      : [],
+  isInvalid: formElement.validity.validity === 'invalid',
+});
+
+export const getInputFieldProps = <Value extends unknown>(
+  decodeInputValue: (value: string) => Value,
+  encodeInputValue: (value: Value) => string
+) => (formElement: FormElement<Value, any>) => ({
+  isInvalid: formElement.validity.validity === 'invalid',
+  onChange: (evt: React.ChangeEvent<HTMLInputElement>) => {
+    const newValue = evt.currentTarget.value;
+    formElement.updateValue(() => decodeInputValue(newValue));
+  },
+  value: encodeInputValue(formElement.value),
+});
+
+export const getStringInputFieldProps = getInputFieldProps<string>(
+  (value) => `${value}`,
+  (value) => value
+);
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/index_names_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/logs/settings/index_names_configuration_panel.tsx
new file mode 100644
index 00000000000000..2d2909f42bae6a
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/index_names_configuration_panel.tsx
@@ -0,0 +1,127 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiButton,
+  EuiCallOut,
+  EuiCode,
+  EuiDescribedFormGroup,
+  EuiFieldText,
+  EuiFormRow,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React from 'react';
+import { useTrackPageview } from '../../../../../observability/public';
+import { LogIndexNameReference } from '../../../../common/log_sources';
+import { FormElement } from './form_elements';
+import { getFormRowProps, getInputFieldProps } from './form_field_props';
+import { FormValidationError } from './validation_errors';
+
+export const IndexNamesConfigurationPanel: React.FC<{
+  isLoading: boolean;
+  isReadOnly: boolean;
+  indexNamesFormElement: FormElement<LogIndexNameReference, FormValidationError>;
+  onSwitchToIndexPatternReference: () => void;
+}> = ({ isLoading, isReadOnly, indexNamesFormElement, onSwitchToIndexPatternReference }) => {
+  useTrackPageview({ app: 'infra_logs', path: 'log_source_configuration_index_name' });
+  useTrackPageview({
+    app: 'infra_logs',
+    path: 'log_source_configuration_index_name',
+    delay: 15000,
+  });
+
+  return (
+    <>
+      <EuiTitle size="s">
+        <h3>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.indicesSectionTitle"
+            defaultMessage="Indices"
+          />
+        </h3>
+      </EuiTitle>
+      <EuiSpacer size="m" />
+      <EuiCallOut title={deprecationCalloutTitle} color="warning" iconType="alert">
+        <FormattedMessage
+          tagName="p"
+          id="xpack.infra.logSourceConfiguration.indexNameReferenceDeprecationDescription"
+          defaultMessage="Referring to Elasticsearch indices directly is a deprecated way of configuring a log source. Instead, log source now integrate with Kibana index patterns to configure the used indices."
+        />
+        <EuiButton color="warning" onClick={onSwitchToIndexPatternReference}>
+          <FormattedMessage
+            id="xpack.infra.logSourceConfiguration.switchToIndexPatternReferenceButtonLabel"
+            defaultMessage="Use Kibana index patterns"
+          />
+        </EuiButton>
+      </EuiCallOut>
+      <EuiSpacer size="m" />
+      <EuiDescribedFormGroup
+        title={
+          <h4>
+            <FormattedMessage
+              id="xpack.infra.sourceConfiguration.logIndicesTitle"
+              defaultMessage="Log indices"
+            />
+          </h4>
+        }
+        description={
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.logIndicesDescription"
+            defaultMessage="Index pattern for matching indices that contain log data"
+          />
+        }
+      >
+        <EuiFormRow
+          fullWidth
+          helpText={
+            <FormattedMessage
+              id="xpack.infra.sourceConfiguration.logIndicesRecommendedValue"
+              defaultMessage="The recommended value is {defaultValue}"
+              values={{
+                defaultValue: <EuiCode>logs-*,filebeat-*</EuiCode>,
+              }}
+            />
+          }
+          label={
+            <FormattedMessage
+              id="xpack.infra.sourceConfiguration.logIndicesLabel"
+              defaultMessage="Log indices"
+            />
+          }
+          {...getFormRowProps(indexNamesFormElement)}
+        >
+          <EuiFieldText
+            data-test-subj="logIndicesInput"
+            fullWidth
+            disabled={isLoading}
+            isLoading={isLoading}
+            readOnly={isReadOnly}
+            {...getIndexNamesInputFieldProps(indexNamesFormElement)}
+          />
+        </EuiFormRow>
+      </EuiDescribedFormGroup>
+    </>
+  );
+};
+
+const getIndexNamesInputFieldProps = getInputFieldProps<LogIndexNameReference>(
+  (value) => ({
+    type: 'index_name',
+    indexName: value,
+  }),
+  ({ indexName }) => indexName
+);
+
+const deprecationCalloutTitle = i18n.translate(
+  'xpack.infra.logSourceConfiguration.indexNameReferenceDeprecationTitle',
+  {
+    defaultMessage: 'Deprecated configuration option',
+  }
+);
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/index_pattern_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/logs/settings/index_pattern_configuration_panel.tsx
new file mode 100644
index 00000000000000..a16f15505bc309
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/index_pattern_configuration_panel.tsx
@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiDescribedFormGroup, EuiFormRow, EuiLink, EuiSpacer, EuiTitle } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useCallback, useMemo } from 'react';
+import { useTrackPageview } from '../../../../../observability/public';
+import { LogIndexPatternReference } from '../../../../common/log_sources';
+import { useLinkProps } from '../../../hooks/use_link_props';
+import { FormElement } from './form_elements';
+import { getFormRowProps } from './form_field_props';
+import { IndexPatternSelector } from './index_pattern_selector';
+import { FormValidationError } from './validation_errors';
+
+export const IndexPatternConfigurationPanel: React.FC<{
+  isLoading: boolean;
+  isReadOnly: boolean;
+  indexPatternFormElement: FormElement<LogIndexPatternReference | undefined, FormValidationError>;
+}> = ({ isLoading, isReadOnly, indexPatternFormElement }) => {
+  useTrackPageview({ app: 'infra_logs', path: 'log_source_configuration_index_pattern' });
+  useTrackPageview({
+    app: 'infra_logs',
+    path: 'log_source_configuration_index_pattern',
+    delay: 15000,
+  });
+
+  const changeIndexPatternId = useCallback(
+    (indexPatternId: string | undefined) => {
+      if (indexPatternId != null) {
+        indexPatternFormElement.updateValue(() => ({
+          type: 'index_pattern',
+          indexPatternId,
+        }));
+      } else {
+        indexPatternFormElement.updateValue(() => undefined);
+      }
+    },
+    [indexPatternFormElement]
+  );
+
+  return (
+    <>
+      <EuiTitle size="s">
+        <h3>
+          <FormattedMessage
+            id="xpack.infra.logSourceConfiguration.indexPatternSectionTitle"
+            defaultMessage="Index pattern"
+          />
+        </h3>
+      </EuiTitle>
+      <EuiSpacer size="m" />
+      <IndexPatternInlineHelpMessage />
+      <EuiSpacer size="m" />
+      <EuiDescribedFormGroup
+        title={
+          <h4>
+            <FormattedMessage
+              id="xpack.infra.logSourceConfiguration.logIndexPatternTitle"
+              defaultMessage="Log index pattern"
+            />
+          </h4>
+        }
+        description={
+          <FormattedMessage
+            id="xpack.infra.logSourceConfiguration.logIndexPatternDescription"
+            defaultMessage="Index pattern that contains log data"
+          />
+        }
+      >
+        <EuiFormRow
+          fullWidth
+          label={
+            <FormattedMessage
+              id="xpack.infra.logSourceConfiguration.logIndexPatternLabel"
+              defaultMessage="Log index pattern"
+            />
+          }
+          {...useMemo(() => (isLoading ? {} : getFormRowProps(indexPatternFormElement)), [
+            isLoading,
+            indexPatternFormElement,
+          ])}
+        >
+          <IndexPatternSelector
+            isLoading={isLoading || indexPatternFormElement.validity.validity === 'pending'}
+            isReadOnly={isReadOnly}
+            indexPatternId={indexPatternFormElement.value?.indexPatternId}
+            onChangeIndexPatternId={changeIndexPatternId}
+          />
+        </EuiFormRow>
+      </EuiDescribedFormGroup>
+    </>
+  );
+};
+
+const IndexPatternInlineHelpMessage = React.memo(() => {
+  const indexPatternManagementLinkProps = useLinkProps({
+    app: 'management',
+    pathname: '/kibana/indexPatterns',
+  });
+
+  return (
+    <FormattedMessage
+      id="xpack.infra.logSourceConfiguration.logIndexPatternHelpText"
+      defaultMessage="Kibana index patterns are shared among apps in the Kibana space and can be managed via the {indexPatternsManagementLink}."
+      values={{
+        indexPatternsManagementLink: (
+          <EuiLink {...indexPatternManagementLinkProps}>
+            <FormattedMessage
+              id="xpack.infra.logSourceConfiguration.indexPatternManagementLinkText"
+              defaultMessage="index patterns management screen"
+            />
+          </EuiLink>
+        ),
+      }}
+    />
+  );
+});
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/index_pattern_selector.tsx b/x-pack/plugins/infra/public/pages/logs/settings/index_pattern_selector.tsx
new file mode 100644
index 00000000000000..9e110db53a27f2
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/index_pattern_selector.tsx
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useCallback, useEffect, useMemo } from 'react';
+import { useKibanaIndexPatternTitles } from '../../../hooks/use_kibana_index_patterns';
+
+type IndexPatternOption = EuiComboBoxOptionOption<string>;
+
+export const IndexPatternSelector: React.FC<{
+  indexPatternId: string | undefined;
+  isLoading: boolean;
+  isReadOnly: boolean;
+  onChangeIndexPatternId: (indexPatternId: string | undefined) => void;
+}> = ({ indexPatternId, isLoading, isReadOnly, onChangeIndexPatternId }) => {
+  const {
+    indexPatternTitles: availableIndexPatterns,
+    latestIndexPatternTitlesRequest,
+    fetchIndexPatternTitles,
+  } = useKibanaIndexPatternTitles();
+
+  useEffect(() => {
+    fetchIndexPatternTitles();
+  }, [fetchIndexPatternTitles]);
+
+  const availableOptions = useMemo<IndexPatternOption[]>(
+    () =>
+      availableIndexPatterns.map(({ id, title }) => ({
+        key: id,
+        label: title,
+        value: id,
+      })),
+    [availableIndexPatterns]
+  );
+
+  const selectedOptions = useMemo<IndexPatternOption[]>(
+    () => availableOptions.filter(({ key }) => key === indexPatternId),
+    [availableOptions, indexPatternId]
+  );
+
+  const changeSelectedIndexPatterns = useCallback(
+    ([newlySelectedOption]: IndexPatternOption[]) => {
+      if (typeof newlySelectedOption?.key === 'string') {
+        return onChangeIndexPatternId(newlySelectedOption.key);
+      }
+
+      return onChangeIndexPatternId(undefined);
+    },
+    [onChangeIndexPatternId]
+  );
+
+  return (
+    <EuiComboBox<string>
+      isLoading={isLoading || latestIndexPatternTitlesRequest.state === 'pending'}
+      isDisabled={isReadOnly}
+      options={availableOptions}
+      placeholder={indexPatternSelectorPlaceholder}
+      selectedOptions={selectedOptions}
+      singleSelection={true}
+      onChange={changeSelectedIndexPatterns}
+    />
+  );
+};
+
+const indexPatternSelectorPlaceholder = i18n.translate(
+  'xpack.infra.logSourceConfiguration.indexPatternSelectorPlaceholder',
+  { defaultMessage: 'Choose an index pattern' }
+);
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_form_state.ts b/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_form_state.ts
index b7656e6499006e..49d14e04ca328d 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_form_state.ts
+++ b/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_form_state.ts
@@ -5,120 +5,107 @@
  * 2.0.
  */
 
-import { ReactNode, useCallback, useMemo, useState } from 'react';
+import { useMemo } from 'react';
+import { useUiTracker } from '../../../../../observability/public';
 import {
-  createInputFieldProps,
-  validateInputFieldNotEmpty,
-} from '../../../components/source_configuration/input_fields';
+  LogIndexNameReference,
+  logIndexNameReferenceRT,
+  LogIndexPatternReference,
+} from '../../../../common/log_sources';
+import { useKibanaIndexPatternService } from '../../../hooks/use_kibana_index_patterns';
+import { useCompositeFormElement, useFormElement } from './form_elements';
+import {
+  FormValidationError,
+  validateIndexPattern,
+  validateStringNotEmpty,
+} from './validation_errors';
 
-interface FormState {
-  name: string;
-  description: string;
-  logAlias: string;
-  tiebreakerField: string;
-  timestampField: string;
-}
+export type LogIndicesFormState = LogIndexNameReference | LogIndexPatternReference | undefined;
 
-type FormStateChanges = Partial<FormState>;
+export const useLogIndicesFormElement = (initialValue: LogIndicesFormState) => {
+  const indexPatternService = useKibanaIndexPatternService();
 
-export const useLogIndicesConfigurationFormState = ({
-  initialFormState = defaultFormState,
-}: {
-  initialFormState?: FormState;
-}) => {
-  const [formStateChanges, setFormStateChanges] = useState<FormStateChanges>({});
+  const trackIndexPatternValidationError = useUiTracker({ app: 'infra_logs' });
 
-  const resetForm = useCallback(() => setFormStateChanges({}), []);
+  const logIndicesFormElement = useFormElement<LogIndicesFormState, FormValidationError>({
+    initialValue,
+    validate: useMemo(
+      () => async (logIndices) => {
+        if (logIndices == null) {
+          return validateStringNotEmpty('log index pattern', '');
+        } else if (logIndexNameReferenceRT.is(logIndices)) {
+          return validateStringNotEmpty('log indices', logIndices.indexName);
+        } else {
+          const emptyStringErrors = validateStringNotEmpty(
+            'log index pattern',
+            logIndices.indexPatternId
+          );
 
-  const formState = useMemo(
-    () => ({
-      ...initialFormState,
-      ...formStateChanges,
-    }),
-    [initialFormState, formStateChanges]
-  );
+          if (emptyStringErrors.length > 0) {
+            return emptyStringErrors;
+          }
 
-  const nameFieldProps = useMemo(
-    () =>
-      createInputFieldProps({
-        errors: validateInputFieldNotEmpty(formState.name),
-        name: 'name',
-        onChange: (name) => setFormStateChanges((changes) => ({ ...changes, name })),
-        value: formState.name,
-      }),
-    [formState.name]
-  );
-  const logAliasFieldProps = useMemo(
-    () =>
-      createInputFieldProps({
-        errors: validateInputFieldNotEmpty(formState.logAlias),
-        name: 'logAlias',
-        onChange: (logAlias) => setFormStateChanges((changes) => ({ ...changes, logAlias })),
-        value: formState.logAlias,
-      }),
-    [formState.logAlias]
-  );
-  const tiebreakerFieldFieldProps = useMemo(
-    () =>
-      createInputFieldProps({
-        errors: validateInputFieldNotEmpty(formState.tiebreakerField),
-        name: `tiebreakerField`,
-        onChange: (tiebreakerField) =>
-          setFormStateChanges((changes) => ({ ...changes, tiebreakerField })),
-        value: formState.tiebreakerField,
-      }),
-    [formState.tiebreakerField]
-  );
-  const timestampFieldFieldProps = useMemo(
-    () =>
-      createInputFieldProps({
-        errors: validateInputFieldNotEmpty(formState.timestampField),
-        name: `timestampField`,
-        onChange: (timestampField) =>
-          setFormStateChanges((changes) => ({ ...changes, timestampField })),
-        value: formState.timestampField,
-      }),
-    [formState.timestampField]
-  );
+          const indexPatternErrors = validateIndexPattern(
+            await indexPatternService.get(logIndices.indexPatternId)
+          );
 
-  const fieldProps = useMemo(
-    () => ({
-      name: nameFieldProps,
-      logAlias: logAliasFieldProps,
-      tiebreakerField: tiebreakerFieldFieldProps,
-      timestampField: timestampFieldFieldProps,
-    }),
-    [nameFieldProps, logAliasFieldProps, tiebreakerFieldFieldProps, timestampFieldFieldProps]
-  );
+          if (indexPatternErrors.length > 0) {
+            trackIndexPatternValidationError({
+              metric: 'configuration_index_pattern_validation_failed',
+            });
+          } else {
+            trackIndexPatternValidationError({
+              metric: 'configuration_index_pattern_validation_succeeded',
+            });
+          }
 
-  const errors = useMemo(
-    () =>
-      Object.values(fieldProps).reduce<ReactNode[]>(
-        (accumulatedErrors, { error }) => [...accumulatedErrors, ...error],
-        []
-      ),
-    [fieldProps]
-  );
+          return indexPatternErrors;
+        }
+      },
+      [indexPatternService, trackIndexPatternValidationError]
+    ),
+  });
+
+  return logIndicesFormElement;
+};
 
-  const isFormValid = useMemo(() => errors.length <= 0, [errors]);
+export interface FieldsFormState {
+  tiebreakerField: string;
+  timestampField: string;
+}
 
-  const isFormDirty = useMemo(() => Object.keys(formStateChanges).length > 0, [formStateChanges]);
+export const useFieldsFormElement = (initialValues: FieldsFormState) => {
+  const tiebreakerFieldFormElement = useFormElement<string, FormValidationError>({
+    initialValue: initialValues.tiebreakerField,
+    validate: useMemo(
+      () => async (tiebreakerField) => validateStringNotEmpty('tiebreaker', tiebreakerField),
+      []
+    ),
+  });
+
+  const timestampFieldFormElement = useFormElement<string, FormValidationError>({
+    initialValue: initialValues.timestampField,
+    validate: useMemo(
+      () => async (timestampField) => validateStringNotEmpty('timestamp', timestampField),
+      []
+    ),
+  });
+
+  const fieldsFormElement = useCompositeFormElement(
+    useMemo(
+      () => ({
+        childFormElements: {
+          tiebreaker: tiebreakerFieldFormElement,
+          timestamp: timestampFieldFormElement,
+        },
+      }),
+      [tiebreakerFieldFormElement, timestampFieldFormElement]
+    )
+  );
 
   return {
-    errors,
-    fieldProps,
-    formState,
-    formStateChanges,
-    isFormDirty,
-    isFormValid,
-    resetForm,
+    fieldsFormElement,
+    tiebreakerFieldFormElement,
+    timestampFieldFormElement,
   };
 };
-
-const defaultFormState: FormState = {
-  name: '',
-  description: '',
-  logAlias: '',
-  tiebreakerField: '',
-  timestampField: '',
-};
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.stories.tsx b/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.stories.tsx
new file mode 100644
index 00000000000000..8cc9f5b4357efe
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.stories.tsx
@@ -0,0 +1,168 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCodeBlock, EuiPage, EuiPageBody, EuiPageContent, PropsOf } from '@elastic/eui';
+import { I18nProvider } from '@kbn/i18n/react';
+import { Meta, Story } from '@storybook/react/types-6-0';
+import React from 'react';
+import { KBN_FIELD_TYPES } from '../../../../../../../src/plugins/data/public';
+import { EuiThemeProvider } from '../../../../../../../src/plugins/kibana_react/common';
+import {
+  MockIndexPatternsKibanaContextProvider,
+  MockIndexPatternSpec,
+} from '../../../hooks/use_kibana_index_patterns.mock';
+import {
+  FieldsFormState,
+  LogIndicesFormState,
+  useFieldsFormElement,
+  useLogIndicesFormElement,
+} from './indices_configuration_form_state';
+import { IndicesConfigurationPanel } from './indices_configuration_panel';
+
+export default {
+  title: 'infra/logsSettings/indicesConfiguration',
+  decorators: [
+    (WrappedStory, { args }) => {
+      return (
+        <I18nProvider>
+          <EuiThemeProvider>
+            <MockIndexPatternsKibanaContextProvider
+              asyncDelay={2000}
+              mockIndexPatterns={args.availableIndexPatterns}
+            >
+              <EuiPage restrictWidth>
+                <EuiPageBody>
+                  <EuiPageContent>
+                    <WrappedStory />
+                  </EuiPageContent>
+                </EuiPageBody>
+              </EuiPage>
+            </MockIndexPatternsKibanaContextProvider>
+          </EuiThemeProvider>
+        </I18nProvider>
+      );
+    },
+  ],
+  argTypes: {
+    logIndices: {
+      control: {
+        type: 'object',
+      },
+    },
+    availableIndexPatterns: {
+      control: {
+        type: 'object',
+      },
+    },
+  },
+} as Meta;
+
+type IndicesConfigurationPanelProps = PropsOf<typeof IndicesConfigurationPanel>;
+
+type IndicesConfigurationPanelStoryArgs = Pick<
+  IndicesConfigurationPanelProps,
+  'isLoading' | 'isReadOnly'
+> & {
+  availableIndexPatterns: MockIndexPatternSpec[];
+  logIndices: LogIndicesFormState;
+  fields: FieldsFormState;
+};
+
+const IndicesConfigurationPanelTemplate: Story<IndicesConfigurationPanelStoryArgs> = ({
+  isLoading,
+  isReadOnly,
+  logIndices,
+  fields,
+}) => {
+  const logIndicesFormElement = useLogIndicesFormElement(logIndices);
+  const { tiebreakerFieldFormElement, timestampFieldFormElement } = useFieldsFormElement(fields);
+
+  return (
+    <>
+      <IndicesConfigurationPanel
+        isLoading={isLoading}
+        isReadOnly={isReadOnly}
+        indicesFormElement={logIndicesFormElement}
+        tiebreakerFieldFormElement={tiebreakerFieldFormElement}
+        timestampFieldFormElement={timestampFieldFormElement}
+      />
+      <EuiCodeBlock language="json">
+        // field states{'\n'}
+        {JSON.stringify(
+          {
+            logIndices: {
+              value: logIndicesFormElement.value,
+              validity: logIndicesFormElement.validity,
+            },
+            tiebreakerField: {
+              value: tiebreakerFieldFormElement.value,
+              validity: tiebreakerFieldFormElement.validity,
+            },
+            timestampField: {
+              value: timestampFieldFormElement.value,
+              validity: timestampFieldFormElement.validity,
+            },
+          },
+          null,
+          2
+        )}
+      </EuiCodeBlock>
+    </>
+  );
+};
+
+const defaultArgs: IndicesConfigurationPanelStoryArgs = {
+  isLoading: false,
+  isReadOnly: false,
+  logIndices: {
+    type: 'index_name' as const,
+    indexName: 'logs-*',
+  },
+  fields: {
+    tiebreakerField: '_doc',
+    timestampField: '@timestamp',
+  },
+  availableIndexPatterns: [
+    {
+      id: 'INDEX_PATTERN_A',
+      title: 'pattern-a-*',
+      timeFieldName: '@timestamp',
+      fields: [
+        {
+          name: '@timestamp',
+          type: KBN_FIELD_TYPES.DATE,
+          searchable: true,
+          aggregatable: true,
+        },
+        {
+          name: 'message',
+          type: KBN_FIELD_TYPES.STRING,
+          searchable: true,
+          aggregatable: true,
+        },
+      ],
+    },
+    {
+      id: 'INDEX_PATTERN_B',
+      title: 'pattern-b-*',
+      fields: [],
+    },
+  ],
+};
+
+export const IndexNameWithDefaultFields = IndicesConfigurationPanelTemplate.bind({});
+
+IndexNameWithDefaultFields.args = {
+  ...defaultArgs,
+};
+
+export const IndexPattern = IndicesConfigurationPanelTemplate.bind({});
+
+IndexPattern.args = {
+  ...defaultArgs,
+  logIndices: undefined,
+};
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.tsx
index e6f03e76255a24..6f762afd79244f 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/settings/indices_configuration_panel.tsx
@@ -5,85 +5,77 @@
  * 2.0.
  */
 
+import React, { useCallback } from 'react';
+import { useUiTracker } from '../../../../../observability/public';
 import {
-  EuiCode,
-  EuiDescribedFormGroup,
-  EuiFieldText,
-  EuiForm,
-  EuiFormRow,
-  EuiSpacer,
-  EuiTitle,
-} from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import React from 'react';
-import { InputFieldProps } from '../../../components/source_configuration/input_fields';
+  logIndexNameReferenceRT,
+  LogIndexPatternReference,
+  logIndexPatternReferenceRT,
+  LogIndexReference,
+} from '../../../../common/log_sources';
+import { FieldsConfigurationPanel } from './fields_configuration_panel';
+import { FormElement, isFormElementForType } from './form_elements';
+import { IndexNamesConfigurationPanel } from './index_names_configuration_panel';
+import { IndexPatternConfigurationPanel } from './index_pattern_configuration_panel';
+import { FormValidationError } from './validation_errors';
 
-interface IndicesConfigurationPanelProps {
+export const IndicesConfigurationPanel = React.memo<{
   isLoading: boolean;
-  readOnly: boolean;
-  logAliasFieldProps: InputFieldProps;
-}
+  isReadOnly: boolean;
+  indicesFormElement: FormElement<LogIndexReference | undefined, FormValidationError>;
+  tiebreakerFieldFormElement: FormElement<string, FormValidationError>;
+  timestampFieldFormElement: FormElement<string, FormValidationError>;
+}>(
+  ({
+    isLoading,
+    isReadOnly,
+    indicesFormElement,
+    tiebreakerFieldFormElement,
+    timestampFieldFormElement,
+  }) => {
+    const trackSwitchToIndexPatternReference = useUiTracker({ app: 'infra_logs' });
 
-export const IndicesConfigurationPanel = ({
-  isLoading,
-  readOnly,
-  logAliasFieldProps,
-}: IndicesConfigurationPanelProps) => (
-  <EuiForm>
-    <EuiTitle size="s">
-      <h3>
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.indicesSectionTitle"
-          defaultMessage="Indices"
-        />
-      </h3>
-    </EuiTitle>
-    <EuiSpacer size="m" />
-    <EuiDescribedFormGroup
-      title={
-        <h4>
-          <FormattedMessage
-            id="xpack.infra.sourceConfiguration.logIndicesTitle"
-            defaultMessage="Log indices"
-          />
-        </h4>
-      }
-      description={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.logIndicesDescription"
-          defaultMessage="Index pattern for matching indices that contain log data"
+    const switchToIndexPatternReference = useCallback(() => {
+      indicesFormElement.updateValue(() => undefined);
+      trackSwitchToIndexPatternReference({
+        metric: 'configuration_switch_to_index_pattern_reference',
+      });
+    }, [indicesFormElement, trackSwitchToIndexPatternReference]);
+
+    if (isIndexPatternFormElement(indicesFormElement)) {
+      return (
+        <IndexPatternConfigurationPanel
+          isLoading={isLoading}
+          isReadOnly={isReadOnly}
+          indexPatternFormElement={indicesFormElement}
         />
-      }
-    >
-      <EuiFormRow
-        error={logAliasFieldProps.error}
-        fullWidth
-        helpText={
-          <FormattedMessage
-            id="xpack.infra.sourceConfiguration.logIndicesRecommendedValue"
-            defaultMessage="The recommended value is {defaultValue}"
-            values={{
-              defaultValue: <EuiCode>logs-*,filebeat-*</EuiCode>,
-            }}
+      );
+    } else if (isIndexNamesFormElement(indicesFormElement)) {
+      return (
+        <>
+          <IndexNamesConfigurationPanel
+            isLoading={isLoading}
+            isReadOnly={isReadOnly}
+            indexNamesFormElement={indicesFormElement}
+            onSwitchToIndexPatternReference={switchToIndexPatternReference}
           />
-        }
-        isInvalid={logAliasFieldProps.isInvalid}
-        label={
-          <FormattedMessage
-            id="xpack.infra.sourceConfiguration.logIndicesLabel"
-            defaultMessage="Log indices"
+          <FieldsConfigurationPanel
+            isLoading={isLoading}
+            isReadOnly={isReadOnly}
+            tiebreakerFieldFormElement={tiebreakerFieldFormElement}
+            timestampFieldFormElement={timestampFieldFormElement}
           />
-        }
-      >
-        <EuiFieldText
-          data-test-subj="logIndicesInput"
-          fullWidth
-          disabled={isLoading}
-          isLoading={isLoading}
-          readOnly={readOnly}
-          {...logAliasFieldProps}
-        />
-      </EuiFormRow>
-    </EuiDescribedFormGroup>
-  </EuiForm>
+        </>
+      );
+    } else {
+      return null;
+    }
+  }
+);
+
+const isIndexPatternFormElement = isFormElementForType(
+  (value): value is LogIndexPatternReference | undefined =>
+    value == null || logIndexPatternReferenceRT.is(value)
 );
+
+const isIndexNamesFormElement = isFormElementForType(logIndexNameReferenceRT.is);
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_form_state.tsx b/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_form_state.tsx
index 011fbf8a9d9a6c..80eb44de9da9d1 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_form_state.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_form_state.tsx
@@ -5,150 +5,16 @@
  * 2.0.
  */
 
-import { FormattedMessage } from '@kbn/i18n/react';
-import React, { useCallback, useMemo, useState } from 'react';
-import {
-  FieldLogColumnConfiguration,
-  isMessageLogColumnConfiguration,
-  isTimestampLogColumnConfiguration,
-  LogColumnConfiguration,
-  MessageLogColumnConfiguration,
-  TimestampLogColumnConfiguration,
-} from '../../../utils/source_configuration';
-
-export interface TimestampLogColumnConfigurationProps {
-  logColumnConfiguration: TimestampLogColumnConfiguration['timestampColumn'];
-  remove: () => void;
-  type: 'timestamp';
-}
-
-export interface MessageLogColumnConfigurationProps {
-  logColumnConfiguration: MessageLogColumnConfiguration['messageColumn'];
-  remove: () => void;
-  type: 'message';
-}
-
-export interface FieldLogColumnConfigurationProps {
-  logColumnConfiguration: FieldLogColumnConfiguration['fieldColumn'];
-  remove: () => void;
-  type: 'field';
-}
-
-export type LogColumnConfigurationProps =
-  | TimestampLogColumnConfigurationProps
-  | MessageLogColumnConfigurationProps
-  | FieldLogColumnConfigurationProps;
-
-interface FormState {
-  logColumns: LogColumnConfiguration[];
-}
-
-type FormStateChanges = Partial<FormState>;
-
-export const useLogColumnsConfigurationFormState = ({
-  initialFormState = defaultFormState,
-}: {
-  initialFormState?: FormState;
-}) => {
-  const [formStateChanges, setFormStateChanges] = useState<FormStateChanges>({});
-
-  const resetForm = useCallback(() => setFormStateChanges({}), []);
-
-  const formState = useMemo(
-    () => ({
-      ...initialFormState,
-      ...formStateChanges,
-    }),
-    [initialFormState, formStateChanges]
-  );
-
-  const logColumnConfigurationProps = useMemo<LogColumnConfigurationProps[]>(
-    () =>
-      formState.logColumns.map(
-        (logColumn): LogColumnConfigurationProps => {
-          const remove = () =>
-            setFormStateChanges((changes) => ({
-              ...changes,
-              logColumns: formState.logColumns.filter((item) => item !== logColumn),
-            }));
-
-          if (isTimestampLogColumnConfiguration(logColumn)) {
-            return {
-              logColumnConfiguration: logColumn.timestampColumn,
-              remove,
-              type: 'timestamp',
-            };
-          } else if (isMessageLogColumnConfiguration(logColumn)) {
-            return {
-              logColumnConfiguration: logColumn.messageColumn,
-              remove,
-              type: 'message',
-            };
-          } else {
-            return {
-              logColumnConfiguration: logColumn.fieldColumn,
-              remove,
-              type: 'field',
-            };
-          }
-        }
-      ),
-    [formState.logColumns]
-  );
-
-  const addLogColumn = useCallback(
-    (logColumnConfiguration: LogColumnConfiguration) =>
-      setFormStateChanges((changes) => ({
-        ...changes,
-        logColumns: [...formState.logColumns, logColumnConfiguration],
-      })),
-    [formState.logColumns]
-  );
-
-  const moveLogColumn = useCallback(
-    (sourceIndex, destinationIndex) => {
-      if (destinationIndex >= 0 && sourceIndex <= formState.logColumns.length - 1) {
-        const newLogColumns = [...formState.logColumns];
-        newLogColumns.splice(destinationIndex, 0, newLogColumns.splice(sourceIndex, 1)[0]);
-        setFormStateChanges((changes) => ({
-          ...changes,
-          logColumns: newLogColumns,
-        }));
-      }
-    },
-    [formState.logColumns]
-  );
-
-  const errors = useMemo(
-    () =>
-      logColumnConfigurationProps.length <= 0
-        ? [
-            <FormattedMessage
-              id="xpack.infra.sourceConfiguration.logColumnListEmptyErrorMessage"
-              defaultMessage="The log column list must not be empty."
-            />,
-          ]
-        : [],
-    [logColumnConfigurationProps]
-  );
-
-  const isFormValid = useMemo(() => (errors.length <= 0 ? true : false), [errors]);
-
-  const isFormDirty = useMemo(() => Object.keys(formStateChanges).length > 0, [formStateChanges]);
-
-  return {
-    addLogColumn,
-    moveLogColumn,
-    errors,
-    logColumnConfigurationProps,
-    formState,
-    formStateChanges,
-    isFormDirty,
-    isFormValid,
-    resetForm,
-  };
-};
-
-const defaultFormState: FormState = {
-  logColumns: [],
+import { useMemo } from 'react';
+import { LogColumnConfiguration } from '../../../utils/source_configuration';
+import { useFormElement } from './form_elements';
+import { FormValidationError, validateColumnListNotEmpty } from './validation_errors';
+
+export const useLogColumnsFormElement = (initialValue: LogColumnConfiguration[]) => {
+  const logColumnsFormElement = useFormElement<LogColumnConfiguration[], FormValidationError>({
+    initialValue,
+    validate: useMemo(() => async (logColumns) => validateColumnListNotEmpty(logColumns), []),
+  });
+
+  return logColumnsFormElement;
 };
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_panel.tsx
index fb17f8bee34649..70db7837b8ae52 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/settings/log_columns_configuration_panel.tsx
@@ -13,7 +13,6 @@ import {
   EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiForm,
   EuiIcon,
   EuiPanel,
   EuiSpacer,
@@ -24,28 +23,54 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { useCallback } from 'react';
 import { DragHandleProps, DropResult } from '../../../../../observability/public';
-import { LogColumnConfiguration } from '../../../utils/source_configuration';
-import { AddLogColumnButtonAndPopover } from './add_log_column_popover';
 import {
-  FieldLogColumnConfigurationProps,
-  LogColumnConfigurationProps,
-} from './log_columns_configuration_form_state';
+  FieldLogColumnConfiguration,
+  getLogColumnConfigurationId,
+  isMessageLogColumnConfiguration,
+  isTimestampLogColumnConfiguration,
+  LogColumnConfiguration,
+  MessageLogColumnConfiguration,
+  TimestampLogColumnConfiguration,
+} from '../../../utils/source_configuration';
+import { AddLogColumnButtonAndPopover } from './add_log_column_popover';
+import { FormElement } from './form_elements';
+import { LogSourceConfigurationFormError } from './source_configuration_form_errors';
+import { FormValidationError } from './validation_errors';
 
-interface LogColumnsConfigurationPanelProps {
+export const LogColumnsConfigurationPanel = React.memo<{
   availableFields: string[];
   isLoading: boolean;
-  logColumnConfiguration: LogColumnConfigurationProps[];
-  addLogColumn: (logColumn: LogColumnConfiguration) => void;
-  moveLogColumn: (sourceIndex: number, destinationIndex: number) => void;
-}
+  logColumnsFormElement: FormElement<LogColumnConfiguration[], FormValidationError>;
+}>(({ availableFields, isLoading, logColumnsFormElement }) => {
+  const addLogColumn = useCallback(
+    (logColumnConfiguration: LogColumnConfiguration) =>
+      logColumnsFormElement.updateValue((logColumns) => [...logColumns, logColumnConfiguration]),
+    [logColumnsFormElement]
+  );
+
+  const removeLogColumn = useCallback(
+    (logColumn: LogColumnConfiguration) =>
+      logColumnsFormElement.updateValue((logColumns) =>
+        logColumns.filter((item) => item !== logColumn)
+      ),
+    [logColumnsFormElement]
+  );
+
+  const moveLogColumn = useCallback(
+    (sourceIndex, destinationIndex) => {
+      logColumnsFormElement.updateValue((logColumns) => {
+        if (destinationIndex >= 0 && sourceIndex <= logColumnsFormElement.value.length - 1) {
+          const newLogColumns = [...logColumnsFormElement.value];
+          newLogColumns.splice(destinationIndex, 0, newLogColumns.splice(sourceIndex, 1)[0]);
+          return newLogColumns;
+        } else {
+          return logColumns;
+        }
+      });
+    },
+    [logColumnsFormElement]
+  );
 
-export const LogColumnsConfigurationPanel: React.FunctionComponent<LogColumnsConfigurationPanelProps> = ({
-  addLogColumn,
-  moveLogColumn,
-  availableFields,
-  isLoading,
-  logColumnConfiguration,
-}) => {
   const onDragEnd = useCallback(
     ({ source, destination }: DropResult) =>
       destination && moveLogColumn(source.index, destination.index),
@@ -53,7 +78,7 @@ export const LogColumnsConfigurationPanel: React.FunctionComponent<LogColumnsCon
   );
 
   return (
-    <EuiForm>
+    <>
       <EuiFlexGroup>
         <EuiFlexItem>
           <EuiTitle size="s" data-test-subj="sourceConfigurationLogColumnsSectionTitle">
@@ -73,63 +98,89 @@ export const LogColumnsConfigurationPanel: React.FunctionComponent<LogColumnsCon
           />
         </EuiFlexItem>
       </EuiFlexGroup>
-      {logColumnConfiguration.length > 0 ? (
+      {logColumnsFormElement.value.length > 0 ? (
         <EuiDragDropContext onDragEnd={onDragEnd}>
           <EuiDroppable droppableId="COLUMN_CONFIG_DROPPABLE_AREA">
-            <>
-              {/* Fragment here necessary for typechecking */}
-              {logColumnConfiguration.map((column, index) => (
+            {logColumnsFormElement.value.map((logColumnConfiguration, index) => {
+              const columnId = getLogColumnConfigurationId(logColumnConfiguration);
+              return (
                 <EuiDraggable
-                  key={`logColumnConfigurationPanel-${column.logColumnConfiguration.id}`}
+                  key={`logColumnConfigurationPanel-${columnId}`}
                   index={index}
-                  draggableId={column.logColumnConfiguration.id}
+                  draggableId={columnId}
                   customDragHandle
                 >
                   {(provided) => (
                     <LogColumnConfigurationPanel
                       dragHandleProps={provided.dragHandleProps}
-                      logColumnConfigurationProps={column}
+                      logColumnConfiguration={logColumnConfiguration}
+                      onRemove={removeLogColumn}
                     />
                   )}
                 </EuiDraggable>
-              ))}
-            </>
+              );
+            })}
           </EuiDroppable>
         </EuiDragDropContext>
       ) : (
         <LogColumnConfigurationEmptyPrompt />
       )}
-    </EuiForm>
+      {logColumnsFormElement.validity.validity === 'invalid'
+        ? logColumnsFormElement.validity.reasons.map((error) => (
+            <EuiText key={error.type} textAlign="center" color="danger">
+              <LogSourceConfigurationFormError error={error} />
+            </EuiText>
+          ))
+        : null}
+    </>
+  );
+});
+
+const LogColumnConfigurationPanel: React.FunctionComponent<{
+  logColumnConfiguration: LogColumnConfiguration;
+  dragHandleProps: DragHandleProps;
+  onRemove: (logColumnConfiguration: LogColumnConfiguration) => void;
+}> = ({ logColumnConfiguration, dragHandleProps, onRemove }) => {
+  const removeColumn = useCallback(() => onRemove(logColumnConfiguration), [
+    logColumnConfiguration,
+    onRemove,
+  ]);
+
+  return (
+    <>
+      <EuiSpacer size="m" />
+      {isTimestampLogColumnConfiguration(logColumnConfiguration) ? (
+        <TimestampLogColumnConfigurationPanel
+          dragHandleProps={dragHandleProps}
+          logColumnConfiguration={logColumnConfiguration}
+          onRemove={removeColumn}
+        />
+      ) : isMessageLogColumnConfiguration(logColumnConfiguration) ? (
+        <MessageLogColumnConfigurationPanel
+          dragHandleProps={dragHandleProps}
+          logColumnConfiguration={logColumnConfiguration}
+          onRemove={removeColumn}
+        />
+      ) : (
+        <FieldLogColumnConfigurationPanel
+          dragHandleProps={dragHandleProps}
+          logColumnConfiguration={logColumnConfiguration}
+          onRemove={removeColumn}
+        />
+      )}
+    </>
   );
 };
 
-interface LogColumnConfigurationPanelProps {
-  logColumnConfigurationProps: LogColumnConfigurationProps;
+interface LogColumnConfigurationPanelProps<LogColumnConfigurationType> {
+  logColumnConfiguration: LogColumnConfigurationType;
   dragHandleProps: DragHandleProps;
+  onRemove: () => void;
 }
 
-const LogColumnConfigurationPanel: React.FunctionComponent<LogColumnConfigurationPanelProps> = (
-  props
-) => (
-  <>
-    <EuiSpacer size="m" />
-    {props.logColumnConfigurationProps.type === 'timestamp' ? (
-      <TimestampLogColumnConfigurationPanel {...props} />
-    ) : props.logColumnConfigurationProps.type === 'message' ? (
-      <MessageLogColumnConfigurationPanel {...props} />
-    ) : (
-      <FieldLogColumnConfigurationPanel
-        logColumnConfigurationProps={props.logColumnConfigurationProps}
-        dragHandleProps={props.dragHandleProps}
-      />
-    )}
-  </>
-);
-
-const TimestampLogColumnConfigurationPanel: React.FunctionComponent<LogColumnConfigurationPanelProps> = ({
-  logColumnConfigurationProps,
-  dragHandleProps,
-}) => (
+const TimestampLogColumnConfigurationPanel: React.FunctionComponent<
+  LogColumnConfigurationPanelProps<TimestampLogColumnConfiguration>
+> = ({ dragHandleProps, onRemove }) => (
   <ExplainedLogColumnConfigurationPanel
     fieldName="Timestamp"
     helpText={
@@ -142,15 +193,14 @@ const TimestampLogColumnConfigurationPanel: React.FunctionComponent<LogColumnCon
         }}
       />
     }
-    removeColumn={logColumnConfigurationProps.remove}
+    onRemove={onRemove}
     dragHandleProps={dragHandleProps}
   />
 );
 
-const MessageLogColumnConfigurationPanel: React.FunctionComponent<LogColumnConfigurationPanelProps> = ({
-  logColumnConfigurationProps,
-  dragHandleProps,
-}) => (
+const MessageLogColumnConfigurationPanel: React.FunctionComponent<
+  LogColumnConfigurationPanelProps<MessageLogColumnConfiguration>
+> = ({ dragHandleProps, onRemove }) => (
   <ExplainedLogColumnConfigurationPanel
     fieldName="Message"
     helpText={
@@ -160,29 +210,26 @@ const MessageLogColumnConfigurationPanel: React.FunctionComponent<LogColumnConfi
         defaultMessage="This system field shows the log entry message as derived from the document fields."
       />
     }
-    removeColumn={logColumnConfigurationProps.remove}
+    onRemove={onRemove}
     dragHandleProps={dragHandleProps}
   />
 );
 
-const FieldLogColumnConfigurationPanel: React.FunctionComponent<{
-  logColumnConfigurationProps: FieldLogColumnConfigurationProps;
-  dragHandleProps: DragHandleProps;
-}> = ({
-  logColumnConfigurationProps: {
-    logColumnConfiguration: { field },
-    remove,
-  },
+const FieldLogColumnConfigurationPanel: React.FunctionComponent<
+  LogColumnConfigurationPanelProps<FieldLogColumnConfiguration>
+> = ({
   dragHandleProps,
+  logColumnConfiguration: {
+    fieldColumn: { field },
+  },
+  onRemove,
 }) => {
-  const fieldLogColumnTitle = i18n.translate(
-    'xpack.infra.sourceConfiguration.fieldLogColumnTitle',
-    {
-      defaultMessage: 'Field',
-    }
-  );
   return (
-    <EuiPanel data-test-subj={`logColumnPanel fieldLogColumnPanel fieldLogColumnPanel:${field}`}>
+    <EuiPanel
+      color="subdued"
+      data-test-subj={`logColumnPanel fieldLogColumnPanel fieldLogColumnPanel:${field}`}
+      hasShadow={false}
+    >
       <EuiFlexGroup alignItems="center">
         <EuiFlexItem grow={false}>
           <div data-test-subj="moveLogColumnHandle" {...dragHandleProps}>
@@ -195,7 +242,7 @@ const FieldLogColumnConfigurationPanel: React.FunctionComponent<{
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
           <RemoveLogColumnButton
-            onClick={remove}
+            onClick={onRemove}
             columnDescription={`${fieldLogColumnTitle} - ${field}`}
           />
         </EuiFlexItem>
@@ -207,11 +254,13 @@ const FieldLogColumnConfigurationPanel: React.FunctionComponent<{
 const ExplainedLogColumnConfigurationPanel: React.FunctionComponent<{
   fieldName: React.ReactNode;
   helpText: React.ReactNode;
-  removeColumn: () => void;
+  onRemove: () => void;
   dragHandleProps: DragHandleProps;
-}> = ({ fieldName, helpText, removeColumn, dragHandleProps }) => (
+}> = ({ fieldName, helpText, onRemove, dragHandleProps }) => (
   <EuiPanel
+    color="subdued"
     data-test-subj={`logColumnPanel systemLogColumnPanel systemLogColumnPanel:${fieldName}`}
+    hasShadow={false}
   >
     <EuiFlexGroup alignItems="center">
       <EuiFlexItem grow={false}>
@@ -226,7 +275,7 @@ const ExplainedLogColumnConfigurationPanel: React.FunctionComponent<{
         </EuiText>
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
-        <RemoveLogColumnButton onClick={removeColumn} columnDescription={String(fieldName)} />
+        <RemoveLogColumnButton onClick={onRemove} columnDescription={String(fieldName)} />
       </EuiFlexItem>
     </EuiFlexGroup>
   </EuiPanel>
@@ -277,3 +326,7 @@ const LogColumnConfigurationEmptyPrompt: React.FunctionComponent = () => (
     }
   />
 );
+
+const fieldLogColumnTitle = i18n.translate('xpack.infra.sourceConfiguration.fieldLogColumnTitle', {
+  defaultMessage: 'Field',
+});
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/name_configuration_form_state.tsx b/x-pack/plugins/infra/public/pages/logs/settings/name_configuration_form_state.tsx
new file mode 100644
index 00000000000000..f97ece074c4a3c
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/name_configuration_form_state.tsx
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { useFormElement } from './form_elements';
+import { FormValidationError, validateStringNotEmpty } from './validation_errors';
+
+export const useNameFormElement = (initialValue: string) => {
+  const nameFormElement = useFormElement<string, FormValidationError>({
+    initialValue,
+    validate: useMemo(() => async (name) => validateStringNotEmpty('name', name), []),
+  });
+
+  return nameFormElement;
+};
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/name_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/logs/settings/name_configuration_panel.tsx
new file mode 100644
index 00000000000000..54158b654fee36
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/name_configuration_panel.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiDescribedFormGroup,
+  EuiFieldText,
+  EuiForm,
+  EuiFormRow,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+import { FormElement } from './form_elements';
+import { getFormRowProps, getStringInputFieldProps } from './form_field_props';
+import { FormValidationError } from './validation_errors';
+
+export const NameConfigurationPanel = React.memo<{
+  isLoading: boolean;
+  isReadOnly: boolean;
+  nameFormElement: FormElement<string, FormValidationError>;
+}>(({ isLoading, isReadOnly, nameFormElement }) => (
+  <EuiForm>
+    <EuiTitle size="s" data-test-subj="sourceConfigurationNameSectionTitle">
+      <h3>
+        <FormattedMessage
+          id="xpack.infra.sourceConfiguration.nameSectionTitle"
+          defaultMessage="Name"
+        />
+      </h3>
+    </EuiTitle>
+    <EuiSpacer size="m" />
+    <EuiDescribedFormGroup
+      title={
+        <h4>
+          <FormattedMessage id="xpack.infra.sourceConfiguration.nameLabel" defaultMessage="Name" />
+        </h4>
+      }
+      description={
+        <FormattedMessage
+          id="xpack.infra.sourceConfiguration.nameDescription"
+          defaultMessage="A descriptive name for the source configuration"
+        />
+      }
+    >
+      <EuiFormRow
+        fullWidth
+        label={
+          <FormattedMessage id="xpack.infra.sourceConfiguration.nameLabel" defaultMessage="Name" />
+        }
+        {...useMemo(() => getFormRowProps(nameFormElement), [nameFormElement])}
+      >
+        <EuiFieldText
+          data-test-subj="nameInput"
+          fullWidth
+          disabled={isLoading}
+          readOnly={isReadOnly}
+          isLoading={isLoading}
+          name="name"
+          {...useMemo(() => getStringInputFieldProps(nameFormElement), [nameFormElement])}
+        />
+      </EuiFormRow>
+    </EuiDescribedFormGroup>
+  </EuiForm>
+));
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_errors.tsx b/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_errors.tsx
new file mode 100644
index 00000000000000..af36a9dc0090b2
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_errors.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCallOut, EuiCode } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React from 'react';
+import { FormValidationError } from './validation_errors';
+
+export const LogSourceConfigurationFormErrors: React.FC<{ errors: FormValidationError[] }> = ({
+  errors,
+}) => (
+  <EuiCallOut color="danger" iconType="alert" title={logSourceConfigurationFormErrorsCalloutTitle}>
+    <ul>
+      {errors.map((error, errorIndex) => (
+        <li key={errorIndex}>
+          <LogSourceConfigurationFormError error={error} />
+        </li>
+      ))}
+    </ul>
+  </EuiCallOut>
+);
+
+export const LogSourceConfigurationFormError: React.FC<{ error: FormValidationError }> = ({
+  error,
+}) => {
+  if (error.type === 'generic') {
+    return <>{error.message}</>;
+  } else if (error.type === 'empty_field') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.emptyFieldErrorMessage"
+        defaultMessage="The field '{fieldName}' must not be empty."
+        values={{
+          fieldName: error.fieldName,
+        }}
+      />
+    );
+  } else if (error.type === 'empty_column_list') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.emptyColumnListErrorMessage"
+        defaultMessage="The column list must not be empty."
+      />
+    );
+  } else if (error.type === 'child') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.childFormElementErrorMessage"
+        defaultMessage="At least one form field is in an invalid state."
+      />
+    );
+  } else if (error.type === 'missing_timestamp_field') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.missingTimestampFieldErrorMessage"
+        defaultMessage="The index pattern must be time-based."
+      />
+    );
+  } else if (error.type === 'missing_message_field') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.missingMessageFieldErrorMessage"
+        defaultMessage="The index pattern must contain a {messageField} field."
+        values={{
+          messageField: <EuiCode>message</EuiCode>,
+        }}
+      />
+    );
+  } else if (error.type === 'invalid_message_field_type') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.invalidMessageFieldTypeErrorMessage"
+        defaultMessage="The {messageField} field must be a text field."
+        values={{
+          messageField: <EuiCode>message</EuiCode>,
+        }}
+      />
+    );
+  } else if (error.type === 'rollup_index_pattern') {
+    return (
+      <FormattedMessage
+        id="xpack.infra.logSourceConfiguration.rollupIndexPatternErrorMessage"
+        defaultMessage="The index pattern must not be a rollup index pattern."
+      />
+    );
+  } else {
+    return null;
+  }
+};
+
+const logSourceConfigurationFormErrorsCalloutTitle = i18n.translate(
+  'xpack.infra.logSourceConfiguration.logSourceConfigurationFormErrorsCalloutTitle',
+  {
+    defaultMessage: 'Inconsistent source configuration',
+  }
+);
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_state.tsx b/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_state.tsx
index 95c55b556ab866..67e790a98f5183 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_state.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_form_state.tsx
@@ -5,103 +5,69 @@
  * 2.0.
  */
 
-import { useCallback, useMemo } from 'react';
-import { ResolvedLogSourceConfiguration } from '../../../../common/log_sources';
-import { useLogIndicesConfigurationFormState } from './indices_configuration_form_state';
-import { useLogColumnsConfigurationFormState } from './log_columns_configuration_form_state';
+import { useMemo } from 'react';
+import { LogSourceConfigurationProperties } from '../../../containers/logs/log_source';
+import { useCompositeFormElement } from './form_elements';
+import { useFieldsFormElement, useLogIndicesFormElement } from './indices_configuration_form_state';
+import { useLogColumnsFormElement } from './log_columns_configuration_form_state';
+import { useNameFormElement } from './name_configuration_form_state';
 
 export const useLogSourceConfigurationFormState = (
-  configuration?: ResolvedLogSourceConfiguration
+  configuration?: LogSourceConfigurationProperties
 ) => {
-  const indicesConfigurationFormState = useLogIndicesConfigurationFormState({
-    initialFormState: useMemo(
-      () =>
-        configuration
-          ? {
-              name: configuration.name,
-              description: configuration.description,
-              logAlias: configuration.indices,
-              tiebreakerField: configuration.tiebreakerField,
-              timestampField: configuration.timestampField,
-            }
-          : undefined,
-      [configuration]
-    ),
-  });
+  const nameFormElement = useNameFormElement(configuration?.name ?? '');
 
-  const logColumnsConfigurationFormState = useLogColumnsConfigurationFormState({
-    initialFormState: useMemo(
+  const logIndicesFormElement = useLogIndicesFormElement(
+    useMemo(
       () =>
-        configuration
-          ? {
-              logColumns: configuration.columns,
-            }
-          : undefined,
+        configuration?.logIndices ?? {
+          type: 'index_name',
+          indexName: '',
+        },
       [configuration]
-    ),
-  });
-
-  const errors = useMemo(
-    () => [...indicesConfigurationFormState.errors, ...logColumnsConfigurationFormState.errors],
-    [indicesConfigurationFormState.errors, logColumnsConfigurationFormState.errors]
+    )
   );
 
-  const resetForm = useCallback(() => {
-    indicesConfigurationFormState.resetForm();
-    logColumnsConfigurationFormState.resetForm();
-  }, [indicesConfigurationFormState, logColumnsConfigurationFormState]);
-
-  const isFormDirty = useMemo(
-    () => indicesConfigurationFormState.isFormDirty || logColumnsConfigurationFormState.isFormDirty,
-    [indicesConfigurationFormState.isFormDirty, logColumnsConfigurationFormState.isFormDirty]
-  );
-
-  const isFormValid = useMemo(
-    () => indicesConfigurationFormState.isFormValid && logColumnsConfigurationFormState.isFormValid,
-    [indicesConfigurationFormState.isFormValid, logColumnsConfigurationFormState.isFormValid]
+  const {
+    fieldsFormElement,
+    tiebreakerFieldFormElement,
+    timestampFieldFormElement,
+  } = useFieldsFormElement(
+    useMemo(
+      () => ({
+        tiebreakerField: configuration?.fields?.tiebreaker ?? '_doc',
+        timestampField: configuration?.fields?.timestamp ?? '@timestamp',
+      }),
+      [configuration]
+    )
   );
 
-  const formState = useMemo(
-    () => ({
-      name: indicesConfigurationFormState.formState.name,
-      description: indicesConfigurationFormState.formState.description,
-      logAlias: indicesConfigurationFormState.formState.logAlias,
-      fields: {
-        tiebreaker: indicesConfigurationFormState.formState.tiebreakerField,
-        timestamp: indicesConfigurationFormState.formState.timestampField,
-      },
-      logColumns: logColumnsConfigurationFormState.formState.logColumns,
-    }),
-    [indicesConfigurationFormState.formState, logColumnsConfigurationFormState.formState]
+  const logColumnsFormElement = useLogColumnsFormElement(
+    useMemo(() => configuration?.logColumns ?? [], [configuration])
   );
 
-  const formStateChanges = useMemo(
-    () => ({
-      name: indicesConfigurationFormState.formStateChanges.name,
-      description: indicesConfigurationFormState.formStateChanges.description,
-      logAlias: indicesConfigurationFormState.formStateChanges.logAlias,
-      fields: {
-        tiebreaker: indicesConfigurationFormState.formStateChanges.tiebreakerField,
-        timestamp: indicesConfigurationFormState.formStateChanges.timestampField,
-      },
-      logColumns: logColumnsConfigurationFormState.formStateChanges.logColumns,
-    }),
-    [
-      indicesConfigurationFormState.formStateChanges,
-      logColumnsConfigurationFormState.formStateChanges,
-    ]
+  const sourceConfigurationFormElement = useCompositeFormElement(
+    useMemo(
+      () => ({
+        childFormElements: {
+          name: nameFormElement,
+          logIndices: logIndicesFormElement,
+          fields: fieldsFormElement,
+          logColumns: logColumnsFormElement,
+        },
+        validate: async () => [],
+      }),
+      [nameFormElement, logIndicesFormElement, fieldsFormElement, logColumnsFormElement]
+    )
   );
 
   return {
-    addLogColumn: logColumnsConfigurationFormState.addLogColumn,
-    moveLogColumn: logColumnsConfigurationFormState.moveLogColumn,
-    errors,
-    formState,
-    formStateChanges,
-    isFormDirty,
-    isFormValid,
-    indicesConfigurationProps: indicesConfigurationFormState.fieldProps,
-    logColumnConfigurationProps: logColumnsConfigurationFormState.logColumnConfigurationProps,
-    resetForm,
+    formState: sourceConfigurationFormElement.value,
+    logIndicesFormElement,
+    logColumnsFormElement,
+    nameFormElement,
+    sourceConfigurationFormElement,
+    tiebreakerFieldFormElement,
+    timestampFieldFormElement,
   };
 };
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_settings.tsx b/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_settings.tsx
index 2eaf4f61409a81..9ab7d38e6c8383 100644
--- a/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_settings.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/settings/source_configuration_settings.tsx
@@ -7,33 +7,40 @@
 
 import {
   EuiButton,
-  EuiCallOut,
   EuiErrorBoundary,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiPanel,
-  EuiSpacer,
   EuiPage,
   EuiPageBody,
+  EuiPageContentBody,
+  EuiPanel,
+  EuiSpacer,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { useCallback, useMemo } from 'react';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
-import { FieldsConfigurationPanel } from './fields_configuration_panel';
+import { useTrackPageview } from '../../../../../observability/public';
+import { SourceLoadingPage } from '../../../components/source_loading_page';
+import { useLogSourceContext } from '../../../containers/logs/log_source';
+import { Prompt } from '../../../utils/navigation_warning_prompt';
 import { IndicesConfigurationPanel } from './indices_configuration_panel';
-import { NameConfigurationPanel } from '../../../components/source_configuration/name_configuration_panel';
 import { LogColumnsConfigurationPanel } from './log_columns_configuration_panel';
+import { NameConfigurationPanel } from './name_configuration_panel';
+import { LogSourceConfigurationFormErrors } from './source_configuration_form_errors';
 import { useLogSourceConfigurationFormState } from './source_configuration_form_state';
-import { useLogSourceContext } from '../../../containers/logs/log_source';
-import { SourceLoadingPage } from '../../../components/source_loading_page';
-import { Prompt } from '../../../utils/navigation_warning_prompt';
-import { LogSourceConfigurationPropertiesPatch } from '../../../../common/http_api/log_sources';
 
 export const LogsSettingsPage = () => {
   const uiCapabilities = useKibana().services.application?.capabilities;
   const shouldAllowEdit = uiCapabilities?.logs?.configureSource === true;
 
+  useTrackPageview({ app: 'infra_logs', path: 'log_source_configuration' });
+  useTrackPageview({
+    app: 'infra_logs',
+    path: 'log_source_configuration',
+    delay: 15000,
+  });
+
   const {
     sourceConfiguration: source,
     isLoading,
@@ -48,35 +55,19 @@ export const LogsSettingsPage = () => {
   );
 
   const {
-    addLogColumn,
-    moveLogColumn,
-    indicesConfigurationProps,
-    logColumnConfigurationProps,
-    errors,
-    resetForm,
-    isFormDirty,
-    isFormValid,
-    formStateChanges,
-  } = useLogSourceConfigurationFormState(resolvedSourceConfiguration);
+    sourceConfigurationFormElement,
+    formState,
+    logIndicesFormElement,
+    logColumnsFormElement,
+    nameFormElement,
+    tiebreakerFieldFormElement,
+    timestampFieldFormElement,
+  } = useLogSourceConfigurationFormState(source?.configuration);
 
   const persistUpdates = useCallback(async () => {
-    // NOTE / TODO: This is just a temporary workaround until this work is merged with the corresponding UI branch.
-    // Otherwise we would be duplicating work changing the logAlias etc references twice.
-    const patchedProperties: LogSourceConfigurationPropertiesPatch & { logAlias?: string } = {
-      ...formStateChanges,
-      ...(formStateChanges.logAlias
-        ? {
-            logIndices: {
-              type: 'index_name',
-              indexName: formStateChanges.logAlias,
-            },
-          }
-        : {}),
-    };
-    delete patchedProperties.logAlias;
-    await updateSourceConfiguration(patchedProperties);
-    resetForm();
-  }, [updateSourceConfiguration, resetForm, formStateChanges]);
+    await updateSourceConfiguration(formState);
+    sourceConfigurationFormElement.resetValue();
+  }, [updateSourceConfiguration, sourceConfigurationFormElement, formState]);
 
   const isWriteable = useMemo(() => shouldAllowEdit && source && source.origin !== 'internal', [
     shouldAllowEdit,
@@ -92,110 +83,100 @@ export const LogsSettingsPage = () => {
 
   return (
     <EuiErrorBoundary>
-      <EuiPage>
-        <EuiPageBody
-          className="eui-displayBlock"
-          restrictWidth
-          data-test-subj="sourceConfigurationContent"
-        >
-          <Prompt prompt={isFormDirty ? unsavedFormPromptMessage : undefined} />
-          <EuiPanel paddingSize="l">
-            <NameConfigurationPanel
-              isLoading={isLoading}
-              nameFieldProps={indicesConfigurationProps.name}
-              readOnly={!isWriteable}
-            />
-          </EuiPanel>
-          <EuiSpacer />
-          <EuiPanel paddingSize="l">
-            <IndicesConfigurationPanel
-              isLoading={isLoading}
-              logAliasFieldProps={indicesConfigurationProps.logAlias}
-              readOnly={!isWriteable}
-            />
-          </EuiPanel>
-          <EuiSpacer />
-          <EuiPanel paddingSize="l">
-            <FieldsConfigurationPanel
-              isLoading={isLoading}
-              readOnly={!isWriteable}
-              tiebreakerFieldProps={indicesConfigurationProps.tiebreakerField}
-              timestampFieldProps={indicesConfigurationProps.timestampField}
+      <EuiPage style={{ flex: '1 0 0%' }}>
+        <EuiPageBody data-test-subj="sourceConfigurationContent" restrictWidth>
+          <EuiPageContentBody>
+            <Prompt
+              prompt={sourceConfigurationFormElement.isDirty ? unsavedFormPromptMessage : undefined}
             />
-          </EuiPanel>
-          <EuiSpacer />
-          <EuiPanel paddingSize="l">
-            <LogColumnsConfigurationPanel
-              addLogColumn={addLogColumn}
-              moveLogColumn={moveLogColumn}
-              availableFields={availableFields}
-              isLoading={isLoading}
-              logColumnConfiguration={logColumnConfigurationProps}
-            />
-          </EuiPanel>
-          {errors.length > 0 ? (
-            <>
-              <EuiCallOut color="danger">
-                <ul>
-                  {errors.map((error, errorIndex) => (
-                    <li key={errorIndex}>{error}</li>
-                  ))}
-                </ul>
-              </EuiCallOut>
-              <EuiSpacer size="m" />
-            </>
-          ) : null}
-          <EuiSpacer size="m" />
-          <EuiFlexGroup>
-            {isWriteable && (
-              <EuiFlexItem>
-                {isLoading ? (
-                  <EuiFlexGroup justifyContent="flexEnd">
-                    <EuiFlexItem grow={false}>
-                      <EuiButton color="primary" isLoading fill>
-                        Loading
-                      </EuiButton>
-                    </EuiFlexItem>
-                  </EuiFlexGroup>
-                ) : (
-                  <>
+            <EuiPanel paddingSize="l">
+              <NameConfigurationPanel
+                isLoading={isLoading}
+                isReadOnly={!isWriteable}
+                nameFormElement={nameFormElement}
+              />
+            </EuiPanel>
+            <EuiSpacer />
+            <EuiPanel paddingSize="l">
+              <IndicesConfigurationPanel
+                isLoading={isLoading}
+                isReadOnly={!isWriteable}
+                indicesFormElement={logIndicesFormElement}
+                tiebreakerFieldFormElement={tiebreakerFieldFormElement}
+                timestampFieldFormElement={timestampFieldFormElement}
+              />
+            </EuiPanel>
+            <EuiSpacer />
+            <EuiPanel paddingSize="l">
+              <LogColumnsConfigurationPanel
+                availableFields={availableFields}
+                isLoading={isLoading}
+                logColumnsFormElement={logColumnsFormElement}
+              />
+            </EuiPanel>
+            <EuiSpacer />
+            {sourceConfigurationFormElement.validity.validity === 'invalid' ? (
+              <>
+                <LogSourceConfigurationFormErrors
+                  errors={sourceConfigurationFormElement.validity.reasons}
+                />
+                <EuiSpacer />
+              </>
+            ) : null}
+            <EuiFlexGroup>
+              {isWriteable && (
+                <EuiFlexItem>
+                  {isLoading ? (
                     <EuiFlexGroup justifyContent="flexEnd">
                       <EuiFlexItem grow={false}>
-                        <EuiButton
-                          data-test-subj="discardSettingsButton"
-                          color="danger"
-                          iconType="cross"
-                          isDisabled={isLoading || !isFormDirty}
-                          onClick={() => {
-                            resetForm();
-                          }}
-                        >
-                          <FormattedMessage
-                            id="xpack.infra.sourceConfiguration.discardSettingsButtonLabel"
-                            defaultMessage="Discard"
-                          />
-                        </EuiButton>
-                      </EuiFlexItem>
-                      <EuiFlexItem grow={false}>
-                        <EuiButton
-                          data-test-subj="applySettingsButton"
-                          color="primary"
-                          isDisabled={!isFormDirty || !isFormValid}
-                          fill
-                          onClick={persistUpdates}
-                        >
-                          <FormattedMessage
-                            id="xpack.infra.sourceConfiguration.applySettingsButtonLabel"
-                            defaultMessage="Apply"
-                          />
+                        <EuiButton color="primary" isLoading fill>
+                          Loading
                         </EuiButton>
                       </EuiFlexItem>
                     </EuiFlexGroup>
-                  </>
-                )}
-              </EuiFlexItem>
-            )}
-          </EuiFlexGroup>
+                  ) : (
+                    <>
+                      <EuiFlexGroup justifyContent="flexEnd">
+                        <EuiFlexItem grow={false}>
+                          <EuiButton
+                            data-test-subj="discardSettingsButton"
+                            color="danger"
+                            iconType="cross"
+                            isDisabled={isLoading || !sourceConfigurationFormElement.isDirty}
+                            onClick={() => {
+                              sourceConfigurationFormElement.resetValue();
+                            }}
+                          >
+                            <FormattedMessage
+                              id="xpack.infra.sourceConfiguration.discardSettingsButtonLabel"
+                              defaultMessage="Discard"
+                            />
+                          </EuiButton>
+                        </EuiFlexItem>
+                        <EuiFlexItem grow={false}>
+                          <EuiButton
+                            data-test-subj="applySettingsButton"
+                            color="primary"
+                            isDisabled={
+                              !sourceConfigurationFormElement.isDirty ||
+                              sourceConfigurationFormElement.validity.validity !== 'valid'
+                            }
+                            fill
+                            onClick={persistUpdates}
+                          >
+                            <FormattedMessage
+                              id="xpack.infra.sourceConfiguration.applySettingsButtonLabel"
+                              defaultMessage="Apply"
+                            />
+                          </EuiButton>
+                        </EuiFlexItem>
+                      </EuiFlexGroup>
+                    </>
+                  )}
+                </EuiFlexItem>
+              )}
+            </EuiFlexGroup>
+          </EuiPageContentBody>
         </EuiPageBody>
       </EuiPage>
     </EuiErrorBoundary>
diff --git a/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts b/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts
new file mode 100644
index 00000000000000..b6e5a387590ed9
--- /dev/null
+++ b/x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IndexPattern, KBN_FIELD_TYPES } from '../../../../../../../src/plugins/data/public';
+
+export interface GenericValidationError {
+  type: 'generic';
+  message: string;
+}
+
+export interface ChildFormValidationError {
+  type: 'child';
+}
+
+export interface EmptyFieldValidationError {
+  type: 'empty_field';
+  fieldName: string;
+}
+
+export interface EmptyColumnListValidationError {
+  type: 'empty_column_list';
+}
+
+export interface MissingTimestampFieldValidationError {
+  type: 'missing_timestamp_field';
+  indexPatternTitle: string;
+}
+
+export interface MissingMessageFieldValidationError {
+  type: 'missing_message_field';
+  indexPatternTitle: string;
+}
+
+export interface InvalidMessageFieldTypeValidationError {
+  type: 'invalid_message_field_type';
+  indexPatternTitle: string;
+}
+
+export interface RollupIndexPatternValidationError {
+  type: 'rollup_index_pattern';
+  indexPatternTitle: string;
+}
+
+export type FormValidationError =
+  | GenericValidationError
+  | ChildFormValidationError
+  | EmptyFieldValidationError
+  | EmptyColumnListValidationError
+  | MissingTimestampFieldValidationError
+  | MissingMessageFieldValidationError
+  | InvalidMessageFieldTypeValidationError
+  | RollupIndexPatternValidationError;
+
+export const validateStringNotEmpty = (fieldName: string, value: string): FormValidationError[] =>
+  value === '' ? [{ type: 'empty_field', fieldName }] : [];
+
+export const validateColumnListNotEmpty = (columns: unknown[]): FormValidationError[] =>
+  columns.length <= 0 ? [{ type: 'empty_column_list' }] : [];
+
+export const validateIndexPattern = (indexPattern: IndexPattern): FormValidationError[] => {
+  return [
+    ...validateIndexPatternIsTimeBased(indexPattern),
+    ...validateIndexPatternHasStringMessageField(indexPattern),
+    ...validateIndexPatternIsntRollup(indexPattern),
+  ];
+};
+
+export const validateIndexPatternIsTimeBased = (
+  indexPattern: IndexPattern
+): FormValidationError[] =>
+  indexPattern.isTimeBased()
+    ? []
+    : [
+        {
+          type: 'missing_timestamp_field' as const,
+          indexPatternTitle: indexPattern.title,
+        },
+      ];
+
+export const validateIndexPatternHasStringMessageField = (
+  indexPattern: IndexPattern
+): FormValidationError[] => {
+  const messageField = indexPattern.getFieldByName('message');
+
+  if (messageField == null) {
+    return [
+      {
+        type: 'missing_message_field' as const,
+        indexPatternTitle: indexPattern.title,
+      },
+    ];
+  } else if (messageField.type !== KBN_FIELD_TYPES.STRING) {
+    return [
+      {
+        type: 'invalid_message_field_type' as const,
+        indexPatternTitle: indexPattern.title,
+      },
+    ];
+  } else {
+    return [];
+  }
+};
+
+export const validateIndexPatternIsntRollup = (indexPattern: IndexPattern): FormValidationError[] =>
+  indexPattern.type != null
+    ? [
+        {
+          type: 'rollup_index_pattern' as const,
+          indexPatternTitle: indexPattern.title,
+        },
+      ]
+    : [];
diff --git a/x-pack/plugins/infra/public/pages/metrics/index.tsx b/x-pack/plugins/infra/public/pages/metrics/index.tsx
index 51cc4ca0984837..b43d7640f63907 100644
--- a/x-pack/plugins/infra/public/pages/metrics/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/index.tsx
@@ -120,6 +120,7 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => {
                     >
                       <EuiFlexGroup gutterSize={'none'} alignItems={'center'}>
                         <EuiFlexItem>
+                          {/** !! Need to be kept in sync with the searchDeepLinks in x-pack/plugins/infra/public/plugin.ts */}
                           <RoutedTabs
                             tabs={[
                               {
diff --git a/x-pack/plugins/infra/public/pages/metrics/settings/fields_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/metrics/settings/fields_configuration_panel.tsx
index 7026f372ec7ff8..1c6c627c08d0bf 100644
--- a/x-pack/plugins/infra/public/pages/metrics/settings/fields_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/settings/fields_configuration_panel.tsx
@@ -19,8 +19,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
-
-import { InputFieldProps } from '../../../components/source_configuration/input_fields';
+import { InputFieldProps } from './input_fields';
 
 interface FieldsConfigurationPanelProps {
   containerFieldProps: InputFieldProps;
diff --git a/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_form_state.ts b/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_form_state.ts
index ad26c1b13b0e18..ced87112e6e9a8 100644
--- a/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_form_state.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_form_state.ts
@@ -6,12 +6,11 @@
  */
 
 import { ReactNode, useCallback, useMemo, useState } from 'react';
-
 import {
   createInputFieldProps,
   createInputRangeFieldProps,
   validateInputFieldNotEmpty,
-} from '../../../components/source_configuration/input_fields';
+} from './input_fields';
 
 interface FormState {
   name: string;
diff --git a/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_panel.tsx
index c64ab2b0e9df53..c1e0d2ffefa800 100644
--- a/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/settings/indices_configuration_panel.tsx
@@ -16,9 +16,8 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
-
 import { METRICS_INDEX_PATTERN } from '../../../../common/constants';
-import { InputFieldProps } from '../../../components/source_configuration/input_fields';
+import { InputFieldProps } from './input_fields';
 
 interface IndicesConfigurationPanelProps {
   isLoading: boolean;
diff --git a/x-pack/plugins/infra/public/components/source_configuration/input_fields.tsx b/x-pack/plugins/infra/public/pages/metrics/settings/input_fields.tsx
similarity index 100%
rename from x-pack/plugins/infra/public/components/source_configuration/input_fields.tsx
rename to x-pack/plugins/infra/public/pages/metrics/settings/input_fields.tsx
diff --git a/x-pack/plugins/infra/public/pages/metrics/settings/ml_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/metrics/settings/ml_configuration_panel.tsx
index abf25dde0ea990..630820156e0e5f 100644
--- a/x-pack/plugins/infra/public/pages/metrics/settings/ml_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/settings/ml_configuration_panel.tsx
@@ -5,15 +5,17 @@
  * 2.0.
  */
 
-import { EuiTitle } from '@elastic/eui';
-import { EuiSpacer } from '@elastic/eui';
-import { EuiFormRow } from '@elastic/eui';
-import { EuiRange } from '@elastic/eui';
-import { EuiDescribedFormGroup } from '@elastic/eui';
-import { EuiForm } from '@elastic/eui';
+import {
+  EuiDescribedFormGroup,
+  EuiForm,
+  EuiFormRow,
+  EuiRange,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
-import { FormattedMessage } from 'react-intl';
-import { InputRangeFieldProps } from '../../../components/source_configuration/input_fields';
+import { InputRangeFieldProps } from './input_fields';
 
 interface MLConfigurationPanelProps {
   isLoading: boolean;
diff --git a/x-pack/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx b/x-pack/plugins/infra/public/pages/metrics/settings/name_configuration_panel.tsx
similarity index 99%
rename from x-pack/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx
rename to x-pack/plugins/infra/public/pages/metrics/settings/name_configuration_panel.tsx
index 2fa4ff100fe548..bb36d12ff37675 100644
--- a/x-pack/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/settings/name_configuration_panel.tsx
@@ -15,7 +15,6 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
-
 import { InputFieldProps } from './input_fields';
 
 interface NameConfigurationPanelProps {
diff --git a/x-pack/plugins/infra/public/pages/metrics/settings/source_configuration_settings.tsx b/x-pack/plugins/infra/public/pages/metrics/settings/source_configuration_settings.tsx
index 71fa4e76005034..0579194464f4e8 100644
--- a/x-pack/plugins/infra/public/pages/metrics/settings/source_configuration_settings.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/settings/source_configuration_settings.tsx
@@ -10,24 +10,23 @@ import {
   EuiCallOut,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiPanel,
-  EuiSpacer,
   EuiPage,
   EuiPageBody,
+  EuiPanel,
+  EuiSpacer,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { useCallback, useContext, useMemo } from 'react';
-
+import { SourceLoadingPage } from '../../../components/source_loading_page';
 import { Source } from '../../../containers/metrics_source';
+import { useInfraMLCapabilitiesContext } from '../../../containers/ml/infra_ml_capabilities';
+import { Prompt } from '../../../utils/navigation_warning_prompt';
 import { FieldsConfigurationPanel } from './fields_configuration_panel';
 import { IndicesConfigurationPanel } from './indices_configuration_panel';
-import { NameConfigurationPanel } from '../../../components/source_configuration/name_configuration_panel';
-import { useSourceConfigurationFormState } from './source_configuration_form_state';
-import { SourceLoadingPage } from '../../../components/source_loading_page';
-import { Prompt } from '../../../utils/navigation_warning_prompt';
 import { MLConfigurationPanel } from './ml_configuration_panel';
-import { useInfraMLCapabilitiesContext } from '../../../containers/ml/infra_ml_capabilities';
+import { NameConfigurationPanel } from './name_configuration_panel';
+import { useSourceConfigurationFormState } from './source_configuration_form_state';
 
 interface SourceConfigurationSettingsProps {
   shouldAllowEdit: boolean;
diff --git a/x-pack/plugins/infra/public/plugin.ts b/x-pack/plugins/infra/public/plugin.ts
index 2dd1283fb41e5a..12fe53fb426c0e 100644
--- a/x-pack/plugins/infra/public/plugin.ts
+++ b/x-pack/plugins/infra/public/plugin.ts
@@ -63,6 +63,39 @@ export class Plugin implements InfraClientPluginClass {
       euiIconType: 'logoObservability',
       order: 8100,
       appRoute: '/app/logs',
+      meta: {
+        // !! Need to be kept in sync with the routes in x-pack/plugins/infra/public/pages/logs/page_content.tsx
+        searchDeepLinks: [
+          {
+            id: 'stream',
+            title: i18n.translate('xpack.infra.logs.index.streamTabTitle', {
+              defaultMessage: 'Stream',
+            }),
+            path: '/stream',
+          },
+          {
+            id: 'anomalies',
+            title: i18n.translate('xpack.infra.logs.index.anomaliesTabTitle', {
+              defaultMessage: 'Anomalies',
+            }),
+            path: '/anomalies',
+          },
+          {
+            id: 'log-categories',
+            title: i18n.translate('xpack.infra.logs.index.logCategoriesBetaBadgeTitle', {
+              defaultMessage: 'Categories',
+            }),
+            path: '/log-categories',
+          },
+          {
+            id: 'settings',
+            title: i18n.translate('xpack.infra.logs.index.settingsTabTitle', {
+              defaultMessage: 'Settings',
+            }),
+            path: '/settings',
+          },
+        ],
+      },
       category: DEFAULT_APP_CATEGORIES.observability,
       mount: async (params: AppMountParameters) => {
         // mount callback should not use setup dependencies, get start dependencies instead
@@ -82,6 +115,32 @@ export class Plugin implements InfraClientPluginClass {
       order: 8200,
       appRoute: '/app/metrics',
       category: DEFAULT_APP_CATEGORIES.observability,
+      meta: {
+        // !! Need to be kept in sync with the routes in x-pack/plugins/infra/public/pages/metrics/index.tsx
+        searchDeepLinks: [
+          {
+            id: 'inventory',
+            title: i18n.translate('xpack.infra.homePage.inventoryTabTitle', {
+              defaultMessage: 'Inventory',
+            }),
+            path: '/inventory',
+          },
+          {
+            id: 'metrics-explorer',
+            title: i18n.translate('xpack.infra.homePage.metricsExplorerTabTitle', {
+              defaultMessage: 'Metrics Explorer',
+            }),
+            path: '/explorer',
+          },
+          {
+            id: 'settings',
+            title: i18n.translate('xpack.infra.homePage.settingsTabTitle', {
+              defaultMessage: 'Settings',
+            }),
+            path: '/settings',
+          },
+        ],
+      },
       mount: async (params: AppMountParameters) => {
         // mount callback should not use setup dependencies, get start dependencies instead
         const [coreStart, pluginsStart] = await core.getStartServices();
diff --git a/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts b/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts
index 3d08d4fc270bcc..8d51f54e3f55a2 100644
--- a/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts
+++ b/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts
@@ -8,11 +8,12 @@
 import { CoreStart } from 'kibana/public';
 import { coreMock } from 'src/core/public/mocks';
 import { dataPluginMock } from 'src/plugins/data/public/mocks';
-import { callFetchLogSourceStatusAPI } from '../containers/logs/log_source/api/fetch_log_source_status';
+import { createIndexPatternMock } from '../../common/dependency_mocks/index_patterns';
+import { GetLogSourceConfigurationSuccessResponsePayload } from '../../common/http_api/log_sources/get_log_source_configuration';
 import { callFetchLogSourceConfigurationAPI } from '../containers/logs/log_source/api/fetch_log_source_configuration';
+import { callFetchLogSourceStatusAPI } from '../containers/logs/log_source/api/fetch_log_source_status';
 import { InfraClientStartDeps, InfraClientStartExports } from '../types';
 import { getLogsHasDataFetcher, getLogsOverviewDataFetcher } from './logs_overview_fetchers';
-import { GetLogSourceConfigurationSuccessResponsePayload } from '../../common/http_api/log_sources/get_log_source_configuration';
 
 jest.mock('../containers/logs/log_source/api/fetch_log_source_status');
 const mockedCallFetchLogSourceStatusAPI = callFetchLogSourceStatusAPI as jest.MockedFunction<
@@ -41,6 +42,36 @@ function setup() {
   //
   const dataResponder = jest.fn();
 
+  (data.indexPatterns.get as jest.Mock).mockResolvedValue(
+    createIndexPatternMock({
+      id: 'test-index-pattern',
+      title: 'log-indices-*',
+      timeFieldName: '@timestamp',
+      fields: [
+        {
+          name: 'event.dataset',
+          type: 'string',
+          esTypes: ['keyword'],
+          aggregatable: true,
+          searchable: true,
+        },
+        {
+          name: 'runtime_field',
+          type: 'string',
+          runtimeField: {
+            type: 'keyword',
+            script: {
+              source: 'emit("runtime value")',
+            },
+          },
+          esTypes: ['keyword'],
+          aggregatable: true,
+          searchable: true,
+        },
+      ],
+    })
+  );
+
   (data.search.search as jest.Mock).mockReturnValue({
     subscribe: (progress: Function, error: Function, finish: Function) => {
       progress(dataResponder());
@@ -114,7 +145,7 @@ describe('Logs UI Observability Homepage Functions', () => {
           configuration: {
             logIndices: {
               type: 'index_pattern',
-              indexPatternId: 'some-test-id',
+              indexPatternId: 'test-index-pattern',
             },
             fields: { timestamp: '@timestamp', tiebreaker: '_doc' },
           },
diff --git a/x-pack/plugins/infra/public/utils/source_configuration.ts b/x-pack/plugins/infra/public/utils/source_configuration.ts
index a3e1741c7590b1..ac8a331e869529 100644
--- a/x-pack/plugins/infra/public/utils/source_configuration.ts
+++ b/x-pack/plugins/infra/public/utils/source_configuration.ts
@@ -31,3 +31,15 @@ export const isTimestampLogColumnConfiguration = (
   logColumnConfiguration: LogColumnConfiguration
 ): logColumnConfiguration is TimestampLogColumnConfiguration =>
   logColumnConfiguration != null && 'timestampColumn' in logColumnConfiguration;
+
+export const getLogColumnConfigurationId = (
+  logColumnConfiguration: LogColumnConfiguration
+): string => {
+  if (isTimestampLogColumnConfiguration(logColumnConfiguration)) {
+    return logColumnConfiguration.timestampColumn.id;
+  } else if (isMessageLogColumnConfiguration(logColumnConfiguration)) {
+    return logColumnConfiguration.messageColumn.id;
+  } else {
+    return logColumnConfiguration.fieldColumn.id;
+  }
+};
diff --git a/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts b/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
index 33df2b4d55d222..3aaa747b945a82 100644
--- a/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
@@ -93,6 +93,7 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
             ],
           },
         },
+        runtime_mappings: resolvedLogSourceConfiguration.runtimeMappings,
         sort,
         ...highlightClause,
         ...searchAfterClause,
@@ -182,6 +183,7 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
             ],
           },
         },
+        runtime_mappings: resolvedLogSourceConfiguration.runtimeMappings,
         size: 0,
         track_total_hits: false,
       },
diff --git a/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts b/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts
index 7c7417d038e2ea..3cda019359caf9 100644
--- a/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts
@@ -19,13 +19,16 @@ import {
   SearchStrategyDependencies,
 } from 'src/plugins/data/server';
 import { createSearchSessionsClientMock } from '../../../../../../src/plugins/data/server/search/mocks';
+import {
+  createIndexPatternMock,
+  createIndexPatternsStartMock,
+} from '../../../common/dependency_mocks/index_patterns';
 import { InfraSource } from '../../lib/sources';
 import { createInfraSourcesMock } from '../../lib/sources/mocks';
 import {
   logEntriesSearchRequestStateRT,
   logEntriesSearchStrategyProvider,
 } from './log_entries_search_strategy';
-import { getIndexPatternsMock } from './mocks';
 
 describe('LogEntries search strategy', () => {
   it('handles initial search requests', async () => {
@@ -72,6 +75,15 @@ describe('LogEntries search strategy', () => {
           index: 'log-indices-*',
           body: expect.objectContaining({
             fields: expect.arrayContaining(['event.dataset', 'message']),
+            runtime_mappings: {
+              runtime_field: {
+                type: 'keyword',
+                script: {
+                  lang: 'painless',
+                  source: 'emit("runtime value")',
+                },
+              },
+            },
           }),
         }),
       }),
@@ -258,7 +270,7 @@ const createSourceConfigurationMock = (): InfraSource => ({
     description: 'SOURCE_DESCRIPTION',
     logIndices: {
       type: 'index_pattern',
-      indexPatternId: 'some-test-id',
+      indexPatternId: 'test-index-pattern',
     },
     metricAlias: 'metric-indices-*',
     inventoryDefaultView: 'DEFAULT_VIEW',
@@ -323,5 +335,33 @@ const createDataPluginMock = (esSearchStrategyMock: ISearchStrategy): any => ({
   search: {
     getSearchStrategy: jest.fn().mockReturnValue(esSearchStrategyMock),
   },
-  indexPatterns: getIndexPatternsMock(),
+  indexPatterns: createIndexPatternsStartMock(0, [
+    createIndexPatternMock({
+      id: 'test-index-pattern',
+      title: 'log-indices-*',
+      timeFieldName: '@timestamp',
+      fields: [
+        {
+          name: 'event.dataset',
+          type: 'string',
+          esTypes: ['keyword'],
+          aggregatable: true,
+          searchable: true,
+        },
+        {
+          name: 'runtime_field',
+          type: 'string',
+          runtimeField: {
+            type: 'keyword',
+            script: {
+              source: 'emit("runtime value")',
+            },
+          },
+          esTypes: ['keyword'],
+          aggregatable: true,
+          searchable: true,
+        },
+      ],
+    }),
+  ]),
 });
diff --git a/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts b/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts
index fc5dab9006df64..c47a1c163f9ecd 100644
--- a/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts
@@ -109,7 +109,7 @@ export const logEntriesSearchStrategyProvider = ({
             forkJoin([resolvedSourceConfiguration$, messageFormattingRules$]).pipe(
               map(
                 ([
-                  { indices, timestampField, tiebreakerField, columns },
+                  { indices, timestampField, tiebreakerField, columns, runtimeMappings },
                   messageFormattingRules,
                 ]): IEsSearchRequest => {
                   return {
@@ -123,6 +123,7 @@ export const logEntriesSearchStrategyProvider = ({
                       timestampField,
                       tiebreakerField,
                       getRequiredFields(params.columns ?? columns, messageFormattingRules),
+                      runtimeMappings,
                       params.query,
                       params.highlightPhrase
                     ),
diff --git a/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts b/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts
index 785a4414a984cb..f220c8913a2e61 100644
--- a/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts
@@ -18,14 +18,17 @@ import {
   ISearchStrategy,
   SearchStrategyDependencies,
 } from 'src/plugins/data/server';
-import { getIndexPatternsMock } from './mocks';
+import { createSearchSessionsClientMock } from '../../../../../../src/plugins/data/server/search/mocks';
+import {
+  createIndexPatternMock,
+  createIndexPatternsStartMock,
+} from '../../../common/dependency_mocks/index_patterns';
+import { InfraSource } from '../../../common/source_configuration/source_configuration';
 import { createInfraSourcesMock } from '../../lib/sources/mocks';
 import {
   logEntrySearchRequestStateRT,
   logEntrySearchStrategyProvider,
 } from './log_entry_search_strategy';
-import { createSearchSessionsClientMock } from '../../../../../../src/plugins/data/server/search/mocks';
-import { InfraSource } from '../../../common/source_configuration/source_configuration';
 
 describe('LogEntry search strategy', () => {
   it('handles initial search requests', async () => {
@@ -61,7 +64,33 @@ describe('LogEntry search strategy', () => {
       .toPromise();
 
     expect(sourcesMock.getSourceConfiguration).toHaveBeenCalled();
-    expect(esSearchStrategyMock.search).toHaveBeenCalled();
+    expect(esSearchStrategyMock.search).toHaveBeenCalledWith(
+      {
+        params: expect.objectContaining({
+          index: 'log-indices-*',
+          body: expect.objectContaining({
+            query: {
+              ids: {
+                values: ['LOG_ENTRY_ID'],
+              },
+            },
+            runtime_mappings: {
+              runtime_field: {
+                type: 'keyword',
+                script: {
+                  lang: 'painless',
+                  source: 'emit("runtime value")',
+                },
+              },
+            },
+          }),
+          terminate_after: 1,
+          track_total_hits: false,
+        }),
+      },
+      expect.anything(),
+      expect.anything()
+    );
     expect(response.id).toEqual(expect.any(String));
     expect(response.isRunning).toBe(true);
   });
@@ -207,7 +236,7 @@ const createSourceConfigurationMock = (): InfraSource => ({
     description: 'SOURCE_DESCRIPTION',
     logIndices: {
       type: 'index_pattern',
-      indexPatternId: 'some-test-id',
+      indexPatternId: 'test-index-pattern',
     },
     metricAlias: 'metric-indices-*',
     inventoryDefaultView: 'DEFAULT_VIEW',
@@ -261,5 +290,33 @@ const createDataPluginMock = (esSearchStrategyMock: ISearchStrategy): any => ({
   search: {
     getSearchStrategy: jest.fn().mockReturnValue(esSearchStrategyMock),
   },
-  indexPatterns: getIndexPatternsMock(),
+  indexPatterns: createIndexPatternsStartMock(0, [
+    createIndexPatternMock({
+      id: 'test-index-pattern',
+      title: 'log-indices-*',
+      timeFieldName: '@timestamp',
+      fields: [
+        {
+          name: 'event.dataset',
+          type: 'string',
+          esTypes: ['keyword'],
+          aggregatable: true,
+          searchable: true,
+        },
+        {
+          name: 'runtime_field',
+          type: 'string',
+          runtimeField: {
+            type: 'keyword',
+            script: {
+              source: 'emit("runtime value")',
+            },
+          },
+          esTypes: ['keyword'],
+          aggregatable: true,
+          searchable: true,
+        },
+      ],
+    }),
+  ]),
 });
diff --git a/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts b/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts
index c35c05d947da07..aa34204b9fb44a 100644
--- a/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts
@@ -78,13 +78,19 @@ export const logEntrySearchStrategyProvider = ({
           concatMap(({ params }) =>
             resolvedSourceConfiguration$.pipe(
               map(
-                ({ indices, timestampField, tiebreakerField }): IEsSearchRequest => ({
+                ({
+                  indices,
+                  timestampField,
+                  tiebreakerField,
+                  runtimeMappings,
+                }): IEsSearchRequest => ({
                   // @ts-expect-error @elastic/elasticsearch declares indices_boost as Record<string, number>
                   params: createGetLogEntryQuery(
                     indices,
                     params.logEntryId,
                     timestampField,
-                    tiebreakerField
+                    tiebreakerField,
+                    runtimeMappings
                   ),
                 })
               )
diff --git a/x-pack/plugins/infra/server/services/log_entries/mocks.ts b/x-pack/plugins/infra/server/services/log_entries/mocks.ts
deleted file mode 100644
index 7c508b98554ecb..00000000000000
--- a/x-pack/plugins/infra/server/services/log_entries/mocks.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { IIndexPattern, IFieldType, IndexPatternsContract } from 'src/plugins/data/common';
-
-const indexPatternFields: IFieldType[] = [
-  {
-    name: 'event.dataset',
-    type: 'string',
-    esTypes: ['keyword'],
-    aggregatable: true,
-    filterable: true,
-    searchable: true,
-  },
-];
-
-const indexPattern: IIndexPattern = {
-  id: '1234',
-  title: 'log-indices-*',
-  timeFieldName: '@timestamp',
-  fields: indexPatternFields,
-};
-
-export const getIndexPatternsMock = (): any => {
-  return {
-    indexPatternsServiceFactory: async () => {
-      return {
-        get: async (id) => indexPattern,
-        getFieldsForWildcard: async (options) => indexPatternFields,
-      } as Pick<IndexPatternsContract, 'get' | 'getFieldsForWildcard'>;
-    },
-  };
-};
diff --git a/x-pack/plugins/infra/server/services/log_entries/queries/log_entries.ts b/x-pack/plugins/infra/server/services/log_entries/queries/log_entries.ts
index 6ae7232d77a177..6df17dbfd7bfdd 100644
--- a/x-pack/plugins/infra/server/services/log_entries/queries/log_entries.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/queries/log_entries.ts
@@ -29,6 +29,7 @@ export const createGetLogEntriesQuery = (
   timestampField: string,
   tiebreakerField: string,
   fields: string[],
+  runtimeMappings?: estypes.RuntimeFields,
   query?: JsonObject,
   highlightTerm?: string
 ): estypes.AsyncSearchSubmitRequest => {
@@ -53,6 +54,7 @@ export const createGetLogEntriesQuery = (
       },
       // @ts-expect-error @elastic/elasticsearch doesn't declare body.fields on AsyncSearchSubmitRequest
       fields,
+      runtime_mappings: runtimeMappings,
       _source: false,
       ...createSortClause(sortDirection, timestampField, tiebreakerField),
       ...createSearchAfterClause(cursor),
diff --git a/x-pack/plugins/infra/server/services/log_entries/queries/log_entry.ts b/x-pack/plugins/infra/server/services/log_entries/queries/log_entry.ts
index 85af8b92fe080c..6bef317d96ada0 100644
--- a/x-pack/plugins/infra/server/services/log_entries/queries/log_entry.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/queries/log_entry.ts
@@ -17,7 +17,8 @@ export const createGetLogEntryQuery = (
   logEntryIndex: string,
   logEntryId: string,
   timestampField: string,
-  tiebreakerField: string
+  tiebreakerField: string,
+  runtimeMappings?: estypes.RuntimeFields
 ): estypes.AsyncSearchSubmitRequest => ({
   index: logEntryIndex,
   terminate_after: 1,
@@ -32,6 +33,7 @@ export const createGetLogEntryQuery = (
     },
     // @ts-expect-error @elastic/elasticsearch doesn't declare body.fields on AsyncSearchSubmitRequest
     fields: ['*'],
+    runtime_mappings: runtimeMappings,
     sort: [{ [timestampField]: 'desc' }, { [tiebreakerField]: 'desc' }],
     _source: false,
   },
diff --git a/x-pack/plugins/lens/public/app_plugin/app.test.tsx b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
index b7dbf1bbe4d87e..87000865850e12 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.test.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { Observable } from 'rxjs';
+import { Observable, Subject } from 'rxjs';
 import { ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { App } from './app';
@@ -77,6 +77,8 @@ function createMockFrame(): jest.Mocked<EditorFrameInstance> {
   };
 }
 
+const sessionIdSubject = new Subject<string>();
+
 function createMockSearchService() {
   let sessionIdCounter = 1;
   return {
@@ -84,6 +86,7 @@ function createMockSearchService() {
       start: jest.fn(() => `sessionId-${sessionIdCounter++}`),
       clear: jest.fn(),
       getSessionId: jest.fn(() => `sessionId-${sessionIdCounter}`),
+      getSession$: jest.fn(() => sessionIdSubject.asObservable()),
     },
   };
 }
@@ -1269,6 +1272,26 @@ describe('Lens App', () => {
       );
     });
 
+    it('updates the query if saved query is selected', () => {
+      const { component } = mountWith({});
+      act(() => {
+        component.find(TopNavMenu).prop('onSavedQueryUpdated')!({
+          id: '2',
+          attributes: {
+            title: 'new title',
+            description: '',
+            query: { query: 'abc:def', language: 'lucene' },
+          },
+        });
+      });
+      expect(TopNavMenu).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { query: 'abc:def', language: 'lucene' },
+        }),
+        {}
+      );
+    });
+
     it('clears all existing unpinned filters when the active saved query is cleared', () => {
       const { component, frame, services } = mountWith({});
       act(() =>
@@ -1328,6 +1351,24 @@ describe('Lens App', () => {
       );
     });
 
+    it('re-renders the frame if session id changes from the outside', async () => {
+      const services = makeDefaultServices();
+      const { frame } = mountWith({ props: undefined, services });
+
+      act(() => {
+        sessionIdSubject.next('new-session-id');
+      });
+      await act(async () => {
+        await new Promise((r) => setTimeout(r, 0));
+      });
+      expect(frame.mount).toHaveBeenCalledWith(
+        expect.any(Element),
+        expect.objectContaining({
+          searchSessionId: `new-session-id`,
+        })
+      );
+    });
+
     it('updates the searchSessionId when the active saved query is cleared', () => {
       const { component, frame, services } = mountWith({});
       act(() =>
diff --git a/x-pack/plugins/lens/public/app_plugin/app.tsx b/x-pack/plugins/lens/public/app_plugin/app.tsx
index 8caa1737c00ada..f137047cfc871c 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.tsx
@@ -14,7 +14,7 @@ import { Toast } from 'kibana/public';
 import { VisualizeFieldContext } from 'src/plugins/ui_actions/public';
 import { Datatable } from 'src/plugins/expressions/public';
 import { EuiBreadcrumb } from '@elastic/eui';
-import { finalize, switchMap, tap } from 'rxjs/operators';
+import { delay, finalize, switchMap, tap } from 'rxjs/operators';
 import { downloadMultipleAs } from '../../../../../src/plugins/share/public';
 import {
   createKbnUrlStateStorage,
@@ -221,11 +221,29 @@ export function App({
       kbnUrlStateStorage
     );
 
+    const sessionSubscription = data.search.session
+      .getSession$()
+      // wait for a tick to filter/timerange subscribers the chance to update the session id in the state
+      .pipe(delay(0))
+      // then update if it didn't get updated yet
+      .subscribe((newSessionId) => {
+        if (newSessionId) {
+          setState((prevState) => {
+            if (prevState.searchSessionId !== newSessionId) {
+              return { ...prevState, searchSessionId: newSessionId };
+            } else {
+              return prevState;
+            }
+          });
+        }
+      });
+
     return () => {
       stopSyncingQueryServiceStateWithUrl();
       filterSubscription.unsubscribe();
       timeSubscription.unsubscribe();
       autoRefreshSubscription.unsubscribe();
+      sessionSubscription.unsubscribe();
     };
   }, [
     data.query.filterManager,
@@ -674,6 +692,7 @@ export function App({
               setState((s) => ({
                 ...s,
                 savedQuery: { ...savedQuery }, // Shallow query for reference issues
+                query: savedQuery.attributes.query,
               }));
             }}
             onClearSavedQuery={() => {
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.scss
index a58b5c21e77242..6629b440758318 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.scss
@@ -1,7 +1,14 @@
+.lnsConfigPanel__addLayerBtnWrapper {
+  padding-bottom: $euiSize;
+}
+
 .lnsConfigPanel__addLayerBtn {
-  color: transparentize($euiColorMediumShade, .3);
-  // Remove EuiButton's default shadow to make button more subtle
-  // sass-lint:disable-block no-important
-  box-shadow: none !important;
-  border-color: $euiColorLightShade;
+  @include kbnThemeStyle('v7') {
+    // sass-lint:disable-block no-important
+    background-color: transparent !important;
+    color: transparentize($euiColorMediumShade, .3) !important;
+    border-color: $euiColorLightShade !important;
+    box-shadow: none !important;
+  }
+
 }
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.tsx
index 393c7363dc03f9..d52fd29e7233a4 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.tsx
@@ -134,7 +134,7 @@ export function LayerPanels(
         ) : null
       )}
       {activeVisualization.appendLayer && visualizationState && (
-        <EuiFlexItem grow={true}>
+        <EuiFlexItem grow={true} className="lnsConfigPanel__addLayerBtnWrapper">
           <EuiToolTip
             className="eui-fullWidth"
             title={i18n.translate('xpack.lens.xyChart.addLayer', {
@@ -154,6 +154,8 @@ export function LayerPanels(
               aria-label={i18n.translate('xpack.lens.xyChart.addLayerButton', {
                 defaultMessage: 'Add layer',
               })}
+              fill
+              color="text"
               onClick={() => {
                 const id = generateId();
                 dispatch({
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.scss
index b3e6f68b0a68c8..b9f233d2b29508 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.scss
@@ -27,6 +27,7 @@
   margin-right: $euiSizeS;
   margin-left: $euiSizeXS / 2;
   margin-bottom: $euiSizeXS / 2;
+  box-shadow: none !important; // sass-lint:disable-line no-important
 
   &:focus {
     @include euiFocusRing;
@@ -40,7 +41,7 @@
 
 .lnsSuggestionPanel__button-isSelected {
   background-color: $euiColorLightestShade !important; // sass-lint:disable-line no-important
-  border-color: $euiColorMediumShade;
+  border-color: $euiColorMediumShade !important; // sass-lint:disable-line no-important
 
   &:not(:focus) {
     box-shadow: none !important; // sass-lint:disable-line no-important
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
index 9284b1dcc273dc..e5acd2a2f47fda 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
@@ -130,6 +130,8 @@ const SuggestionPreview = ({
     <EuiToolTip content={preview.title}>
       <div data-test-subj={`lnsSuggestion-${camelCase(preview.title)}`}>
         <EuiPanel
+          hasBorder
+          hasShadow={false}
           className={classNames('lnsSuggestionPanel__button', {
             // eslint-disable-next-line @typescript-eslint/naming-convention
             'lnsSuggestionPanel__button-isSelected': selected,
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.scss
index 167c17ee6ae9c5..e687e478cd3680 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.scss
@@ -12,6 +12,9 @@
   overflow: visible;
   border: none;
   height: 100%;
+  @include kbnThemeStyle('v7') {
+    border: none !important; // sass-lint:disable-line no-important
+  }
 
   .lnsWorkspacePanelWrapper__pageContentBody {
     @include euiScrollBar;
@@ -34,7 +37,7 @@
   width: 100%;
   height: 100%;
   border: $euiBorderThin;
-  border-radius: $euiBorderRadius;
+  border-radius: $euiBorderRadiusSmall;
 
   &.lnsDragDrop-isDropTarget {
     @include lnsDroppable;
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx
index e6a38ce2bb7130..6c5116436dddb1 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.test.tsx
@@ -9,6 +9,7 @@ import React, { ChangeEvent, ReactElement } from 'react';
 import { createMockedDragDropContext } from './mocks';
 import { dataPluginMock } from '../../../../../src/plugins/data/public/mocks';
 import { InnerIndexPatternDataPanel, IndexPatternDataPanel, MemoizedDataPanel } from './datapanel';
+import { FieldList } from './field_list';
 import { FieldItem } from './field_item';
 import { NoFieldsCallout } from './no_fields_callout';
 import { act } from 'react-dom/test-utils';
@@ -713,6 +714,30 @@ describe('IndexPattern Data Panel', () => {
       expect(wrapper.find(NoFieldsCallout).length).toEqual(2);
     });
 
+    it('should not allow field details when error', () => {
+      const wrapper = mountWithIntl(
+        <InnerIndexPatternDataPanel {...props} existenceFetchFailed={true} />
+      );
+
+      expect(wrapper.find(FieldList).prop('fieldGroups')).toEqual(
+        expect.objectContaining({
+          AvailableFields: expect.objectContaining({ hideDetails: true }),
+        })
+      );
+    });
+
+    it('should allow field details when timeout', () => {
+      const wrapper = mountWithIntl(
+        <InnerIndexPatternDataPanel {...props} existenceFetchTimeout={true} />
+      );
+
+      expect(wrapper.find(FieldList).prop('fieldGroups')).toEqual(
+        expect.objectContaining({
+          AvailableFields: expect.objectContaining({ hideDetails: false }),
+        })
+      );
+    });
+
     it('should filter down by name', () => {
       const wrapper = mountWithIntl(<InnerIndexPatternDataPanel {...props} />);
       act(() => {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
index 2cad77b0034545..9fd389d4e65d3e 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
@@ -230,6 +230,7 @@ export function IndexPatternDataPanel({
           onUpdateIndexPattern={onUpdateIndexPattern}
           existingFields={state.existingFields}
           existenceFetchFailed={state.existenceFetchFailed}
+          existenceFetchTimeout={state.existenceFetchTimeout}
           dropOntoWorkspace={dropOntoWorkspace}
           hasSuggestionForField={hasSuggestionForField}
         />
@@ -271,6 +272,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   indexPatternRefs,
   indexPatterns,
   existenceFetchFailed,
+  existenceFetchTimeout,
   query,
   dateRange,
   filters,
@@ -297,6 +299,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   charts: ChartsPluginSetup;
   indexPatternFieldEditor: IndexPatternFieldEditorStart;
   existenceFetchFailed?: boolean;
+  existenceFetchTimeout?: boolean;
 }) {
   const [localState, setLocalState] = useState<DataPanelState>({
     nameFilter: '',
@@ -314,7 +317,8 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
     (type) => type in fieldTypeNames
   );
 
-  const fieldInfoUnavailable = existenceFetchFailed || currentIndexPattern.hasRestrictions;
+  const fieldInfoUnavailable =
+    existenceFetchFailed || existenceFetchTimeout || currentIndexPattern.hasRestrictions;
 
   const editPermission = indexPatternFieldEditor.userPermissions.editIndexPattern();
 
@@ -389,7 +393,8 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
         }),
         isAffectedByGlobalFilter: !!filters.length,
         isAffectedByTimeFilter: true,
-        hideDetails: fieldInfoUnavailable,
+        // Show details on timeout but not failure
+        hideDetails: fieldInfoUnavailable && !existenceFetchTimeout,
         defaultNoFieldsMessage: i18n.translate('xpack.lens.indexPatterns.noAvailableDataLabel', {
           defaultMessage: `There are no available fields that contain data.`,
         }),
@@ -438,11 +443,12 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
     return fieldGroupDefinitions;
   }, [
     allFields,
-    existingFields,
-    currentIndexPattern,
     hasSyncedExistingFields,
     fieldInfoUnavailable,
     filters.length,
+    existenceFetchTimeout,
+    currentIndexPattern,
+    existingFields,
   ]);
 
   const fieldGroups: FieldGroups = useMemo(() => {
@@ -503,6 +509,8 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
       patterns: [currentIndexPattern.id],
     });
     onUpdateIndexPattern(newlyMappedIndexPattern[currentIndexPattern.id]);
+    // start a new session so all charts are refreshed
+    data.search.session.start();
   }, [data, currentIndexPattern, onUpdateIndexPattern]);
 
   const editField = useMemo(
@@ -792,6 +800,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
             filter={filter}
             currentIndexPatternId={currentIndexPatternId}
             existenceFetchFailed={existenceFetchFailed}
+            existenceFetchTimeout={existenceFetchTimeout}
             existFieldsInIndex={!!allFields.length}
             dropOntoWorkspace={dropOntoWorkspace}
             hasSuggestionForField={hasSuggestionForField}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx
index 1fc755ec489c7d..2c503a7bd69674 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx
@@ -542,7 +542,12 @@ export function DimensionEditor(props: DimensionEditorProps) {
                         [columnId]: {
                           ...selectedColumn,
                           label: value,
-                          customLabel: true,
+                          customLabel:
+                            operationDefinitionMap[selectedColumn.operationType].getDefaultLabel(
+                              selectedColumn,
+                              state.indexPatterns[state.layers[layerId].indexPatternId],
+                              state.layers[layerId].columns
+                            ) !== value,
                         },
                       },
                     },
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
index 7d1644d07d2aa5..5e79fde0fa8fa6 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
@@ -683,6 +683,44 @@ describe('IndexPatternDimensionEditorPanel', () => {
     );
   });
 
+  it('should remove customLabel flag if label is set to default', () => {
+    wrapper = mount(
+      <IndexPatternDimensionEditorComponent
+        {...defaultProps}
+        state={getStateWithColumns({
+          col1: {
+            ...bytesColumn,
+            label: 'Custom label',
+            customLabel: true,
+          },
+        })}
+      />
+    );
+
+    act(() => {
+      wrapper
+        .find('input[data-test-subj="indexPattern-label-edit"]')
+        .simulate('change', { target: { value: 'Maximum of bytes' } });
+    });
+
+    expect(setState).toHaveBeenCalledWith({
+      ...state,
+      layers: {
+        first: {
+          ...state.layers.first,
+          columns: {
+            ...state.layers.first.columns,
+            col1: expect.objectContaining({
+              label: 'Maximum of bytes',
+              customLabel: false,
+              // Other parts of this don't matter for this test
+            }),
+          },
+        },
+      },
+    });
+  });
+
   describe('transient invalid state', () => {
     it('should set the state if selecting an operation incompatible with the current field', () => {
       wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/filtering.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/filtering.tsx
index ae7406e42746a9..65bc23b4eb1cad 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/filtering.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/filtering.tsx
@@ -75,10 +75,10 @@ export function Filtering({
             anchorClassName="eui-fullWidth"
             panelClassName="lnsIndexPatternDimensionEditor__filtersEditor"
             button={
-              <EuiPanel paddingSize="none">
+              <EuiPanel paddingSize="none" hasShadow={false} hasBorder>
                 <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
                   <EuiFlexItem grow={false}>{/* Empty for spacing */}</EuiFlexItem>
-                  <EuiFlexItem grow={false}>
+                  <EuiFlexItem grow={true}>
                     <EuiLink
                       className="lnsFiltersOperation__popoverButton"
                       data-test-subj="indexPattern-filters-existingFilterTrigger"
@@ -96,6 +96,19 @@ export function Filtering({
                         })}
                     </EuiLink>
                   </EuiFlexItem>
+                  <EuiFlexItem grow={false}>
+                    <EuiButtonIcon
+                      data-test-subj="indexPattern-filter-by-remove"
+                      color="danger"
+                      aria-label={i18n.translate('xpack.lens.filterBy.removeLabel', {
+                        defaultMessage: 'Remove filter',
+                      })}
+                      onClick={() => {
+                        updateLayer(setFilter(columnId, layer, undefined));
+                      }}
+                      iconType="cross"
+                    />
+                  </EuiFlexItem>
                 </EuiFlexGroup>
               </EuiPanel>
             }
@@ -112,19 +125,6 @@ export function Filtering({
             />
           </EuiPopover>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiButtonIcon
-            data-test-subj="indexPattern-filter-by-remove"
-            color="danger"
-            aria-label={i18n.translate('xpack.lens.filterBy.removeLabel', {
-              defaultMessage: 'Remove filter',
-            })}
-            onClick={() => {
-              updateLayer(setFilter(columnId, layer, undefined));
-            }}
-            iconType="cross"
-          />
-        </EuiFlexItem>
       </EuiFlexGroup>
     </EuiFormRow>
   );
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/field_item.scss b/x-pack/plugins/lens/public/indexpattern_datasource/field_item.scss
index 19f5b919752028..a652a18752949b 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/field_item.scss
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/field_item.scss
@@ -17,8 +17,14 @@
 
   &:focus,
   &:focus-within,
+  .kbnFieldButton__button:focus:focus-visible,
   &.kbnFieldButton-isActive {
-    animation: none !important; // sass-lint:disable-line no-important
+    @include kbnThemeStyle('v7') {
+      animation: none !important; // sass-lint:disable-line no-important
+    }
+    @include kbnThemeStyle('v8') {
+      outline: none !important; // sass-lint:disable-line no-important
+    }
   }
 
   &:focus .kbnFieldButton__name span,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx
index ceeb1f5b1caf3a..ee0011ad0390cb 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx
@@ -45,6 +45,7 @@ export const FieldList = React.memo(function FieldList({
   exists,
   fieldGroups,
   existenceFetchFailed,
+  existenceFetchTimeout,
   fieldProps,
   hasSyncedExistingFields,
   filter,
@@ -60,6 +61,7 @@ export const FieldList = React.memo(function FieldList({
   fieldProps: FieldItemSharedProps;
   hasSyncedExistingFields: boolean;
   existenceFetchFailed?: boolean;
+  existenceFetchTimeout?: boolean;
   filter: {
     nameFilter: string;
     typeFilter: string[];
@@ -194,6 +196,7 @@ export const FieldList = React.memo(function FieldList({
                   );
                 }}
                 showExistenceFetchError={existenceFetchFailed}
+                showExistenceFetchTimeout={existenceFetchTimeout}
                 renderCallout={
                   <NoFieldsCallout
                     isAffectedByGlobalFilter={fieldGroup.isAffectedByGlobalFilter}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
index a00f25b04651bf..42de7cb328b130 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
@@ -50,6 +50,7 @@ export interface FieldsAccordionProps {
   renderCallout: JSX.Element;
   exists: (field: IndexPatternField) => boolean;
   showExistenceFetchError?: boolean;
+  showExistenceFetchTimeout?: boolean;
   hideDetails?: boolean;
   groupIndex: number;
   dropOntoWorkspace: DatasourceDataPanelProps['dropOntoWorkspace'];
@@ -73,6 +74,7 @@ export const FieldsAccordion = memo(function InnerFieldsAccordion({
   exists,
   hideDetails,
   showExistenceFetchError,
+  showExistenceFetchTimeout,
   groupIndex,
   dropOntoWorkspace,
   hasSuggestionForField,
@@ -133,25 +135,44 @@ export const FieldsAccordion = memo(function InnerFieldsAccordion({
   }, [label, helpTooltip]);
 
   const extraAction = useMemo(() => {
-    return showExistenceFetchError ? (
-      <EuiIconTip
-        aria-label={i18n.translate('xpack.lens.indexPattern.existenceErrorAriaLabel', {
-          defaultMessage: 'Existence fetch failed',
-        })}
-        type="alert"
-        color="warning"
-        content={i18n.translate('xpack.lens.indexPattern.existenceErrorLabel', {
-          defaultMessage: "Field information can't be loaded",
-        })}
-      />
-    ) : hasLoaded ? (
-      <EuiNotificationBadge size="m" color={isFiltered ? 'accent' : 'subdued'}>
-        {fieldsCount}
-      </EuiNotificationBadge>
-    ) : (
-      <EuiLoadingSpinner size="m" />
-    );
-  }, [showExistenceFetchError, hasLoaded, isFiltered, fieldsCount]);
+    if (showExistenceFetchError) {
+      return (
+        <EuiIconTip
+          aria-label={i18n.translate('xpack.lens.indexPattern.existenceErrorAriaLabel', {
+            defaultMessage: 'Existence fetch failed',
+          })}
+          type="alert"
+          color="warning"
+          content={i18n.translate('xpack.lens.indexPattern.existenceErrorLabel', {
+            defaultMessage: "Field information can't be loaded",
+          })}
+        />
+      );
+    }
+    if (showExistenceFetchTimeout) {
+      return (
+        <EuiIconTip
+          aria-label={i18n.translate('xpack.lens.indexPattern.existenceTimeoutAriaLabel', {
+            defaultMessage: 'Existence fetch timed out',
+          })}
+          type="clock"
+          color="warning"
+          content={i18n.translate('xpack.lens.indexPattern.existenceTimeoutLabel', {
+            defaultMessage: 'Field information took too long',
+          })}
+        />
+      );
+    }
+    if (hasLoaded) {
+      return (
+        <EuiNotificationBadge size="m" color={isFiltered ? 'accent' : 'subdued'}>
+          {fieldsCount}
+        </EuiNotificationBadge>
+      );
+    }
+
+    return <EuiLoadingSpinner size="m" />;
+  }, [showExistenceFetchError, showExistenceFetchTimeout, hasLoaded, isFiltered, fieldsCount]);
 
   return (
     <EuiAccordion
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
index c4ebcab85e7227..ccae659934ba78 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
@@ -965,7 +965,19 @@ describe('IndexPattern Data Source suggestions', () => {
             currentLayer: {
               ...initialState.layers.currentLayer,
               columns: {
-                cola: initialState.layers.currentLayer.columns.cola,
+                cola: {
+                  dataType: 'string',
+                  isBucketed: true,
+                  sourceField: 'source',
+                  label: 'values of source',
+                  customLabel: true,
+                  operationType: 'terms',
+                  params: {
+                    orderBy: { type: 'alphabetical', fallback: false },
+                    orderDirection: 'asc',
+                    size: 5,
+                  },
+                },
               },
               columnOrder: ['cola'],
             },
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index a68f8ae310f3e3..d3913728cb64ec 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -17,6 +17,7 @@ import {
   injectReferences,
 } from './loader';
 import { IndexPatternsContract } from '../../../../../src/plugins/data/public';
+import { HttpFetchError } from '../../../../../src/core/public';
 import {
   IndexPatternPersistedState,
   IndexPatternPrivateState,
@@ -877,6 +878,7 @@ describe('loader', () => {
         foo: 'bar',
         isFirstExistenceFetch: false,
         existenceFetchFailed: false,
+        existenceFetchTimeout: false,
         existingFields: {
           '1': { ip1_field_1: true, ip1_field_2: true },
           '2': { ip2_field_1: true, ip2_field_2: true },
@@ -957,6 +959,56 @@ describe('loader', () => {
       }) as IndexPatternPrivateState;
 
       expect(newState.existenceFetchFailed).toEqual(true);
+      expect(newState.existenceFetchTimeout).toEqual(false);
+      expect(newState.existingFields['1']).toEqual({
+        field1: true,
+        field2: true,
+      });
+    });
+
+    it('should set all fields to available and existence error flag if the request times out', async () => {
+      const setState = jest.fn();
+      const fetchJson = (jest.fn((path: string) => {
+        return new Promise((resolve, reject) => {
+          reject(
+            new HttpFetchError(
+              'timeout',
+              'name',
+              ({} as unknown) as Request,
+              ({ status: 408 } as unknown) as Response
+            )
+          );
+        });
+      }) as unknown) as HttpHandler;
+
+      const args = {
+        dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
+        fetchJson,
+        indexPatterns: [
+          {
+            id: '1',
+            title: '1',
+            hasRestrictions: false,
+            fields: [{ name: 'field1' }, { name: 'field2' }] as IndexPatternField[],
+          },
+        ],
+        setState,
+        dslQuery,
+        showNoDataPopover: jest.fn(),
+        currentIndexPatternTitle: 'abc',
+        isFirstExistenceFetch: false,
+      };
+
+      await syncExistingFields(args);
+
+      const [fn] = setState.mock.calls[0];
+      const newState = fn({
+        foo: 'bar',
+        existingFields: {},
+      }) as IndexPatternPrivateState;
+
+      expect(newState.existenceFetchFailed).toEqual(false);
+      expect(newState.existenceFetchTimeout).toEqual(true);
       expect(newState.existingFields['1']).toEqual({
         field1: true,
         field2: true,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
index ec7ef6a37a27af..0eb661e92bb1d9 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
@@ -445,16 +445,18 @@ export async function syncExistingFields({
       ...state,
       isFirstExistenceFetch: false,
       existenceFetchFailed: false,
+      existenceFetchTimeout: false,
       existingFields: emptinessInfo.reduce((acc, info) => {
         acc[info.indexPatternTitle] = booleanMap(info.existingFieldNames);
         return acc;
       }, state.existingFields),
     }));
   } catch (e) {
-    // show all fields as available if fetch failed
+    // show all fields as available if fetch failed or timed out
     setState((state) => ({
       ...state,
-      existenceFetchFailed: true,
+      existenceFetchFailed: e.res?.status !== 408,
+      existenceFetchTimeout: e.res?.status === 408,
       existingFields: indexPatterns.reduce((acc, pattern) => {
         acc[pattern.title] = booleanMap(pattern.fields.map((field) => field.name));
         return acc;
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
index 0b63dc6ece9747..37bd64251ed814 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
@@ -179,7 +179,7 @@ interface BaseOperationDefinitionProps<C extends BaseIndexPatternColumn> {
     columns: Record<string, IndexPatternColumn>
   ) => string;
   /**
-   * This function is called if another column in the same layer changed or got removed.
+   * This function is called if another column in the same layer changed or got added/removed.
    * Can be used to update references to other columns (e.g. for sorting).
    * Based on the current column and the other updated columns, this function has to
    * return an updated column. If not implemented, the `id` function is used instead.
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/shared_components/buckets.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/shared_components/buckets.tsx
index 38666185eda0e6..b2cfc0e5a7c2cf 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/shared_components/buckets.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/shared_components/buckets.tsx
@@ -51,7 +51,7 @@ const BucketContainer = ({
   isNotRemovable,
 }: BucketContainerProps) => {
   return (
-    <EuiPanel paddingSize="none" data-test-subj={dataTestSubj}>
+    <EuiPanel paddingSize="none" data-test-subj={dataTestSubj} hasShadow={false} hasBorder>
       <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
         <EuiFlexItem grow={false}>{/* Empty for spacing */}</EuiFlexItem>
         <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/index.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/index.tsx
index 857e8b3605cfc5..d226fe6f2a7452 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/index.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/index.tsx
@@ -57,7 +57,9 @@ export interface TermsIndexPatternColumn extends FieldBasedIndexPatternColumn {
   operationType: 'terms';
   params: {
     size: number;
-    orderBy: { type: 'alphabetical' } | { type: 'column'; columnId: string };
+    // if order is alphabetical, the `fallback` flag indicates whether it became alphabetical because there wasn't
+    // another option or whether the user explicitly chose to make it alphabetical.
+    orderBy: { type: 'alphabetical'; fallback?: boolean } | { type: 'column'; columnId: string };
     orderDirection: 'asc' | 'desc';
     otherBucket?: boolean;
     missingBucket?: boolean;
@@ -123,7 +125,7 @@ export const termsOperation: OperationDefinition<TermsIndexPatternColumn, 'field
               type: 'column',
               columnId: existingMetricColumn,
             }
-          : { type: 'alphabetical' },
+          : { type: 'alphabetical', fallback: true },
         orderDirection: existingMetricColumn ? 'desc' : 'asc',
         otherBucket: !indexPattern.hasRestrictions,
         missingBucket: false,
@@ -168,16 +170,29 @@ export const termsOperation: OperationDefinition<TermsIndexPatternColumn, 'field
   onOtherColumnChanged: (layer, thisColumnId, changedColumnId) => {
     const columns = layer.columns;
     const currentColumn = columns[thisColumnId] as TermsIndexPatternColumn;
-    if (currentColumn.params.orderBy.type === 'column') {
+    if (currentColumn.params.orderBy.type === 'column' || currentColumn.params.orderBy.fallback) {
       // check whether the column is still there and still a metric
-      const columnSortedBy = columns[currentColumn.params.orderBy.columnId];
-      if (!columnSortedBy || !isSortableByColumn(layer, changedColumnId)) {
+      const columnSortedBy =
+        currentColumn.params.orderBy.type === 'column'
+          ? columns[currentColumn.params.orderBy.columnId]
+          : undefined;
+      if (
+        !columnSortedBy ||
+        (currentColumn.params.orderBy.type === 'column' &&
+          !isSortableByColumn(layer, currentColumn.params.orderBy.columnId))
+      ) {
+        // check whether we can find another metric column to sort by
+        const existingMetricColumn = Object.entries(layer.columns)
+          .filter(([columnId]) => isSortableByColumn(layer, columnId))
+          .map(([id]) => id)[0];
         return {
           ...currentColumn,
           params: {
             ...currentColumn.params,
-            orderBy: { type: 'alphabetical' },
-            orderDirection: 'asc',
+            orderBy: existingMetricColumn
+              ? { type: 'column', columnId: existingMetricColumn }
+              : { type: 'alphabetical', fallback: true },
+            orderDirection: existingMetricColumn ? 'desc' : 'asc',
           },
         };
       }
@@ -197,7 +212,7 @@ export const termsOperation: OperationDefinition<TermsIndexPatternColumn, 'field
 
     function fromValue(value: string): TermsIndexPatternColumn['params']['orderBy'] {
       if (value === 'alphabetical') {
-        return { type: 'alphabetical' };
+        return { type: 'alphabetical', fallback: false };
       }
       const parts = value.split(SEPARATOR);
       return {
@@ -271,16 +286,23 @@ export const termsOperation: OperationDefinition<TermsIndexPatternColumn, 'field
             data-test-subj="indexPattern-terms-orderBy"
             options={orderOptions}
             value={toValue(currentColumn.params.orderBy)}
-            onChange={(e: React.ChangeEvent<HTMLSelectElement>) =>
+            onChange={(e: React.ChangeEvent<HTMLSelectElement>) => {
+              const newOrderByValue = fromValue(e.target.value);
+              const updatedLayer = updateColumnParam({
+                layer,
+                columnId,
+                paramName: 'orderBy',
+                value: newOrderByValue,
+              });
               updateLayer(
                 updateColumnParam({
-                  layer,
+                  layer: updatedLayer,
                   columnId,
-                  paramName: 'orderBy',
-                  value: fromValue(e.target.value),
+                  paramName: 'orderDirection',
+                  value: newOrderByValue.type === 'alphabetical' ? 'asc' : 'desc',
                 })
-              )
-            }
+              );
+            }}
             aria-label={i18n.translate('xpack.lens.indexPattern.terms.orderBy', {
               defaultMessage: 'Rank by',
             })}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/terms.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/terms.test.tsx
index f75bec141ccaeb..2e7307f6a2ec4a 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/terms.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/terms/terms.test.tsx
@@ -358,7 +358,7 @@ describe('terms', () => {
         },
       });
       expect(termsColumn.params).toEqual(
-        expect.objectContaining({ orderBy: { type: 'alphabetical' } })
+        expect.objectContaining({ orderBy: { type: 'alphabetical', fallback: true } })
       );
     });
 
@@ -469,7 +469,7 @@ describe('terms', () => {
       );
       expect(updatedColumn.params).toEqual(
         expect.objectContaining({
-          orderBy: { type: 'alphabetical' },
+          orderBy: { type: 'alphabetical', fallback: true },
         })
       );
     });
@@ -516,7 +516,7 @@ describe('terms', () => {
       );
       expect(updatedColumn.params).toEqual(
         expect.objectContaining({
-          orderBy: { type: 'alphabetical' },
+          orderBy: { type: 'alphabetical', fallback: true },
         })
       );
     });
@@ -548,7 +548,7 @@ describe('terms', () => {
       );
       expect(termsColumn.params).toEqual(
         expect.objectContaining({
-          orderBy: { type: 'alphabetical' },
+          orderBy: { type: 'alphabetical', fallback: true },
         })
       );
     });
@@ -592,7 +592,81 @@ describe('terms', () => {
       );
       expect(termsColumn.params).toEqual(
         expect.objectContaining({
-          orderBy: { type: 'alphabetical' },
+          orderBy: { type: 'alphabetical', fallback: true },
+        })
+      );
+    });
+
+    it('should set order to ascending if falling back to alphabetical', () => {
+      const termsColumn = termsOperation.onOtherColumnChanged!(
+        {
+          columns: {
+            col2: {
+              label: 'Top value of category',
+              dataType: 'string',
+              isBucketed: true,
+
+              // Private
+              operationType: 'terms',
+              params: {
+                orderBy: { type: 'column', columnId: 'col1' },
+                size: 3,
+                orderDirection: 'desc',
+              },
+              sourceField: 'category',
+            },
+          },
+          columnOrder: [],
+          indexPatternId: '',
+        },
+        'col2',
+        'col1'
+      );
+      expect(termsColumn.params).toEqual(
+        expect.objectContaining({
+          orderDirection: 'asc',
+        })
+      );
+    });
+
+    it('should switch back to descending metric sorting if alphabetical sorting was applied as fallback', () => {
+      const initialColumn: TermsIndexPatternColumn = {
+        label: 'Top value of category',
+        dataType: 'string',
+        isBucketed: true,
+
+        // Private
+        operationType: 'terms',
+        params: {
+          orderBy: { type: 'alphabetical', fallback: true },
+          size: 3,
+          orderDirection: 'asc',
+        },
+        sourceField: 'category',
+      };
+      const updatedColumn = termsOperation.onOtherColumnChanged!(
+        {
+          indexPatternId: '',
+          columnOrder: [],
+          columns: {
+            col2: initialColumn,
+            col1: {
+              label: 'Count',
+              dataType: 'number',
+              isBucketed: false,
+              sourceField: 'Records',
+              operationType: 'count',
+            },
+          },
+        },
+        'col2',
+        'col1'
+      );
+
+      expect(updatedColumn.params).toEqual(
+        expect.objectContaining({
+          orderBy: { type: 'column', columnId: 'col1' },
+          orderDirection: 'desc',
         })
       );
     });
@@ -774,6 +848,7 @@ describe('terms', () => {
                 type: 'column',
                 columnId: 'col2',
               },
+              orderDirection: 'desc',
             },
           },
         },
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.test.ts
index 34e2eb2c901228..d3ca70c086cb54 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.test.ts
@@ -352,6 +352,50 @@ describe('state_helpers', () => {
       ).toEqual(expect.objectContaining({ columnOrder: ['col1', 'col2'] }));
     });
 
+    it('should call onOtherColumn changed on existing columns', () => {
+      expect(
+        insertNewColumn({
+          layer: {
+            indexPatternId: '1',
+            columnOrder: ['col1'],
+            columns: {
+              col1: {
+                label: 'Top values of source',
+                dataType: 'string',
+                isBucketed: true,
+
+                // Private
+                operationType: 'terms',
+                sourceField: 'source',
+                params: {
+                  orderBy: { type: 'alphabetical', fallback: true },
+                  orderDirection: 'asc',
+                  size: 5,
+                },
+              },
+            },
+          },
+          columnId: 'col2',
+          indexPattern,
+          op: 'sum',
+          field: indexPattern.fields[2],
+          visualizationGroups: [],
+        })
+      ).toEqual(
+        expect.objectContaining({
+          columns: expect.objectContaining({
+            col1: expect.objectContaining({
+              params: {
+                orderBy: { columnId: 'col2', type: 'column' },
+                orderDirection: 'desc',
+                size: 5,
+              },
+            }),
+          }),
+        })
+      );
+    });
+
     it('should allow multiple metrics', () => {
       expect(
         insertNewColumn({
@@ -908,7 +952,11 @@ describe('state_helpers', () => {
           columns: {
             col1: {
               ...termsColumn,
-              params: { orderBy: { type: 'alphabetical' }, orderDirection: 'asc', size: 5 },
+              params: {
+                orderBy: { type: 'alphabetical', fallback: true },
+                orderDirection: 'asc',
+                size: 5,
+              },
             },
             id1: expect.objectContaining({
               dataType: 'number',
@@ -1624,7 +1672,7 @@ describe('state_helpers', () => {
             ...termsColumn,
             params: {
               ...termsColumn.params,
-              orderBy: { type: 'alphabetical' },
+              orderBy: { type: 'alphabetical', fallback: true },
               orderDirection: 'asc',
             },
           },
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.ts
index 1661e5de8248ea..bbe2ca4cd3d619 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/layer_helpers.ts
@@ -714,7 +714,11 @@ function addBucket(
     columns: { ...layer.columns, [addedColumnId]: column },
     columnOrder: updatedColumnOrder,
   };
-  return { ...tempLayer, columnOrder: getColumnOrder(tempLayer) };
+  return {
+    ...tempLayer,
+    columns: adjustColumnReferencesForChangedColumn(tempLayer, addedColumnId),
+    columnOrder: getColumnOrder(tempLayer),
+  };
 }
 
 export function reorderByGroups(
@@ -766,7 +770,11 @@ function addMetric(
       [addedColumnId]: column,
     },
   };
-  return { ...tempLayer, columnOrder: getColumnOrder(tempLayer) };
+  return {
+    ...tempLayer,
+    columnOrder: getColumnOrder(tempLayer),
+    columns: adjustColumnReferencesForChangedColumn(tempLayer, addedColumnId),
+  };
 }
 
 export function getMetricOperationTypes(field: IndexPatternField) {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
index 18f653c588ee83..98dc767c44c7dd 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
@@ -87,6 +87,7 @@ export interface IndexPatternPrivateState {
   existingFields: Record<string, Record<string, boolean>>;
   isFirstExistenceFetch: boolean;
   existenceFetchFailed?: boolean;
+  existenceFetchTimeout?: boolean;
 }
 
 export interface IndexPatternRef {
diff --git a/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx b/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx
index 2487ddf32cd1f9..e1dbd4da4b902d 100644
--- a/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx
@@ -822,6 +822,59 @@ describe('xy_expression', () => {
       });
     });
 
+    test('returns correct original data for ordinal x axis with special formatter', () => {
+      const geometry: GeometryValue = { x: 'BAR', y: 1, accessor: 'y1', mark: null, datum: {} };
+      const series = {
+        key: 'spec{d}yAccessor{d}splitAccessors{b-2}',
+        specId: 'd',
+        yAccessor: 'a',
+        splitAccessors: {},
+        seriesKeys: ['a'],
+      };
+
+      const { args, data } = sampleArgs();
+
+      convertSpy.mockImplementation((x) => (typeof x === 'string' ? x.toUpperCase() : x));
+
+      const wrapper = mountWithIntl(
+        <XYChart
+          {...defaultProps}
+          data={data}
+          args={{
+            ...args,
+            layers: [
+              {
+                layerId: 'first',
+                seriesType: 'line',
+                xAccessor: 'd',
+                accessors: ['a', 'b'],
+                columnToLabel: '{"a": "Label A", "b": "Label B", "d": "Label D"}',
+                xScaleType: 'ordinal',
+                yScaleType: 'linear',
+                isHistogram: false,
+                palette: mockPaletteOutput,
+              },
+            ],
+          }}
+        />
+      );
+
+      wrapper.find(Settings).first().prop('onElementClick')!([
+        [geometry, series as XYChartSeriesIdentifier],
+      ]);
+
+      expect(onClickValue).toHaveBeenCalledWith({
+        data: [
+          {
+            column: 3,
+            row: 1,
+            table: data.tables.first,
+            value: 'Bar',
+          },
+        ],
+      });
+    });
+
     test('onElementClick is not triggering event on noInteractivity mode', () => {
       const { args, data } = sampleArgs();
 
diff --git a/x-pack/plugins/lens/public/xy_visualization/expression.tsx b/x-pack/plugins/lens/public/xy_visualization/expression.tsx
index a78d86b3f864cd..47b8dbfc15f532 100644
--- a/x-pack/plugins/lens/public/xy_visualization/expression.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/expression.tsx
@@ -456,19 +456,27 @@ export function XYChart({
 
     const table = data.tables[layer.layerId];
 
+    const xColumn = table.columns.find((col) => col.id === layer.xAccessor);
+    const currentXFormatter =
+      layer.xAccessor && layersAlreadyFormatted[layer.xAccessor] && xColumn
+        ? formatFactory(xColumn.meta.params)
+        : xAxisFormatter;
+
+    const rowIndex = table.rows.findIndex((row) => {
+      if (layer.xAccessor) {
+        if (layersAlreadyFormatted[layer.xAccessor]) {
+          // stringify the value to compare with the chart value
+          return currentXFormatter.convert(row[layer.xAccessor]) === xyGeometry.x;
+        }
+        return row[layer.xAccessor] === xyGeometry.x;
+      }
+    });
+
     const points = [
       {
-        row: table.rows.findIndex((row) => {
-          if (layer.xAccessor) {
-            if (layersAlreadyFormatted[layer.xAccessor]) {
-              // stringify the value to compare with the chart value
-              return xAxisFormatter.convert(row[layer.xAccessor]) === xyGeometry.x;
-            }
-            return row[layer.xAccessor] === xyGeometry.x;
-          }
-        }),
+        row: rowIndex,
         column: table.columns.findIndex((col) => col.id === layer.xAccessor),
-        value: xyGeometry.x,
+        value: layer.xAccessor ? table.rows[rowIndex][layer.xAccessor] : xyGeometry.x,
       },
     ];
 
@@ -626,7 +634,11 @@ export function XYChart({
               const newRow = { ...row };
               for (const column of table.columns) {
                 const record = newRow[column.id];
-                if (record && !isPrimitive(record)) {
+                if (
+                  record &&
+                  // pre-format values for ordinal x axes because there can only be a single x axis formatter on chart level
+                  (!isPrimitive(record) || (column.id === xAccessor && xScaleType === 'ordinal'))
+                ) {
                   newRow[column.id] = formatFactory(column.meta.params).convert(record);
                 }
               }
diff --git a/x-pack/plugins/lens/server/routes/existing_fields.ts b/x-pack/plugins/lens/server/routes/existing_fields.ts
index 2e6d6128352315..d775113d83ff7b 100644
--- a/x-pack/plugins/lens/server/routes/existing_fields.ts
+++ b/x-pack/plugins/lens/server/routes/existing_fields.ts
@@ -68,8 +68,15 @@ export async function existingFieldsRoute(setup: CoreSetup<PluginStartContract>,
           }),
         });
       } catch (e) {
+        if (e instanceof errors.TimeoutError) {
+          logger.info(`Field existence check timed out on ${req.params.indexPatternId}`);
+          // 408 is Request Timeout
+          return res.customError({ statusCode: 408, body: e.message });
+        }
         logger.info(
-          `Field existence check failed: ${isBoomError(e) ? e.output.payload.message : e.message}`
+          `Field existence check failed on ${req.params.indexPatternId}: ${
+            isBoomError(e) ? e.output.payload.message : e.message
+          }`
         );
         if (e instanceof errors.ResponseError && e.statusCode === 404) {
           return res.notFound({ body: e.message });
@@ -182,31 +189,44 @@ async function fetchIndexPatternStats({
 
   const scriptedFields = fields.filter((f) => f.isScript);
   const runtimeFields = fields.filter((f) => f.runtimeField);
-  const { body: result } = await client.search({
-    index,
-    body: {
-      size: SAMPLE_SIZE,
-      query,
-      sort: timeFieldName && fromDate && toDate ? [{ [timeFieldName]: 'desc' }] : [],
-      fields: ['*'],
-      _source: false,
-      runtime_mappings: runtimeFields.reduce((acc, field) => {
-        if (!field.runtimeField) return acc;
-        // @ts-expect-error @elastic/elasticsearch StoredScript.language is required
-        acc[field.name] = field.runtimeField;
-        return acc;
-      }, {} as Record<string, estypes.RuntimeField>),
-      script_fields: scriptedFields.reduce((acc, field) => {
-        acc[field.name] = {
-          script: {
-            lang: field.lang!,
-            source: field.script!,
-          },
-        };
-        return acc;
-      }, {} as Record<string, estypes.ScriptField>),
+  const { body: result } = await client.search(
+    {
+      index,
+      body: {
+        size: SAMPLE_SIZE,
+        query,
+        // Sorted queries are usually able to skip entire shards that don't match
+        sort: timeFieldName && fromDate && toDate ? [{ [timeFieldName]: 'desc' }] : [],
+        fields: ['*'],
+        _source: false,
+        runtime_mappings: runtimeFields.reduce((acc, field) => {
+          if (!field.runtimeField) return acc;
+          // @ts-expect-error @elastic/elasticsearch StoredScript.language is required
+          acc[field.name] = field.runtimeField;
+          return acc;
+        }, {} as Record<string, estypes.RuntimeField>),
+        script_fields: scriptedFields.reduce((acc, field) => {
+          acc[field.name] = {
+            script: {
+              lang: field.lang!,
+              source: field.script!,
+            },
+          };
+          return acc;
+        }, {} as Record<string, estypes.ScriptField>),
+        // Small improvement because there is overhead in counting
+        track_total_hits: false,
+        // Per-shard timeout, must be lower than overall. Shards return partial results on timeout
+        timeout: '4500ms',
+      },
     },
-  });
+    {
+      // Global request timeout. Will cancel the request if exceeded. Overrides the elasticsearch.requestTimeout
+      requestTimeout: '5000ms',
+      // Fails fast instead of retrying- default is to retry
+      maxRetries: 0,
+    }
+  );
   return result.hits.hits;
 }
 
diff --git a/x-pack/plugins/license_api_guard/READM.md b/x-pack/plugins/license_api_guard/READM.md
deleted file mode 100644
index 767223125b12c3..00000000000000
--- a/x-pack/plugins/license_api_guard/READM.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# License API guard plugin
-
-This plugin is used by ES UI plugins to reject API requests to plugins that are unsupported by the user's license.
\ No newline at end of file
diff --git a/x-pack/plugins/license_api_guard/README.md b/x-pack/plugins/license_api_guard/README.md
new file mode 100644
index 00000000000000..bf2a9fdff71221
--- /dev/null
+++ b/x-pack/plugins/license_api_guard/README.md
@@ -0,0 +1,3 @@
+# License API guard plugin
+
+This plugin is used by ES UI plugins to reject API requests when the plugin is unsupported by the user's license.
\ No newline at end of file
diff --git a/x-pack/plugins/license_api_guard/server/license.test.ts b/x-pack/plugins/license_api_guard/server/license.test.ts
index e9da393f534786..400af7261ff871 100644
--- a/x-pack/plugins/license_api_guard/server/license.test.ts
+++ b/x-pack/plugins/license_api_guard/server/license.test.ts
@@ -6,18 +6,38 @@
  */
 
 import { of } from 'rxjs';
-import type { KibanaRequest, RequestHandlerContext } from 'src/core/server';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { httpServerMock } from 'src/core/server/http/http_server.mocks';
-
+import type { Logger, KibanaRequest, RequestHandlerContext } from 'src/core/server';
+import { httpServerMock } from 'src/core/server/mocks';
 import { License } from './license';
-import { LicenseCheckState, licensingMock } from './shared_imports';
+import { LicenseCheckState, licensingMock, LicenseType } from './shared_imports';
 
 describe('License API guard', () => {
   const pluginName = 'testPlugin';
-  const currentLicenseType = 'basic';
 
-  const testRoute = ({ licenseState }: { licenseState: string }) => {
+  const mockLicensingService = ({
+    licenseType,
+    licenseState,
+  }: {
+    licenseType: LicenseType;
+    licenseState: LicenseCheckState;
+  }) => {
+    const licenseMock = licensingMock.createLicenseMock();
+    licenseMock.type = licenseType;
+    licenseMock.check('test', 'gold'); // Flush default mocked state
+    licenseMock.check.mockReturnValue({ state: licenseState }); // Replace with new mocked state
+
+    return {
+      license$: of(licenseMock),
+    };
+  };
+
+  const testRoute = ({
+    licenseType,
+    licenseState,
+  }: {
+    licenseType: LicenseType;
+    licenseState: LicenseCheckState;
+  }) => {
     const license = new License();
 
     const logger = {
@@ -25,19 +45,11 @@ describe('License API guard', () => {
     };
 
     license.setup({ pluginName, logger });
-
-    const licenseMock = licensingMock.createLicenseMock();
-    licenseMock.type = currentLicenseType;
-    licenseMock.check('test', 'basic'); // Flush default mocked state
-    licenseMock.check.mockReturnValue({ state: licenseState as LicenseCheckState }); // Replace with new mocked state
-
-    const licensing = {
-      license$: of(licenseMock),
-    };
+    const licensing = mockLicensingService({ licenseType, licenseState });
 
     license.start({
       pluginId: 'id',
-      minimumLicenseType: 'basic',
+      minimumLicenseType: 'gold',
       licensing,
     });
 
@@ -61,44 +73,67 @@ describe('License API guard', () => {
     };
   };
 
-  describe('valid license', () => {
-    it('the original route is called and nothing is logged', () => {
-      const { errorResponse, logMesssage, route } = testRoute({ licenseState: 'valid' });
-
-      expect(errorResponse).toBeUndefined();
-      expect(logMesssage).toBeUndefined();
-      expect(route).toHaveBeenCalled();
+  describe('basic minimum license', () => {
+    it('is rejected', () => {
+      const license = new License();
+      license.setup({ pluginName, logger: {} as Logger });
+      expect(() => {
+        license.start({
+          pluginId: pluginName,
+          minimumLicenseType: 'basic',
+          licensing: mockLicensingService({ licenseType: 'gold', licenseState: 'valid' }),
+        });
+      }).toThrowError(
+        `Basic licenses don't restrict the use of plugins. Please don't use license_api_guard in the ${pluginName} plugin, or provide a more restrictive minimumLicenseType.`
+      );
     });
   });
 
-  [
-    {
-      licenseState: 'invalid',
-      expectedMessage: `Your ${currentLicenseType} license does not support ${pluginName}. Please upgrade your license.`,
-    },
-    {
-      licenseState: 'expired',
-      expectedMessage: `You cannot use ${pluginName} because your ${currentLicenseType} license has expired.`,
-    },
-    {
-      licenseState: 'unavailable',
-      expectedMessage: `You cannot use ${pluginName} because license information is not available at this time.`,
-    },
-  ].forEach(({ licenseState, expectedMessage }) => {
-    describe(`${licenseState} license`, () => {
-      it('replies with and logs the error message', () => {
-        const { errorResponse, logMesssage, route } = testRoute({ licenseState });
-
-        // We depend on the call to `response.forbidden()` to generate the 403 status code,
-        // so we can't assert for it here.
-        expect(errorResponse).toEqual({
-          body: {
-            message: expectedMessage,
-          },
+  describe('non-basic minimum license', () => {
+    const licenseType = 'gold';
+
+    describe('when valid', () => {
+      it('the original route is called and nothing is logged', () => {
+        const { errorResponse, logMesssage, route } = testRoute({
+          licenseType,
+          licenseState: 'valid',
         });
 
-        expect(logMesssage).toBe(expectedMessage);
-        expect(route).not.toHaveBeenCalled();
+        expect(errorResponse).toBeUndefined();
+        expect(logMesssage).toBeUndefined();
+        expect(route).toHaveBeenCalled();
+      });
+    });
+
+    [
+      {
+        licenseState: 'invalid' as LicenseCheckState,
+        expectedMessage: `Your ${licenseType} license does not support ${pluginName}. Please upgrade your license.`,
+      },
+      {
+        licenseState: 'expired' as LicenseCheckState,
+        expectedMessage: `You cannot use ${pluginName} because your ${licenseType} license has expired.`,
+      },
+      {
+        licenseState: 'unavailable' as LicenseCheckState,
+        expectedMessage: `You cannot use ${pluginName} because license information is not available at this time.`,
+      },
+    ].forEach(({ licenseState, expectedMessage }) => {
+      describe(`when ${licenseState}`, () => {
+        it('replies with and logs the error message', () => {
+          const { errorResponse, logMesssage, route } = testRoute({ licenseType, licenseState });
+
+          // We depend on the call to `response.forbidden()` to generate the 403 status code,
+          // so we can't assert for it here.
+          expect(errorResponse).toEqual({
+            body: {
+              message: expectedMessage,
+            },
+          });
+
+          expect(logMesssage).toBe(expectedMessage);
+          expect(route).not.toHaveBeenCalled();
+        });
       });
     });
   });
diff --git a/x-pack/plugins/license_api_guard/server/license.ts b/x-pack/plugins/license_api_guard/server/license.ts
index 3b0fbc8422d637..66e47f02b6e289 100644
--- a/x-pack/plugins/license_api_guard/server/license.ts
+++ b/x-pack/plugins/license_api_guard/server/license.ts
@@ -44,6 +44,12 @@ export class License {
   }
 
   start({ pluginId, minimumLicenseType, licensing }: StartSettings) {
+    if (minimumLicenseType === 'basic') {
+      throw Error(
+        `Basic licenses don't restrict the use of plugins. Please don't use license_api_guard in the ${pluginId} plugin, or provide a more restrictive minimumLicenseType.`
+      );
+    }
+
     licensing.license$.subscribe((license: ILicense) => {
       this.licenseType = license.type;
       this.licenseCheckState = license.check(pluginId, minimumLicenseType!).state;
diff --git a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts
index 2915eaec8ac776..50043772af95bb 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts
@@ -167,12 +167,6 @@ export class AbstractESSource extends AbstractVectorSource implements IESSource
     const abortController = new AbortController();
     registerCancelCallback(() => abortController.abort());
 
-    const requestResponder = this.getInspectorAdapters()?.requests?.start(requestName, {
-      id: requestId,
-      description: requestDescription,
-      searchSessionId,
-    });
-
     let resp;
     try {
       resp = await searchSource
@@ -180,7 +174,12 @@ export class AbstractESSource extends AbstractVectorSource implements IESSource
           abortSignal: abortController.signal,
           sessionId: searchSessionId,
           legacyHitsTotal: false,
-          requestResponder,
+          inspector: {
+            adapter: this.getInspectorAdapters()?.requests,
+            id: requestId,
+            title: requestName,
+            description: requestDescription,
+          },
         })
         .toPromise();
     } catch (error) {
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/__snapshots__/view.test.js.snap b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/__snapshots__/view.test.js.snap
index beacaaecbf7f80..fbd83ed145a088 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/__snapshots__/view.test.js.snap
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/__snapshots__/view.test.js.snap
@@ -26,6 +26,7 @@ exports[`LayerTOC props isReadOnly 1`] = `
     layer={
       Object {
         "getId": [Function],
+        "supportsFitToBounds": [Function],
       }
     }
   />
@@ -34,6 +35,7 @@ exports[`LayerTOC props isReadOnly 1`] = `
     layer={
       Object {
         "getId": [Function],
+        "supportsFitToBounds": [Function],
       }
     }
   />
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/__snapshots__/view.test.js.snap b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/__snapshots__/view.test.js.snap
index f711549d873161..b43d740e729075 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/__snapshots__/view.test.js.snap
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/__snapshots__/view.test.js.snap
@@ -25,10 +25,17 @@ exports[`TOCEntry is rendered 1`] = `
           "showAtZoomLevel": [Function],
         }
       }
+      supportsFitToBounds={false}
     />
     <div
       className="mapTocEntry__layerIcons"
     >
+      <EuiButtonIcon
+        aria-label="Hide layer"
+        iconType="eyeClosed"
+        onClick={[Function]}
+        title="Hide layer"
+      />
       <EuiButtonIcon
         aria-label="Edit layer"
         iconType="pencil"
@@ -38,7 +45,6 @@ exports[`TOCEntry is rendered 1`] = `
       <EuiButtonIcon
         aria-label="Reorder layer"
         className="mapTocEntry__grab"
-        color="subdued"
         iconType="grab"
         title="Reorder layer"
       />
@@ -88,10 +94,17 @@ exports[`TOCEntry props Should shade background when not selected layer 1`] = `
           "showAtZoomLevel": [Function],
         }
       }
+      supportsFitToBounds={false}
     />
     <div
       className="mapTocEntry__layerIcons"
     >
+      <EuiButtonIcon
+        aria-label="Hide layer"
+        iconType="eyeClosed"
+        onClick={[Function]}
+        title="Hide layer"
+      />
       <EuiButtonIcon
         aria-label="Edit layer"
         iconType="pencil"
@@ -101,7 +114,6 @@ exports[`TOCEntry props Should shade background when not selected layer 1`] = `
       <EuiButtonIcon
         aria-label="Reorder layer"
         className="mapTocEntry__grab"
-        color="subdued"
         iconType="grab"
         title="Reorder layer"
       />
@@ -151,10 +163,17 @@ exports[`TOCEntry props Should shade background when selected layer 1`] = `
           "showAtZoomLevel": [Function],
         }
       }
+      supportsFitToBounds={false}
     />
     <div
       className="mapTocEntry__layerIcons"
     >
+      <EuiButtonIcon
+        aria-label="Hide layer"
+        iconType="eyeClosed"
+        onClick={[Function]}
+        title="Hide layer"
+      />
       <EuiButtonIcon
         aria-label="Edit layer"
         iconType="pencil"
@@ -164,7 +183,6 @@ exports[`TOCEntry props Should shade background when selected layer 1`] = `
       <EuiButtonIcon
         aria-label="Reorder layer"
         className="mapTocEntry__grab"
-        color="subdued"
         iconType="grab"
         title="Reorder layer"
       />
@@ -214,7 +232,18 @@ exports[`TOCEntry props isReadOnly 1`] = `
           "showAtZoomLevel": [Function],
         }
       }
+      supportsFitToBounds={false}
     />
+    <div
+      className="mapTocEntry__layerIcons"
+    >
+      <EuiButtonIcon
+        aria-label="Hide layer"
+        iconType="eyeClosed"
+        onClick={[Function]}
+        title="Hide layer"
+      />
+    </div>
   </div>
   <span
     className="mapTocEntry__detailsToggle"
@@ -260,10 +289,17 @@ exports[`TOCEntry props should display layer details when isLegendDetailsOpen is
           "showAtZoomLevel": [Function],
         }
       }
+      supportsFitToBounds={false}
     />
     <div
       className="mapTocEntry__layerIcons"
     >
+      <EuiButtonIcon
+        aria-label="Hide layer"
+        iconType="eyeClosed"
+        onClick={[Function]}
+        title="Hide layer"
+      />
       <EuiButtonIcon
         aria-label="Edit layer"
         iconType="pencil"
@@ -273,7 +309,6 @@ exports[`TOCEntry props should display layer details when isLegendDetailsOpen is
       <EuiButtonIcon
         aria-label="Reorder layer"
         className="mapTocEntry__grab"
-        color="subdued"
         iconType="grab"
         title="Reorder layer"
       />
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/action_labels.ts b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/action_labels.ts
new file mode 100644
index 00000000000000..74d4b205bfdf2a
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/action_labels.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export function getVisibilityToggleIcon(isVisible: boolean) {
+  return isVisible ? 'eyeClosed' : 'eye';
+}
+
+export function getVisibilityToggleLabel(isVisible: boolean) {
+  return isVisible
+    ? i18n.translate('xpack.maps.layerTocActions.hideLayerTitle', {
+        defaultMessage: 'Hide layer',
+      })
+    : i18n.translate('xpack.maps.layerTocActions.showLayerTitle', {
+        defaultMessage: 'Show layer',
+      });
+}
+
+export const EDIT_LAYER_LABEL = i18n.translate(
+  'xpack.maps.layerControl.layerTocActions.editButtonLabel',
+  {
+    defaultMessage: 'Edit layer',
+  }
+);
+
+export const FIT_TO_DATA_LABEL = i18n.translate('xpack.maps.layerTocActions.fitToDataTitle', {
+  defaultMessage: 'Fit to data',
+});
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/index.js b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/index.js
index 85e9c242bf4bf9..ee7922a579c349 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/index.js
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/index.js
@@ -19,10 +19,12 @@ import {
   getFlyoutDisplay,
 } from '../../../../../selectors/ui_selectors';
 import {
+  fitToLayerExtent,
   setSelectedLayer,
   updateFlyout,
   hideTOCDetails,
   showTOCDetails,
+  toggleLayerVisible,
 } from '../../../../../actions';
 
 function mapStateToProps(state = {}, ownProps) {
@@ -40,6 +42,9 @@ function mapStateToProps(state = {}, ownProps) {
 
 function mapDispatchToProps(dispatch) {
   return {
+    fitToBounds: (layerId) => {
+      dispatch(fitToLayerExtent(layerId));
+    },
     openLayerPanel: async (layerId) => {
       await dispatch(setSelectedLayer(layerId));
       dispatch(updateFlyout(FLYOUT_STATE.LAYER_PANEL));
@@ -50,6 +55,9 @@ function mapDispatchToProps(dispatch) {
     showTOCDetails: (layerId) => {
       dispatch(showTOCDetails(layerId));
     },
+    toggleVisible: (layerId) => {
+      dispatch(toggleLayerVisible(layerId));
+    },
   };
 }
 
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.test.tsx b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.test.tsx
index b1afb72750dab2..dd85d6dd1eb6ec 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.test.tsx
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.test.tsx
@@ -14,8 +14,6 @@ import { AbstractSource, ISource } from '../../../../../../classes/sources/sourc
 
 import { TOCEntryActionsPopover } from './toc_entry_actions_popover';
 
-let supportsFitToBounds: boolean;
-
 class MockSource extends AbstractSource implements ISource {}
 
 class LayerMock extends AbstractLayer implements ILayer {
@@ -31,10 +29,6 @@ class LayerMock extends AbstractLayer implements ILayer {
     super({ layerDescriptor, source });
   }
 
-  async supportsFitToBounds(): Promise<boolean> {
-    return supportsFitToBounds;
-  }
-
   isVisible() {
     return true;
   }
@@ -51,13 +45,10 @@ const defaultProps = {
   layer: new LayerMock(),
   removeLayer: () => {},
   toggleVisible: () => {},
+  supportsFitToBounds: true,
 };
 
 describe('TOCEntryActionsPopover', () => {
-  beforeEach(() => {
-    supportsFitToBounds = true;
-  });
-
   test('is rendered', async () => {
     const component = shallow(<TOCEntryActionsPopover {...defaultProps} />);
 
@@ -81,8 +72,9 @@ describe('TOCEntryActionsPopover', () => {
   });
 
   test('should disable fit to data when supportsFitToBounds is false', async () => {
-    supportsFitToBounds = false;
-    const component = shallow(<TOCEntryActionsPopover {...defaultProps} />);
+    const component = shallow(
+      <TOCEntryActionsPopover {...defaultProps} supportsFitToBounds={false} />
+    );
 
     // Ensure all promises resolve
     await new Promise((resolve) => process.nextTick(resolve));
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
index 8127bd1e412836..3cd719f0b9447f 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/toc_entry_actions_popover/toc_entry_actions_popover.tsx
@@ -11,6 +11,12 @@ import { EuiPopover, EuiContextMenu, EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ILayer } from '../../../../../../classes/layers/layer';
 import { TOCEntryButton } from '../toc_entry_button';
+import {
+  getVisibilityToggleIcon,
+  getVisibilityToggleLabel,
+  EDIT_LAYER_LABEL,
+  FIT_TO_DATA_LABEL,
+} from '../action_labels';
 
 export interface Props {
   cloneLayer: (layerId: string) => void;
@@ -22,37 +28,16 @@ export interface Props {
   isReadOnly: boolean;
   layer: ILayer;
   removeLayer: (layerId: string) => void;
+  supportsFitToBounds: boolean;
   toggleVisible: (layerId: string) => void;
 }
 
 interface State {
   isPopoverOpen: boolean;
-  supportsFitToBounds: boolean;
 }
 
 export class TOCEntryActionsPopover extends Component<Props, State> {
-  private _isMounted: boolean = false;
-
-  state = {
-    isPopoverOpen: false,
-    supportsFitToBounds: false,
-  };
-
-  componentDidMount() {
-    this._isMounted = true;
-    this._loadSupportsFitToBounds();
-  }
-
-  componentWillUnmount() {
-    this._isMounted = false;
-  }
-
-  async _loadSupportsFitToBounds() {
-    const supportsFitToBounds = await this.props.layer.supportsFitToBounds();
-    if (this._isMounted) {
-      this.setState({ supportsFitToBounds });
-    }
-  }
+  state: State = { isPopoverOpen: false };
 
   _togglePopover = () => {
     this.setState((prevState) => ({
@@ -85,31 +70,23 @@ export class TOCEntryActionsPopover extends Component<Props, State> {
   _getActionsPanel() {
     const actionItems = [
       {
-        name: i18n.translate('xpack.maps.layerTocActions.fitToDataTitle', {
-          defaultMessage: 'Fit to data',
-        }),
+        name: FIT_TO_DATA_LABEL,
         icon: <EuiIcon type="expand" size="m" />,
         'data-test-subj': 'fitToBoundsButton',
-        toolTipContent: this.state.supportsFitToBounds
+        toolTipContent: this.props.supportsFitToBounds
           ? null
           : i18n.translate('xpack.maps.layerTocActions.noFitSupportTooltip', {
               defaultMessage: 'Layer does not support fit to data',
             }),
-        disabled: !this.state.supportsFitToBounds,
+        disabled: !this.props.supportsFitToBounds,
         onClick: () => {
           this._closePopover();
           this._fitToBounds();
         },
       },
       {
-        name: this.props.layer.isVisible()
-          ? i18n.translate('xpack.maps.layerTocActions.hideLayerTitle', {
-              defaultMessage: 'Hide layer',
-            })
-          : i18n.translate('xpack.maps.layerTocActions.showLayerTitle', {
-              defaultMessage: 'Show layer',
-            }),
-        icon: <EuiIcon type={this.props.layer.isVisible() ? 'eyeClosed' : 'eye'} size="m" />,
+        name: getVisibilityToggleLabel(this.props.layer.isVisible()),
+        icon: <EuiIcon type={getVisibilityToggleIcon(this.props.layer.isVisible())} size="m" />,
         'data-test-subj': 'layerVisibilityToggleButton',
         toolTipContent: null,
         onClick: () => {
@@ -122,9 +99,7 @@ export class TOCEntryActionsPopover extends Component<Props, State> {
     if (!this.props.isReadOnly) {
       actionItems.push({
         disabled: this.props.isEditButtonDisabled,
-        name: i18n.translate('xpack.maps.layerTocActions.editLayerTitle', {
-          defaultMessage: 'Edit layer',
-        }),
+        name: EDIT_LAYER_LABEL,
         icon: <EuiIcon type="pencil" size="m" />,
         'data-test-subj': 'editLayerButton',
         toolTipContent: null,
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/view.js b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/view.js
index 9e5a6080c830d8..b886dd21030baf 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/view.js
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/toc_entry/view.js
@@ -11,6 +11,12 @@ import classNames from 'classnames';
 import { EuiIcon, EuiButtonIcon, EuiConfirmModal } from '@elastic/eui';
 import { TOCEntryActionsPopover } from './toc_entry_actions_popover';
 import { i18n } from '@kbn/i18n';
+import {
+  getVisibilityToggleIcon,
+  getVisibilityToggleLabel,
+  EDIT_LAYER_LABEL,
+  FIT_TO_DATA_LABEL,
+} from './action_labels';
 
 function escapeLayerName(name) {
   return name ? name.split(' ').join('_') : '';
@@ -21,12 +27,14 @@ export class TOCEntry extends React.Component {
     displayName: null,
     hasLegendDetails: false,
     shouldShowModal: false,
+    supportsFitToBounds: false,
   };
 
   componentDidMount() {
     this._isMounted = true;
     this._updateDisplayName();
     this._loadHasLegendDetails();
+    this._loadSupportsFitToBounds();
   }
 
   componentWillUnmount() {
@@ -46,6 +54,13 @@ export class TOCEntry extends React.Component {
     }
   };
 
+  async _loadSupportsFitToBounds() {
+    const supportsFitToBounds = await this.props.layer.supportsFitToBounds();
+    if (this._isMounted) {
+      this.setState({ supportsFitToBounds });
+    }
+  }
+
   async _loadHasLegendDetails() {
     const hasLegendDetails =
       (await this.props.layer.hasLegendDetails()) &&
@@ -83,6 +98,14 @@ export class TOCEntry extends React.Component {
     this.props.openLayerPanel(this.props.layer.getId());
   };
 
+  _fitToBounds = () => {
+    this.props.fitToBounds(this.props.layer.getId());
+  };
+
+  _toggleVisible = () => {
+    this.props.toggleVisible(this.props.layer.getId());
+  };
+
   _renderCancelModal() {
     if (!this.state.shouldShowModal) {
       return null;
@@ -115,28 +138,40 @@ export class TOCEntry extends React.Component {
     );
   }
 
-  _renderLayerIcons() {
-    if (this.props.isReadOnly) {
-      return null;
+  _renderQuickActions() {
+    const quickActions = [
+      <EuiButtonIcon
+        iconType={getVisibilityToggleIcon(this.props.layer.isVisible())}
+        title={getVisibilityToggleLabel(this.props.layer.isVisible())}
+        aria-label={getVisibilityToggleLabel(this.props.layer.isVisible())}
+        onClick={this._toggleVisible}
+      />,
+    ];
+
+    if (this.state.supportsFitToBounds) {
+      quickActions.push(
+        <EuiButtonIcon
+          iconType="expand"
+          title={FIT_TO_DATA_LABEL}
+          aria-label={FIT_TO_DATA_LABEL}
+          onClick={this._fitToBounds}
+        />
+      );
     }
 
-    return (
-      <div className="mapTocEntry__layerIcons">
+    if (!this.props.isReadOnly) {
+      quickActions.push(
         <EuiButtonIcon
           isDisabled={this.props.isEditButtonDisabled}
           iconType="pencil"
-          aria-label={i18n.translate('xpack.maps.layerControl.tocEntry.editButtonAriaLabel', {
-            defaultMessage: 'Edit layer',
-          })}
-          title={i18n.translate('xpack.maps.layerControl.tocEntry.editButtonTitle', {
-            defaultMessage: 'Edit layer',
-          })}
+          aria-label={EDIT_LAYER_LABEL}
+          title={EDIT_LAYER_LABEL}
           onClick={this._openLayerPanelWithCheck}
         />
-
+      );
+      quickActions.push(
         <EuiButtonIcon
           iconType="grab"
-          color="subdued"
           title={i18n.translate('xpack.maps.layerControl.tocEntry.grabButtonTitle', {
             defaultMessage: 'Reorder layer',
           })}
@@ -146,8 +181,10 @@ export class TOCEntry extends React.Component {
           className="mapTocEntry__grab"
           {...this.props.dragHandleProps}
         />
-      </div>
-    );
+      );
+    }
+
+    return <div className="mapTocEntry__layerIcons">{quickActions}</div>;
   }
 
   _renderDetailsToggle() {
@@ -206,9 +243,10 @@ export class TOCEntry extends React.Component {
           escapedDisplayName={escapeLayerName(this.state.displayName)}
           editLayer={this._openLayerPanelWithCheck}
           isEditButtonDisabled={this.props.isEditButtonDisabled}
+          supportsFitToBounds={this.state.supportsFitToBounds}
         />
 
-        {this._renderLayerIcons()}
+        {this._renderQuickActions()}
       </div>
     );
   }
diff --git a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/view.test.js b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/view.test.js
index 1a14d854b5449b..4a036d8d70c8f3 100644
--- a/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/view.test.js
+++ b/x-pack/plugins/maps/public/connected_components/widget_overlay/layer_control/layer_toc/view.test.js
@@ -21,11 +21,17 @@ const mockLayers = [
     getId: () => {
       return '1';
     },
+    supportsFitToBounds: () => {
+      return true;
+    },
   },
   {
     getId: () => {
       return '2';
     },
+    supportsFitToBounds: () => {
+      return false;
+    },
   },
 ];
 
diff --git a/x-pack/plugins/ml/common/constants/alerts.ts b/x-pack/plugins/ml/common/constants/alerts.ts
index 53b8fa7d5fea7b..30daf0d45c3ac7 100644
--- a/x-pack/plugins/ml/common/constants/alerts.ts
+++ b/x-pack/plugins/ml/common/constants/alerts.ts
@@ -47,3 +47,5 @@ export const ML_ALERT_TYPES_CONFIG: Record<
 };
 
 export const ALERT_PREVIEW_SAMPLE_SIZE = 5;
+
+export const TOP_N_BUCKETS_COUNT = 1;
diff --git a/x-pack/plugins/ml/common/types/alerts.ts b/x-pack/plugins/ml/common/types/alerts.ts
index bbbb260409bd07..f2c3385c1fbc79 100644
--- a/x-pack/plugins/ml/common/types/alerts.ts
+++ b/x-pack/plugins/ml/common/types/alerts.ts
@@ -93,4 +93,11 @@ export type MlAnomalyDetectionAlertParams = {
   severity: number;
   resultType: AnomalyResultType;
   includeInterim: boolean;
+  lookbackInterval: string | null | undefined;
+  topNBuckets: number | null | undefined;
 } & AlertTypeParams;
+
+export type MlAnomalyDetectionAlertAdvancedSettings = Pick<
+  MlAnomalyDetectionAlertParams,
+  'lookbackInterval' | 'topNBuckets'
+>;
diff --git a/x-pack/plugins/ml/common/util/alerts.test.ts b/x-pack/plugins/ml/common/util/alerts.test.ts
new file mode 100644
index 00000000000000..d9896c967165bc
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/alerts.test.ts
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getLookbackInterval, resolveLookbackInterval } from './alerts';
+import type { CombinedJobWithStats, Datafeed, Job } from '../types/anomaly_detection_jobs';
+
+describe('resolveLookbackInterval', () => {
+  test('resolves interval for bucket spans bigger than 1m', () => {
+    const testJobs = [
+      {
+        analysis_config: {
+          bucket_span: '15m',
+        },
+      },
+    ] as Job[];
+
+    const testDatafeeds = [
+      {
+        query_delay: '65630ms',
+      },
+    ] as Datafeed[];
+
+    expect(resolveLookbackInterval(testJobs, testDatafeeds)).toBe('32m');
+  });
+
+  test('resolves interval for bucket spans smaller than 1m', () => {
+    const testJobs = [
+      {
+        analysis_config: {
+          bucket_span: '50s',
+        },
+      },
+    ] as Job[];
+
+    const testDatafeeds = [
+      {
+        query_delay: '20s',
+      },
+    ] as Datafeed[];
+
+    expect(resolveLookbackInterval(testJobs, testDatafeeds)).toBe('3m');
+  });
+
+  test('resolves interval for bucket spans smaller than 1m without query dealay', () => {
+    const testJobs = [
+      {
+        analysis_config: {
+          bucket_span: '59s',
+        },
+      },
+    ] as Job[];
+
+    const testDatafeeds = [{}] as Datafeed[];
+
+    expect(resolveLookbackInterval(testJobs, testDatafeeds)).toBe('3m');
+  });
+});
+
+describe('getLookbackInterval', () => {
+  test('resolves interval for bucket spans bigger than 1m', () => {
+    const testJobs = [
+      {
+        analysis_config: {
+          bucket_span: '15m',
+        },
+        datafeed_config: {
+          query_delay: '65630ms',
+        },
+      },
+    ] as CombinedJobWithStats[];
+
+    expect(getLookbackInterval(testJobs)).toBe('32m');
+  });
+});
diff --git a/x-pack/plugins/ml/common/util/alerts.ts b/x-pack/plugins/ml/common/util/alerts.ts
new file mode 100644
index 00000000000000..5d68677d4fb973
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/alerts.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CombinedJobWithStats, Datafeed, Job } from '../types/anomaly_detection_jobs';
+import { resolveMaxTimeInterval } from './job_utils';
+import { isDefined } from '../types/guards';
+import { parseInterval } from './parse_interval';
+
+const narrowBucketLength = 60;
+
+/**
+ * Resolves the lookback interval for the rule
+ * using the formula max(2m, 2 * bucket_span) + query_delay + 1s.
+ * and rounds up to a whole number of minutes.
+ */
+export function resolveLookbackInterval(jobs: Job[], datafeeds: Datafeed[]): string {
+  const bucketSpanInSeconds = Math.ceil(
+    resolveMaxTimeInterval(jobs.map((v) => v.analysis_config.bucket_span)) ?? 0
+  );
+  const queryDelayInSeconds = Math.ceil(
+    resolveMaxTimeInterval(datafeeds.map((v) => v.query_delay).filter(isDefined)) ?? 0
+  );
+
+  const result =
+    Math.max(2 * narrowBucketLength, 2 * bucketSpanInSeconds) + queryDelayInSeconds + 1;
+
+  return `${Math.ceil(result / 60)}m`;
+}
+
+/**
+ * @deprecated We should avoid using {@link CombinedJobWithStats}. Replace usages with {@link resolveLookbackInterval} when
+ * Kibana API returns mapped job and the datafeed configs.
+ */
+export function getLookbackInterval(jobs: CombinedJobWithStats[]): string {
+  return resolveLookbackInterval(
+    jobs,
+    jobs.map((v) => v.datafeed_config)
+  );
+}
+
+export function getTopNBuckets(job: Job): number {
+  const bucketSpan = parseInterval(job.analysis_config.bucket_span);
+
+  if (bucketSpan === null) {
+    throw new Error('Unable to resolve a bucket span length');
+  }
+
+  return Math.ceil(narrowBucketLength / bucketSpan.asSeconds());
+}
diff --git a/x-pack/plugins/ml/common/util/job_utils.test.ts b/x-pack/plugins/ml/common/util/job_utils.test.ts
index 59f8c8a4dae3af..4f5877703b8e3f 100644
--- a/x-pack/plugins/ml/common/util/job_utils.test.ts
+++ b/x-pack/plugins/ml/common/util/job_utils.test.ts
@@ -20,7 +20,7 @@ import {
   getSafeAggregationName,
   getLatestDataOrBucketTimestamp,
   getEarliestDatafeedStartTime,
-  resolveBucketSpanInSeconds,
+  resolveMaxTimeInterval,
 } from './job_utils';
 import { CombinedJob, Job } from '../types/anomaly_detection_jobs';
 import moment from 'moment';
@@ -606,7 +606,10 @@ describe('ML - job utils', () => {
 
   describe('resolveBucketSpanInSeconds', () => {
     test('should resolve maximum bucket interval', () => {
-      expect(resolveBucketSpanInSeconds(['15m', '1h', '6h', '90s'])).toBe(21600);
+      expect(resolveMaxTimeInterval(['15m', '1h', '6h', '90s'])).toBe(21600);
+    });
+    test('returns undefined for an empty array', () => {
+      expect(resolveMaxTimeInterval([])).toBe(undefined);
     });
   });
 });
diff --git a/x-pack/plugins/ml/common/util/job_utils.ts b/x-pack/plugins/ml/common/util/job_utils.ts
index da340d4413849e..78e565a491386c 100644
--- a/x-pack/plugins/ml/common/util/job_utils.ts
+++ b/x-pack/plugins/ml/common/util/job_utils.ts
@@ -831,14 +831,16 @@ export function splitIndexPatternNames(indexPatternName: string): string[] {
 }
 
 /**
- * Resolves the longest bucket span from the list.
- * @param bucketSpans Collection of bucket spans
+ * Resolves the longest time interval from the list.
+ * @param timeIntervals Collection of the strings representing time intervals, e.g. ['15m', '1h', '2d']
  */
-export function resolveBucketSpanInSeconds(bucketSpans: string[]): number {
-  return Math.max(
-    ...bucketSpans
+export function resolveMaxTimeInterval(timeIntervals: string[]): number | undefined {
+  const result = Math.max(
+    ...timeIntervals
       .map((b) => parseInterval(b))
       .filter(isDefined)
       .map((v) => v.asSeconds())
   );
+
+  return Number.isFinite(result) ? result : undefined;
 }
diff --git a/x-pack/plugins/ml/common/util/runtime_field_utils.test.ts b/x-pack/plugins/ml/common/util/runtime_field_utils.test.ts
index 1b5e3e18b14f64..e7f92306668981 100644
--- a/x-pack/plugins/ml/common/util/runtime_field_utils.test.ts
+++ b/x-pack/plugins/ml/common/util/runtime_field_utils.test.ts
@@ -77,15 +77,15 @@ describe('ML runtime field utils', () => {
       ).toBe(false);
     });
 
-    it('allows object with most basic runtime mapping', () => {
+    it('allows object with most basic runtime field', () => {
       expect(isRuntimeMappings({ fieldName: { type: 'keyword' } })).toBe(true);
     });
-    it('allows object with multiple most basic runtime mappings', () => {
+    it('allows object with multiple most basic runtime fields', () => {
       expect(
         isRuntimeMappings({ fieldName1: { type: 'keyword' }, fieldName2: { type: 'keyword' } })
       ).toBe(true);
     });
-    it('allows object with runtime mappings including scripts', () => {
+    it('allows object with runtime fields including scripts', () => {
       expect(
         isRuntimeMappings({
           fieldName1: { type: 'keyword' },
diff --git a/x-pack/plugins/ml/common/util/validators.ts b/x-pack/plugins/ml/common/util/validators.ts
index b52e82495a76cc..0936efbcb00fce 100644
--- a/x-pack/plugins/ml/common/util/validators.ts
+++ b/x-pack/plugins/ml/common/util/validators.ts
@@ -7,6 +7,7 @@
 
 import { ALLOWED_DATA_UNITS } from '../constants/validation';
 import { parseInterval } from './parse_interval';
+import { isPopulatedObject } from './object_utils';
 
 /**
  * Provides a validator function for maximum allowed input length.
@@ -85,6 +86,10 @@ export function memoryInputValidator(allowedUnits = ALLOWED_DATA_UNITS) {
 
 export function timeIntervalInputValidator() {
   return (value: string) => {
+    if (value === '') {
+      return null;
+    }
+
     const r = parseInterval(value);
     if (r === null) {
       return {
@@ -95,3 +100,32 @@ export function timeIntervalInputValidator() {
     return null;
   };
 }
+
+export interface NumberValidationResult {
+  min: boolean;
+  max: boolean;
+}
+
+export function numberValidator(conditions?: { min?: number; max?: number }) {
+  if (
+    conditions?.min !== undefined &&
+    conditions.max !== undefined &&
+    conditions.min > conditions.max
+  ) {
+    throw new Error('Invalid validator conditions');
+  }
+
+  return (value: number): NumberValidationResult | null => {
+    const result = {} as NumberValidationResult;
+    if (conditions?.min !== undefined && value < conditions.min) {
+      result.min = true;
+    }
+    if (conditions?.max !== undefined && value > conditions.max) {
+      result.max = true;
+    }
+    if (isPopulatedObject(result)) {
+      return result;
+    }
+    return null;
+  };
+}
diff --git a/x-pack/plugins/ml/public/alerting/advanced_settings.tsx b/x-pack/plugins/ml/public/alerting/advanced_settings.tsx
new file mode 100644
index 00000000000000..05ce3c13215b35
--- /dev/null
+++ b/x-pack/plugins/ml/public/alerting/advanced_settings.tsx
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiAccordion,
+  EuiDescribedFormGroup,
+  EuiFieldNumber,
+  EuiFormRow,
+  EuiHorizontalRule,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
+import { MlAnomalyDetectionAlertAdvancedSettings } from '../../common/types/alerts';
+import { TimeIntervalControl } from './time_interval_control';
+import { TOP_N_BUCKETS_COUNT } from '../../common/constants/alerts';
+
+interface AdvancedSettingsProps {
+  value: MlAnomalyDetectionAlertAdvancedSettings;
+  onChange: (update: Partial<MlAnomalyDetectionAlertAdvancedSettings>) => void;
+}
+
+export const AdvancedSettings: FC<AdvancedSettingsProps> = React.memo(({ value, onChange }) => {
+  return (
+    <EuiAccordion
+      id="mlAnomalyAlertAdvancedSettings"
+      buttonContent={
+        <FormattedMessage
+          id="xpack.ml.anomalyDetectionAlert.advancedSettingsLabel"
+          defaultMessage="Advanced settings"
+        />
+      }
+      data-test-subj={'mlAnomalyAlertAdvancedSettingsTrigger'}
+    >
+      <EuiSpacer size="m" />
+      <EuiDescribedFormGroup
+        gutterSize={'s'}
+        titleSize={'xxs'}
+        title={
+          <h4>
+            <FormattedMessage
+              id="xpack.ml.anomalyDetectionAlert.lookbackIntervalLabel"
+              defaultMessage="Lookback interval"
+            />
+          </h4>
+        }
+        description={
+          <EuiText size={'xs'}>
+            <FormattedMessage
+              id="xpack.ml.anomalyDetectionAlert.lookbackIntervalDescription"
+              defaultMessage="Time interval to query the anomalies data during each rule condition check. By default, is derived from the bucket span of the job and the query delay of the datafeed."
+            />
+          </EuiText>
+        }
+      >
+        <TimeIntervalControl
+          value={value.lookbackInterval}
+          label={
+            <FormattedMessage
+              id="xpack.ml.anomalyDetectionAlert.lookbackIntervalLabel"
+              defaultMessage="Lookback interval"
+            />
+          }
+          onChange={(update) => {
+            onChange({ lookbackInterval: update });
+          }}
+          data-test-subj={'mlAnomalyAlertLookbackInterval'}
+        />
+      </EuiDescribedFormGroup>
+
+      <EuiDescribedFormGroup
+        gutterSize={'s'}
+        titleSize={'xxs'}
+        title={
+          <h4>
+            <FormattedMessage
+              id="xpack.ml.anomalyDetectionAlert.topNBucketsLabel"
+              defaultMessage="Number of latest buckets"
+            />
+          </h4>
+        }
+        description={
+          <EuiText size={'xs'}>
+            <FormattedMessage
+              id="xpack.ml.anomalyDetectionAlert.topNBucketsDescription"
+              defaultMessage="The number of latest buckets to check to obtain the highest anomaly."
+            />
+          </EuiText>
+        }
+      >
+        <EuiFormRow
+          label={
+            <FormattedMessage
+              id="xpack.ml.anomalyDetectionAlert.topNBucketsLabel"
+              defaultMessage="Number of latest buckets"
+            />
+          }
+        >
+          <EuiFieldNumber
+            value={value.topNBuckets ?? TOP_N_BUCKETS_COUNT}
+            min={1}
+            onChange={(e) => {
+              onChange({ topNBuckets: Number(e.target.value) });
+            }}
+            data-test-subj={'mlAnomalyAlertTopNBuckets'}
+          />
+        </EuiFormRow>
+      </EuiDescribedFormGroup>
+      <EuiHorizontalRule margin={'m'} />
+    </EuiAccordion>
+  );
+});
diff --git a/x-pack/plugins/ml/public/alerting/config_validator.tsx b/x-pack/plugins/ml/public/alerting/config_validator.tsx
index 5881a3b36dcbd5..5a834ab14dd359 100644
--- a/x-pack/plugins/ml/public/alerting/config_validator.tsx
+++ b/x-pack/plugins/ml/public/alerting/config_validator.tsx
@@ -5,40 +5,35 @@
  * 2.0.
  */
 
-import React, { FC, useMemo } from 'react';
+import React, { FC } from 'react';
 
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiCallOut, EuiSpacer } from '@elastic/eui';
 import { parseInterval } from '../../common/util/parse_interval';
 import { CombinedJobWithStats } from '../../common/types/anomaly_detection_jobs';
 import { DATAFEED_STATE } from '../../common/constants/states';
-import { resolveBucketSpanInSeconds } from '../../common/util/job_utils';
+import { MlAnomalyDetectionAlertParams } from '../../common/types/alerts';
 
 interface ConfigValidatorProps {
   alertInterval: string;
   jobConfigs: CombinedJobWithStats[];
+  alertParams: MlAnomalyDetectionAlertParams;
 }
 
 /**
  * Validated alert configuration
  */
 export const ConfigValidator: FC<ConfigValidatorProps> = React.memo(
-  ({ jobConfigs = [], alertInterval }) => {
-    const resultBucketSpanInSeconds = useMemo(
-      () => resolveBucketSpanInSeconds(jobConfigs.map((v) => v.analysis_config.bucket_span)),
-      [jobConfigs]
-    );
-
-    const resultBucketSpanString =
-      resultBucketSpanInSeconds % 60 === 0
-        ? `${resultBucketSpanInSeconds / 60}m`
-        : `${resultBucketSpanInSeconds}s`;
-
+  ({ jobConfigs = [], alertInterval, alertParams }) => {
     if (jobConfigs.length === 0) return null;
 
     const alertIntervalInSeconds = parseInterval(alertInterval)!.asSeconds();
 
-    const isAlertIntervalTooHigh = resultBucketSpanInSeconds < alertIntervalInSeconds;
+    const lookbackIntervalInSeconds =
+      !!alertParams.lookbackInterval && parseInterval(alertParams.lookbackInterval)?.asSeconds();
+
+    const isAlertIntervalTooHigh =
+      lookbackIntervalInSeconds && lookbackIntervalInSeconds < alertIntervalInSeconds;
 
     const jobWithoutStartedDatafeed = jobConfigs
       .filter((job) => job.datafeed_config.state !== DATAFEED_STATE.STARTED)
@@ -66,9 +61,9 @@ export const ConfigValidator: FC<ConfigValidatorProps> = React.memo(
               <li>
                 <FormattedMessage
                   id="xpack.ml.alertConditionValidation.alertIntervalTooHighMessage"
-                  defaultMessage="The check interval is greater than the maximum bucket span of the selected jobs. Reduce it to {resultBucketSpan} to avoid excessive delay in receiving notifications."
+                  defaultMessage="The check interval is greater than the lookback interval. Reduce it to {lookbackInterval} to avoid potentially missing notifications."
                   values={{
-                    resultBucketSpan: resultBucketSpanString,
+                    lookbackInterval: alertParams.lookbackInterval,
                   }}
                 />
               </li>
diff --git a/x-pack/plugins/ml/public/alerting/ml_anomaly_alert_trigger.tsx b/x-pack/plugins/ml/public/alerting/ml_anomaly_alert_trigger.tsx
index 89804813a4eda2..3c8ee6bf4899fd 100644
--- a/x-pack/plugins/ml/public/alerting/ml_anomaly_alert_trigger.tsx
+++ b/x-pack/plugins/ml/public/alerting/ml_anomaly_alert_trigger.tsx
@@ -18,11 +18,17 @@ import { ResultTypeSelector } from './result_type_selector';
 import { alertingApiProvider } from '../application/services/ml_api_service/alerting';
 import { PreviewAlertCondition } from './preview_alert_condition';
 import { ANOMALY_THRESHOLD } from '../../common';
-import { MlAnomalyDetectionAlertParams } from '../../common/types/alerts';
+import {
+  MlAnomalyDetectionAlertAdvancedSettings,
+  MlAnomalyDetectionAlertParams,
+} from '../../common/types/alerts';
 import { ANOMALY_RESULT_TYPE } from '../../common/constants/anomalies';
 import { InterimResultsControl } from './interim_results_control';
 import { ConfigValidator } from './config_validator';
 import { CombinedJobWithStats } from '../../common/types/anomaly_detection_jobs';
+import { AdvancedSettings } from './advanced_settings';
+import { getLookbackInterval, getTopNBuckets } from '../../common/util/alerts';
+import { isDefined } from '../../common/types/guards';
 
 interface MlAnomalyAlertTriggerProps {
   alertParams: MlAnomalyDetectionAlertParams;
@@ -114,6 +120,28 @@ const MlAnomalyAlertTrigger: FC<MlAnomalyAlertTriggerProps> = ({
     }
   });
 
+  const advancedSettings = useMemo(() => {
+    let { lookbackInterval, topNBuckets } = alertParams;
+
+    if (!isDefined(lookbackInterval) && jobConfigs.length > 0) {
+      lookbackInterval = getLookbackInterval(jobConfigs);
+    }
+    if (!isDefined(topNBuckets) && jobConfigs.length > 0) {
+      topNBuckets = getTopNBuckets(jobConfigs[0]);
+    }
+    return {
+      lookbackInterval,
+      topNBuckets,
+    };
+  }, [alertParams.lookbackInterval, alertParams.topNBuckets, jobConfigs]);
+
+  const resultParams = useMemo(() => {
+    return {
+      ...alertParams,
+      ...advancedSettings,
+    };
+  }, [alertParams, advancedSettings]);
+
   return (
     <EuiForm data-test-subj={'mlAnomalyAlertForm'}>
       <EuiFlexGroup gutterSize={'none'} justifyContent={'flexEnd'}>
@@ -139,7 +167,11 @@ const MlAnomalyAlertTrigger: FC<MlAnomalyAlertTriggerProps> = ({
         errors={errors.jobSelection}
       />
 
-      <ConfigValidator jobConfigs={jobConfigs} alertInterval={alertInterval} />
+      <ConfigValidator
+        jobConfigs={jobConfigs}
+        alertInterval={alertInterval}
+        alertParams={resultParams}
+      />
 
       <ResultTypeSelector
         value={alertParams.resultType}
@@ -157,6 +189,17 @@ const MlAnomalyAlertTrigger: FC<MlAnomalyAlertTriggerProps> = ({
       />
       <EuiSpacer size="m" />
 
+      <AdvancedSettings
+        value={advancedSettings}
+        onChange={useCallback((update) => {
+          Object.keys(update).forEach((k) => {
+            setAlertParams(k, update[k as keyof MlAnomalyDetectionAlertAdvancedSettings]);
+          });
+        }, [])}
+      />
+
+      <EuiSpacer size="m" />
+
       <PreviewAlertCondition alertingApiService={alertingApiService} alertParams={alertParams} />
 
       <EuiSpacer size="m" />
diff --git a/x-pack/plugins/ml/public/alerting/register_ml_alerts.ts b/x-pack/plugins/ml/public/alerting/register_ml_alerts.ts
index 5bb9df74b6f613..92a5343380cddb 100644
--- a/x-pack/plugins/ml/public/alerting/register_ml_alerts.ts
+++ b/x-pack/plugins/ml/public/alerting/register_ml_alerts.ts
@@ -11,7 +11,10 @@ import { ML_ALERT_TYPES } from '../../common/constants/alerts';
 import { MlAnomalyDetectionAlertParams } from '../../common/types/alerts';
 import { TriggersAndActionsUIPublicPluginSetup } from '../../../triggers_actions_ui/public';
 
-export function registerMlAlerts(triggersActionsUi: TriggersAndActionsUIPublicPluginSetup) {
+export async function registerMlAlerts(triggersActionsUi: TriggersAndActionsUIPublicPluginSetup) {
+  // async import validators to reduce initial bundle size
+  const { validateLookbackInterval, validateTopNBucket } = await import('./validators');
+
   triggersActionsUi.alertTypeRegistry.register({
     id: ML_ALERT_TYPES.ANOMALY_DETECTION,
     description: i18n.translate('xpack.ml.alertTypes.anomalyDetection.description', {
@@ -28,7 +31,9 @@ export function registerMlAlerts(triggersActionsUi: TriggersAndActionsUIPublicPl
           jobSelection: new Array<string>(),
           severity: new Array<string>(),
           resultType: new Array<string>(),
-        },
+          topNBuckets: new Array<string>(),
+          lookbackInterval: new Array<string>(),
+        } as Record<keyof MlAnomalyDetectionAlertParams, string[]>,
       };
 
       if (
@@ -58,6 +63,28 @@ export function registerMlAlerts(triggersActionsUi: TriggersAndActionsUIPublicPl
         );
       }
 
+      if (
+        !!alertParams.lookbackInterval &&
+        validateLookbackInterval(alertParams.lookbackInterval)
+      ) {
+        validationResult.errors.lookbackInterval.push(
+          i18n.translate('xpack.ml.alertTypes.anomalyDetection.lookbackInterval.errorMessage', {
+            defaultMessage: 'Lookback interval is invalid',
+          })
+        );
+      }
+
+      if (
+        typeof alertParams.topNBuckets === 'number' &&
+        validateTopNBucket(alertParams.topNBuckets)
+      ) {
+        validationResult.errors.topNBuckets.push(
+          i18n.translate('xpack.ml.alertTypes.anomalyDetection.topNBuckets.errorMessage', {
+            defaultMessage: 'Number of buckets is invalid',
+          })
+        );
+      }
+
       return validationResult;
     },
     requiresAppContext: false,
diff --git a/x-pack/plugins/ml/public/alerting/severity_control/severity_control.tsx b/x-pack/plugins/ml/public/alerting/severity_control/severity_control.tsx
index 26a53882535b67..b1cd808643ca2f 100644
--- a/x-pack/plugins/ml/public/alerting/severity_control/severity_control.tsx
+++ b/x-pack/plugins/ml/public/alerting/severity_control/severity_control.tsx
@@ -67,7 +67,7 @@ export const SeverityControl: FC<SeveritySelectorProps> = React.memo(({ value, o
         value={value ?? ANOMALY_THRESHOLD.LOW}
         onChange={(e) => {
           // @ts-ignore Property 'value' does not exist on type 'EventTarget' | (EventTarget & HTMLInputElement)
-          onChange(e.target.value);
+          onChange(Number(e.target.value));
         }}
         showLabels
         showValue
diff --git a/x-pack/plugins/ml/public/alerting/time_interval_control.tsx b/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
new file mode 100644
index 00000000000000..8030d340a37745
--- /dev/null
+++ b/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFieldText, EuiFormRow, EuiFieldTextProps } from '@elastic/eui';
+import React, { FC, ReactNode, useMemo } from 'react';
+import { invalidTimeIntervalMessage } from '../application/jobs/new_job/common/job_validator/util';
+import { composeValidators } from '../../common';
+import { timeIntervalInputValidator } from '../../common/util/validators';
+
+type TimeIntervalControlProps = Omit<EuiFieldTextProps, 'value' | 'onChange'> & {
+  label: string | ReactNode;
+  value: string | null | undefined;
+  onChange: (update: string) => void;
+};
+
+export const TimeIntervalControl: FC<TimeIntervalControlProps> = ({
+  value,
+  onChange,
+  label,
+  ...fieldTextProps
+}) => {
+  const validators = useMemo(() => composeValidators(timeIntervalInputValidator()), []);
+
+  const validationErrors = useMemo(() => validators(value), [value]);
+
+  const isInvalid = value !== undefined && !!validationErrors;
+
+  return (
+    <EuiFormRow
+      label={label}
+      isInvalid={isInvalid}
+      error={invalidTimeIntervalMessage(value ?? undefined)}
+    >
+      <EuiFieldText
+        {...fieldTextProps}
+        placeholder="15d, 6m"
+        value={value ?? ''}
+        onChange={(e) => {
+          onChange(e.target.value);
+        }}
+        isInvalid={isInvalid}
+      />
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/delete/persist.gql_query.ts b/x-pack/plugins/ml/public/alerting/validators.ts
similarity index 53%
rename from x-pack/plugins/security_solution/public/timelines/containers/delete/persist.gql_query.ts
rename to x-pack/plugins/ml/public/alerting/validators.ts
index 8312988d61e338..0c76e049b6da91 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/delete/persist.gql_query.ts
+++ b/x-pack/plugins/ml/public/alerting/validators.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-import gql from 'graphql-tag';
+import { numberValidator, timeIntervalInputValidator } from '../../common/util/validators';
 
-export const deleteTimelineMutation = gql`
-  mutation DeleteTimelineMutation($id: [ID!]!) {
-    deleteTimeline(id: $id)
-  }
-`;
+export const validateLookbackInterval = timeIntervalInputValidator();
+export const validateTopNBucket = numberValidator({ min: 1 });
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx
index 810f59d9046961..930c32ce7e4da1 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx
@@ -364,7 +364,7 @@ export const ConfigurationStepForm: FC<ConfigurationStepProps> = ({
           }
           return !option.key?.includes(runtimeMappingKey);
         });
-        // Runtime mappings have been removed
+        // Runtime fields have been removed
         if (runtimeMappings === undefined && runtimeMappingsUpdated === true) {
           setDependentVariableOptions(filteredOptions);
         } else if (runtimeMappings) {
@@ -374,7 +374,7 @@ export const ConfigurationStepForm: FC<ConfigurationStepProps> = ({
         }
       }
 
-      // Update includes - remove previous runtime mappings then add supported runtime fields to includes
+      // Update includes - remove previous runtime fields then add supported runtime fields to includes
       const updatedIncludes = includes.filter((field) => {
         const isRemovedRuntimeField = previousRuntimeMapping && previousRuntimeMapping[field];
         return !isRemovedRuntimeField;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/runtime_mappings.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/runtime_mappings.tsx
index 5b8fc82ef587b5..ec85cc97ac6a69 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/runtime_mappings.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/runtime_mappings.tsx
@@ -20,19 +20,48 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { XJsonMode } from '@kbn/ace';
-import { RuntimeField } from '../../../../../../../../../../src/plugins/data/common/index_patterns';
 import { useMlContext } from '../../../../../contexts/ml';
 import { CreateAnalyticsFormProps } from '../../../analytics_management/hooks/use_create_analytics_form';
 import { XJson } from '../../../../../../../../../../src/plugins/es_ui_shared/public';
 import { getCombinedRuntimeMappings } from '../../../../../components/data_grid/common';
 import { isPopulatedObject } from '../../../../../../../common/util/object_utils';
 import { RuntimeMappingsEditor } from './runtime_mappings_editor';
+import { isRuntimeMappings } from '../../../../../../../common';
+import { SwitchModal } from './switch_modal';
 
 const advancedEditorsSidebarWidth = '220px';
-const COPY_TO_CLIPBOARD_RUNTIME_MAPPINGS = i18n.translate(
+const COPY_RUNTIME_FIELDS_TO_CLIPBOARD_TEXT = i18n.translate(
   'xpack.ml.dataframe.analytics.createWizard.indexPreview.copyRuntimeMappingsClipboardTooltip',
   {
-    defaultMessage: 'Copy Dev Console statement of the runtime mappings to the clipboard.',
+    defaultMessage: 'Copy Dev Console statement of the runtime fields to the clipboard.',
+  }
+);
+
+const APPLY_CHANGES_TEXT = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.advancedSourceEditorApplyButtonText',
+  {
+    defaultMessage: 'Apply changes',
+  }
+);
+
+const RUNTIME_FIELDS_EDITOR_HELP_TEXT = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.advancedRuntimeFieldsEditorHelpText',
+  {
+    defaultMessage: 'The advanced editor allows you to edit the runtime fields of the source.',
+  }
+);
+
+const EDIT_SWITCH_LABEL_TEXT = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.advancedEditorRuntimeFieldsSwitchLabel',
+  {
+    defaultMessage: 'Edit runtime fields',
+  }
+);
+
+const RUNTIME_FIELDS_LABEL_TEXT = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.runtimeFieldsLabel',
+  {
+    defaultMessage: 'Runtime fields',
   }
 );
 
@@ -45,12 +74,15 @@ interface Props {
   state: CreateAnalyticsFormProps['state'];
 }
 
-type RuntimeMappings = Record<string, RuntimeField>;
-
 export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
   const [isRuntimeMappingsEditorEnabled, setIsRuntimeMappingsEditorEnabled] = useState<boolean>(
     false
   );
+  const [
+    isRuntimeMappingsEditorSwitchModalVisible,
+    setRuntimeMappingsEditorSwitchModalVisible,
+  ] = useState<boolean>(false);
+
   const [
     isRuntimeMappingsEditorApplyButtonEnabled,
     setIsRuntimeMappingsEditorApplyButtonEnabled,
@@ -59,7 +91,6 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
     advancedEditorRuntimeMappingsLastApplied,
     setAdvancedEditorRuntimeMappingsLastApplied,
   ] = useState<string>();
-  const [advancedEditorRuntimeMappings, setAdvancedEditorRuntimeMappings] = useState<string>();
 
   const { setFormState } = actions;
   const { jobType, previousRuntimeMapping, runtimeMappings } = state.form;
@@ -90,22 +121,22 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
       runtimeMappingsUpdated: true,
       previousRuntimeMapping: previous,
     });
-    setAdvancedEditorRuntimeMappings(prettySourceConfig);
+    setAdvancedRuntimeMappingsConfig(prettySourceConfig);
     setAdvancedEditorRuntimeMappingsLastApplied(prettySourceConfig);
     setIsRuntimeMappingsEditorApplyButtonEnabled(false);
   };
 
-  // If switching to KQL after updating via editor - reset search
   const toggleEditorHandler = (reset = false) => {
     if (reset === true) {
-      setFormState({ runtimeMappingsUpdated: false });
-    }
-    if (isRuntimeMappingsEditorEnabled === false) {
-      setAdvancedEditorRuntimeMappingsLastApplied(advancedEditorRuntimeMappings);
+      setFormState({
+        runtimeMappingsUpdated: false,
+      });
+
+      setAdvancedRuntimeMappingsConfig(advancedEditorRuntimeMappingsLastApplied ?? '');
     }
 
     setIsRuntimeMappingsEditorEnabled(!isRuntimeMappingsEditorEnabled);
-    setIsRuntimeMappingsEditorApplyButtonEnabled(false);
+    setIsRuntimeMappingsEditorApplyButtonEnabled(isRuntimeMappings(runtimeMappings));
   };
 
   useEffect(function getInitialRuntimeMappings() {
@@ -114,8 +145,11 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
       runtimeMappings
     );
 
+    const prettySourceConfig = JSON.stringify(combinedRuntimeMappings, null, 2);
+
     if (combinedRuntimeMappings) {
-      setAdvancedRuntimeMappingsConfig(JSON.stringify(combinedRuntimeMappings, null, 2));
+      setAdvancedRuntimeMappingsConfig(prettySourceConfig);
+      setAdvancedEditorRuntimeMappingsLastApplied(prettySourceConfig);
       setFormState({
         runtimeMappings: combinedRuntimeMappings,
       });
@@ -125,12 +159,7 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
   return (
     <>
       <EuiSpacer size="s" />
-      <EuiFormRow
-        fullWidth={true}
-        label={i18n.translate('xpack.ml.dataframe.analytics.createWizard.runtimeMappingsLabel', {
-          defaultMessage: 'Runtime mappings',
-        })}
-      >
+      <EuiFormRow fullWidth={true} label={RUNTIME_FIELDS_LABEL_TEXT}>
         <EuiFlexGroup alignItems="baseline" justifyContent="spaceBetween">
           <EuiFlexItem grow={true}>
             {isPopulatedObject(runtimeMappings) ? (
@@ -139,8 +168,8 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
               </EuiText>
             ) : (
               <FormattedMessage
-                id="xpack.ml.dataframe.analytics.createWizard.noRuntimeMappingsLabel"
-                defaultMessage="No runtime mapping"
+                id="xpack.ml.dataframe.analytics.createWizard.noRuntimeFieldLabel"
+                defaultMessage="No runtime field"
               />
             )}
 
@@ -170,27 +199,41 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
                   <EuiFlexItem grow={false}>
                     <EuiSwitch
                       disabled={jobType === undefined}
-                      label={i18n.translate(
-                        'xpack.ml.dataframe.analytics.createWizard.advancedEditorRuntimeMappingsSwitchLabel',
-                        {
-                          defaultMessage: 'Edit runtime mappings',
-                        }
-                      )}
+                      label={EDIT_SWITCH_LABEL_TEXT}
                       checked={isRuntimeMappingsEditorEnabled}
-                      onChange={() => toggleEditorHandler()}
+                      onChange={() => {
+                        if (
+                          isRuntimeMappingsEditorEnabled &&
+                          advancedRuntimeMappingsConfig !== advancedEditorRuntimeMappingsLastApplied
+                        ) {
+                          setRuntimeMappingsEditorSwitchModalVisible(true);
+                          return;
+                        }
+
+                        toggleEditorHandler();
+                      }}
                       data-test-subj="mlDataFrameAnalyticsRuntimeMappingsEditorSwitch"
                     />
+                    {isRuntimeMappingsEditorSwitchModalVisible && (
+                      <SwitchModal
+                        onCancel={() => setRuntimeMappingsEditorSwitchModalVisible(false)}
+                        onConfirm={() => {
+                          setRuntimeMappingsEditorSwitchModalVisible(false);
+                          toggleEditorHandler(true);
+                        }}
+                      />
+                    )}
                   </EuiFlexItem>
                   <EuiFlexItem grow={false}>
                     <EuiCopy
-                      beforeMessage={COPY_TO_CLIPBOARD_RUNTIME_MAPPINGS}
+                      beforeMessage={COPY_RUNTIME_FIELDS_TO_CLIPBOARD_TEXT}
                       textToCopy={advancedRuntimeMappingsConfig ?? ''}
                     >
                       {(copy: () => void) => (
                         <EuiButtonIcon
                           onClick={copy}
                           iconType="copyClipboard"
-                          aria-label={COPY_TO_CLIPBOARD_RUNTIME_MAPPINGS}
+                          aria-label={COPY_RUNTIME_FIELDS_TO_CLIPBOARD_TEXT}
                         />
                       )}
                     </EuiCopy>
@@ -201,15 +244,7 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
               {isRuntimeMappingsEditorEnabled && (
                 <EuiFlexItem style={{ width: advancedEditorsSidebarWidth }}>
                   <EuiSpacer size="s" />
-                  <EuiText size="xs">
-                    {i18n.translate(
-                      'xpack.ml.dataframe.analytics.createWizard.advancedRuntimeMappingsEditorHelpText',
-                      {
-                        defaultMessage:
-                          'The advanced editor allows you to edit the runtime mappings of the source.',
-                      }
-                    )}
-                  </EuiText>
+                  <EuiText size="xs">{RUNTIME_FIELDS_EDITOR_HELP_TEXT}</EuiText>
                   <EuiSpacer size="s" />
                   <EuiButton
                     style={{ width: 'fit-content' }}
@@ -219,12 +254,7 @@ export const RuntimeMappings: FC<Props> = ({ actions, state }) => {
                     disabled={!isRuntimeMappingsEditorApplyButtonEnabled}
                     data-test-subj="mlDataFrameAnalyticsRuntimeMappingsApplyButton"
                   >
-                    {i18n.translate(
-                      'xpack.ml.dataframe.analytics.createWizard.advancedSourceEditorApplyButtonText',
-                      {
-                        defaultMessage: 'Apply changes',
-                      }
-                    )}
+                    {APPLY_CHANGES_TEXT}
                   </EuiButton>
                 </EuiFlexItem>
               )}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/switch_modal.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/switch_modal.tsx
new file mode 100644
index 00000000000000..21a1c18dbea136
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/runtime_mappings/switch_modal.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC } from 'react';
+import { EuiConfirmModal } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+interface Props {
+  onCancel: () => void;
+  onConfirm: () => void;
+}
+
+const modalTitle = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.runtimeEditorSwitchModalTitle',
+  {
+    defaultMessage: 'Edits will be lost',
+  }
+);
+
+const cancelButtonText = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.runtimeEditorSwitchModalCancelButtonText',
+  {
+    defaultMessage: 'Cancel',
+  }
+);
+
+const applyChangesText = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.runtimeEditorSwitchModalConfirmButtonText',
+  {
+    defaultMessage: 'Close editor',
+  }
+);
+const modalMessage = i18n.translate(
+  'xpack.ml.dataframe.analytics.createWizard.runtimeEditorSwitchModalBodyText',
+  {
+    defaultMessage: `The changes in the editor haven't been applied yet. By closing the editor you will lose your edits.`,
+  }
+);
+
+export const SwitchModal: FC<Props> = ({ onCancel, onConfirm }) => (
+  <EuiConfirmModal
+    title={modalTitle}
+    onCancel={onCancel}
+    onConfirm={onConfirm}
+    cancelButtonText={cancelButtonText}
+    confirmButtonText={applyChangesText}
+    buttonColor="danger"
+    defaultFocusedButton="confirm"
+  >
+    <p>{modalMessage}</p>
+  </EuiConfirmModal>
+);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/filter_runtime_mappings.test.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/filter_runtime_mappings.test.ts
index c67a93c5e06262..670447826dcdda 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/filter_runtime_mappings.test.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/filter_runtime_mappings.test.ts
@@ -102,7 +102,7 @@ describe('filter_runtime_mappings', () => {
       datafeed = getDatafeed();
     });
 
-    test('returns no runtime mappings, no mappings in aggs', () => {
+    test('returns no runtime fields, no mappings in aggs', () => {
       const resp = filterRuntimeMappings(job, datafeed);
       expect(Object.keys(resp.runtime_mappings).length).toEqual(0);
 
@@ -111,7 +111,7 @@ describe('filter_runtime_mappings', () => {
       expect(resp.discarded_mappings.airline_lower).not.toEqual(undefined);
     });
 
-    test('returns no runtime mappings, no runtime mappings in datafeed', () => {
+    test('returns no runtime fields, no runtime fields in datafeed', () => {
       datafeed.runtime_mappings = undefined;
       const resp = filterRuntimeMappings(job, datafeed);
       expect(Object.keys(resp.runtime_mappings).length).toEqual(0);
@@ -131,7 +131,7 @@ describe('filter_runtime_mappings', () => {
       expect(resp.discarded_mappings.airline_lower).not.toEqual(undefined);
     });
 
-    test('return no runtime mappings, no mappings in aggs', () => {
+    test('return no runtime fields, no mappings in aggs', () => {
       datafeed.aggregations = getAggs();
       datafeed.aggregations!.buckets!.aggregations!.responsetime!.avg!.field! = 'responsetime';
 
@@ -154,7 +154,7 @@ describe('filter_runtime_mappings', () => {
       expect(resp.discarded_mappings.airline_lower).not.toEqual(undefined);
     });
 
-    test('return two runtime mappings, no mappings in aggs', () => {
+    test('return two runtime fields, no mappings in aggs', () => {
       // set the detector field to be a runtime mapping
       job.analysis_config.detectors[0].field_name = 'responsetime_big';
       // set the detector by field to be a runtime mapping
@@ -167,7 +167,7 @@ describe('filter_runtime_mappings', () => {
       expect(Object.keys(resp.discarded_mappings).length).toEqual(0);
     });
 
-    test('return two runtime mappings, no mappings in aggs, categorization job', () => {
+    test('return two runtime fields, no mappings in aggs, categorization job', () => {
       job.analysis_config.detectors[0].function = 'count';
       // set the detector field to be a runtime mapping
       job.analysis_config.detectors[0].field_name = undefined;
diff --git a/x-pack/plugins/ml/public/application/services/results_service/results_service.js b/x-pack/plugins/ml/public/application/services/results_service/results_service.js
index c258d07cab4840..71be7bcd2b7eb7 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/results_service.js
+++ b/x-pack/plugins/ml/public/application/services/results_service/results_service.js
@@ -970,7 +970,7 @@ export function resultsServiceProvider(mlApiServices) {
                   },
                 },
               },
-              // Runtime mappings only needed to support when query includes a runtime field
+              // Runtime fields only needed to support when query includes a runtime field
               // even though the default timeField can be a search time runtime field
               // because currently Kibana doesn't support that
               ...(isPopulatedObject(runtimeMappings) && query
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable_factory.ts b/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable_factory.ts
index ac5ff2094e22b4..4788d809f016ff 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable_factory.ts
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable_factory.ts
@@ -9,6 +9,7 @@ import { i18n } from '@kbn/i18n';
 
 import type { StartServicesAccessor } from 'kibana/public';
 
+import { PLUGIN_ICON, PLUGIN_ID, ML_APP_NAME } from '../../../common/constants/app';
 import type {
   EmbeddableFactoryDefinition,
   IContainer,
@@ -27,6 +28,14 @@ export class AnomalyChartsEmbeddableFactory
   implements EmbeddableFactoryDefinition<AnomalyChartsEmbeddableInput> {
   public readonly type = ANOMALY_EXPLORER_CHARTS_EMBEDDABLE_TYPE;
 
+  public readonly grouping = [
+    {
+      id: PLUGIN_ID,
+      getDisplayName: () => ML_APP_NAME,
+      getIconType: () => PLUGIN_ICON,
+    },
+  ];
+
   constructor(
     private getStartServices: StartServicesAccessor<MlStartDependencies, MlPluginStart>
   ) {}
@@ -37,7 +46,13 @@ export class AnomalyChartsEmbeddableFactory
 
   public getDisplayName() {
     return i18n.translate('xpack.ml.components.mlAnomalyExplorerEmbeddable.displayName', {
-      defaultMessage: 'ML anomaly chart',
+      defaultMessage: 'Anomaly chart',
+    });
+  }
+
+  public getDescription() {
+    return i18n.translate('xpack.ml.components.mlAnomalyExplorerEmbeddable.description', {
+      defaultMessage: 'View anomaly detection results in a chart.',
     });
   }
 
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts
index fdb2ef8527923b..bc45e075710c55 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts
@@ -9,6 +9,7 @@ import { i18n } from '@kbn/i18n';
 
 import type { StartServicesAccessor } from 'kibana/public';
 
+import { PLUGIN_ID, PLUGIN_ICON, ML_APP_NAME } from '../../../common/constants/app';
 import type {
   EmbeddableFactoryDefinition,
   IContainer,
@@ -26,6 +27,14 @@ export class AnomalySwimlaneEmbeddableFactory
   implements EmbeddableFactoryDefinition<AnomalySwimlaneEmbeddableInput> {
   public readonly type = ANOMALY_SWIMLANE_EMBEDDABLE_TYPE;
 
+  public readonly grouping = [
+    {
+      id: PLUGIN_ID,
+      getDisplayName: () => ML_APP_NAME,
+      getIconType: () => PLUGIN_ICON,
+    },
+  ];
+
   constructor(
     private getStartServices: StartServicesAccessor<MlStartDependencies, MlPluginStart>
   ) {}
@@ -36,7 +45,13 @@ export class AnomalySwimlaneEmbeddableFactory
 
   public getDisplayName() {
     return i18n.translate('xpack.ml.components.jobAnomalyScoreEmbeddable.displayName', {
-      defaultMessage: 'ML anomaly swim lane',
+      defaultMessage: 'Anomaly swim lane',
+    });
+  }
+
+  public getDescription() {
+    return i18n.translate('xpack.ml.components.jobAnomalyScoreEmbeddable.description', {
+      defaultMessage: 'View anomaly detection results in a timeline.',
     });
   }
 
diff --git a/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts b/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts
index 81529669749bce..04d9fcfce7d612 100644
--- a/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts
+++ b/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts
@@ -7,8 +7,6 @@
 
 import Boom from '@hapi/boom';
 import rison from 'rison-node';
-import { ElasticsearchClient } from 'kibana/server';
-import moment from 'moment';
 import { Duration } from 'moment/moment';
 import { MlClient } from '../ml_client';
 import {
@@ -27,8 +25,10 @@ import {
 } from '../../../common/types/alerts';
 import { AnomalyDetectionAlertContext } from './register_anomaly_detection_alert_type';
 import { MlJobsResponse } from '../../../common/types/job_service';
-import { resolveBucketSpanInSeconds } from '../../../common/util/job_utils';
+import { resolveMaxTimeInterval } from '../../../common/util/job_utils';
 import { isDefined } from '../../../common/types/guards';
+import { getTopNBuckets, resolveLookbackInterval } from '../../../common/util/alerts';
+import type { DatafeedsService } from '../../models/job_service/datafeeds';
 
 type AggResultsResponse = { key?: number } & {
   [key in PreviewResultsKeys]: {
@@ -40,12 +40,21 @@ type AggResultsResponse = { key?: number } & {
   };
 };
 
+/**
+ * Mapping for result types and corresponding score fields.
+ */
+const resultTypeScoreMapping = {
+  [ANOMALY_RESULT_TYPE.BUCKET]: 'anomaly_score',
+  [ANOMALY_RESULT_TYPE.RECORD]: 'record_score',
+  [ANOMALY_RESULT_TYPE.INFLUENCER]: 'influencer_score',
+};
+
 /**
  * Alerting related server-side methods
  * @param mlClient
- * @param esClient
+ * @param datafeedsService
  */
-export function alertingServiceProvider(mlClient: MlClient, esClient: ElasticsearchClient) {
+export function alertingServiceProvider(mlClient: MlClient, datafeedsService: DatafeedsService) {
   const getAggResultsLabel = (resultType: AnomalyResultType) => {
     return {
       aggGroupLabel: `${resultType}_results` as PreviewResultsKeys,
@@ -332,7 +341,16 @@ export function alertingServiceProvider(mlClient: MlClient, esClient: Elasticsea
 
     if (jobsResponse.length === 0) {
       // Probably assigned groups don't contain any jobs anymore.
-      return;
+      throw new Error("Couldn't find the job with provided id");
+    }
+
+    const maxBucket = resolveMaxTimeInterval(
+      jobsResponse.map((v) => v.analysis_config.bucket_span)
+    );
+
+    if (maxBucket === undefined) {
+      // Technically it's not possible, just in case.
+      throw new Error('Unable to resolve a valid bucket length');
     }
 
     /**
@@ -341,9 +359,7 @@ export function alertingServiceProvider(mlClient: MlClient, esClient: Elasticsea
      */
     const lookBackTimeInterval = `${Math.max(
       // Double the max bucket span
-      Math.round(
-        resolveBucketSpanInSeconds(jobsResponse.map((v) => v.analysis_config.bucket_span)) * 2
-      ),
+      Math.round(maxBucket * 2),
       checkIntervalGap ? Math.round(checkIntervalGap.asSeconds()) : 0
     )}s`;
 
@@ -368,7 +384,7 @@ export function alertingServiceProvider(mlClient: MlClient, esClient: Elasticsea
             },
             {
               terms: {
-                result_type: Object.values(ANOMALY_RESULT_TYPE),
+                result_type: Object.values(ANOMALY_RESULT_TYPE) as string[],
               },
             },
             ...(params.includeInterim
@@ -431,6 +447,139 @@ export function alertingServiceProvider(mlClient: MlClient, esClient: Elasticsea
     ).filter(isDefined);
   };
 
+  /**
+   * Fetches the most recent anomaly according the top N buckets within the lookback interval
+   * that satisfies a rule criteria.
+   *
+   * @param params - Alert params
+   */
+  const fetchResult = async (
+    params: MlAnomalyDetectionAlertParams
+  ): Promise<AlertExecutionResult | undefined> => {
+    const jobAndGroupIds = [
+      ...(params.jobSelection.jobIds ?? []),
+      ...(params.jobSelection.groupIds ?? []),
+    ];
+
+    // Extract jobs from group ids and make sure provided jobs assigned to a current space
+    const jobsResponse = (
+      await mlClient.getJobs<MlJobsResponse>({ job_id: jobAndGroupIds.join(',') })
+    ).body.jobs;
+
+    if (jobsResponse.length === 0) {
+      // Probably assigned groups don't contain any jobs anymore.
+      return;
+    }
+
+    const jobIds = jobsResponse.map((v) => v.job_id);
+
+    const dataFeeds = await datafeedsService.getDatafeedByJobId(jobIds);
+
+    const maxBucketInSeconds = resolveMaxTimeInterval(
+      jobsResponse.map((v) => v.analysis_config.bucket_span)
+    );
+
+    if (maxBucketInSeconds === undefined) {
+      // Technically it's not possible, just in case.
+      throw new Error('Unable to resolve a valid bucket length');
+    }
+
+    const lookBackTimeInterval: string =
+      params.lookbackInterval ?? resolveLookbackInterval(jobsResponse, dataFeeds ?? []);
+
+    const topNBuckets: number = params.topNBuckets ?? getTopNBuckets(jobsResponse[0]);
+
+    const requestBody = {
+      size: 0,
+      query: {
+        bool: {
+          filter: [
+            {
+              terms: { job_id: jobIds },
+            },
+            {
+              terms: {
+                result_type: Object.values(ANOMALY_RESULT_TYPE) as string[],
+              },
+            },
+            {
+              range: {
+                timestamp: {
+                  gte: `now-${lookBackTimeInterval}`,
+                },
+              },
+            },
+            ...(params.includeInterim
+              ? []
+              : [
+                  {
+                    term: { is_interim: false },
+                  },
+                ]),
+          ],
+        },
+      },
+      aggs: {
+        alerts_over_time: {
+          date_histogram: {
+            field: 'timestamp',
+            fixed_interval: `${maxBucketInSeconds}s`,
+            order: {
+              _key: 'desc' as const,
+            },
+          },
+          aggs: {
+            max_score: {
+              max: {
+                field: resultTypeScoreMapping[params.resultType],
+              },
+            },
+            ...getResultTypeAggRequest(params.resultType, params.severity),
+            truncate: {
+              bucket_sort: {
+                size: topNBuckets,
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const response = await mlClient.anomalySearch(
+      {
+        // @ts-expect-error
+        body: requestBody,
+      },
+      jobIds
+    );
+
+    const result = response.body.aggregations as {
+      alerts_over_time: {
+        buckets: Array<
+          {
+            doc_count: number;
+            key: number;
+            key_as_string: string;
+            max_score: {
+              value: number;
+            };
+          } & AggResultsResponse
+        >;
+      };
+    };
+
+    if (result.alerts_over_time.buckets.length === 0) {
+      return;
+    }
+
+    // Find the most anomalous result from the top N buckets
+    const topResult = result.alerts_over_time.buckets.reduce((prev, current) =>
+      prev.max_score.value > current.max_score.value ? prev : current
+    );
+
+    return getResultsFormatter(params.resultType)(topResult);
+  };
+
   /**
    * TODO Replace with URL generator when https://github.com/elastic/kibana/issues/59453 is resolved
    * @param r
@@ -520,17 +669,8 @@ export function alertingServiceProvider(mlClient: MlClient, esClient: Elasticsea
       startedAt: Date,
       previousStartedAt: Date | null
     ): Promise<AnomalyDetectionAlertContext | undefined> => {
-      const checkIntervalGap = previousStartedAt
-        ? moment.duration(moment(startedAt).diff(previousStartedAt))
-        : undefined;
-
-      const res = await fetchAnomalies(params, undefined, checkIntervalGap);
-
-      if (!res) {
-        throw new Error('No results found');
-      }
+      const result = await fetchResult(params);
 
-      const result = res[0];
       if (!result) return;
 
       const anomalyExplorerUrl = buildExplorerUrl(result, params.resultType);
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/manifest.json
index 2a2c0c202f66b3..384ea006b5b421 100755
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/manifest.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/manifest.json
@@ -36,22 +36,22 @@
   ],
   "datafeeds": [
     {
-      "id": "datafeed_high_count_by_destination_country",
+      "id": "datafeed-high_count_by_destination_country",
       "file": "datafeed_high_count_by_destination_country.json",
       "job_id": "high_count_by_destination_country"
     },
     {
-      "id": "datafeed_high_count_network_denies",
+      "id": "datafeed-high_count_network_denies",
       "file": "datafeed_high_count_network_denies.json",
       "job_id": "high_count_network_denies"
     },
     {
-      "id": "datafeed_high_count_network_events",
+      "id": "datafeed-high_count_network_events",
       "file": "datafeed_high_count_network_events.json",
       "job_id": "high_count_network_events"
     },
     {
-      "id": "datafeed_rare_destination_country",
+      "id": "datafeed-rare_destination_country",
       "file": "datafeed_rare_destination_country.json",
       "job_id": "rare_destination_country"
     }
diff --git a/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts b/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
index 64ee18c6880464..e7c723ba16abaa 100644
--- a/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
+++ b/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
@@ -627,7 +627,7 @@ export class DataVisualizer {
     // filter aggregation with exists query.
     const aggs: Aggs = datafeedAggregations !== undefined ? { ...datafeedAggregations } : {};
 
-    // Combine runtime mappings from the index pattern as well as the datafeed
+    // Combine runtime fields from the index pattern as well as the datafeed
     const combinedRuntimeMappings: RuntimeMappings = {
       ...(isPopulatedObject(runtimeMappings) ? runtimeMappings : {}),
       ...(isPopulatedObject(datafeedConfig) && isPopulatedObject(datafeedConfig.runtime_mappings)
diff --git a/x-pack/plugins/ml/server/models/job_service/datafeeds.ts b/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
index 8279571adbae27..72255e168249a1 100644
--- a/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
+++ b/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
@@ -34,6 +34,8 @@ interface Results {
   };
 }
 
+export type DatafeedsService = ReturnType<typeof datafeedsProvider>;
+
 export function datafeedsProvider(client: IScopedClusterClient, mlClient: MlClient) {
   async function forceStartDatafeeds(datafeedIds: string[], start?: number, end?: number) {
     const jobIds = await getJobIdsByDatafeedId();
@@ -168,25 +170,39 @@ export function datafeedsProvider(client: IScopedClusterClient, mlClient: MlClie
     }, {} as { [id: string]: string });
   }
 
+  async function getDatafeedByJobId(
+    jobId: string[],
+    excludeGenerated?: boolean
+  ): Promise<Datafeed[] | undefined>;
+
   async function getDatafeedByJobId(
     jobId: string,
     excludeGenerated?: boolean
-  ): Promise<Datafeed | undefined> {
+  ): Promise<Datafeed | undefined>;
+
+  async function getDatafeedByJobId(
+    jobId: string | string[],
+    excludeGenerated?: boolean
+  ): Promise<Datafeed | Datafeed[] | undefined> {
+    const jobIds = Array.isArray(jobId) ? jobId : [jobId];
+
     async function findDatafeed() {
       // if the job was doesn't use the standard datafeedId format
       // get all the datafeeds and match it with the jobId
       const {
         body: { datafeeds },
-      } = await mlClient.getDatafeeds(excludeGenerated ? { exclude_generated: true } : {}); //
-      for (const result of datafeeds) {
-        if (result.job_id === jobId) {
-          return result;
-        }
+      } = await mlClient.getDatafeeds(excludeGenerated ? { exclude_generated: true } : {});
+      if (typeof jobId === 'string') {
+        return datafeeds.find((v) => v.job_id === jobId);
+      }
+
+      if (Array.isArray(jobId)) {
+        return datafeeds.filter((v) => jobIds.includes(v.job_id));
       }
     }
     // if the job was created by the wizard,
     // then we can assume it uses the standard format of the datafeedId
-    const assumedDefaultDatafeedId = `datafeed-${jobId}`;
+    const assumedDefaultDatafeedId = jobIds.map((v) => `datafeed-${v}`).join(',');
     try {
       const {
         body: { datafeeds: datafeedsResults },
@@ -194,12 +210,22 @@ export function datafeedsProvider(client: IScopedClusterClient, mlClient: MlClie
         datafeed_id: assumedDefaultDatafeedId,
         ...(excludeGenerated ? { exclude_generated: true } : {}),
       });
-      if (
-        Array.isArray(datafeedsResults) &&
-        datafeedsResults.length === 1 &&
-        datafeedsResults[0].job_id === jobId
-      ) {
-        return datafeedsResults[0];
+      if (Array.isArray(datafeedsResults)) {
+        const result = datafeedsResults.filter((d) => jobIds.includes(d.job_id));
+
+        if (typeof jobId === 'string') {
+          if (datafeedsResults.length === 1 && datafeedsResults[0].job_id === jobId) {
+            return datafeedsResults[0];
+          } else {
+            return await findDatafeed();
+          }
+        }
+
+        if (result.length === jobIds.length) {
+          return datafeedsResults;
+        } else {
+          return await findDatafeed();
+        }
       } else {
         return await findDatafeed();
       }
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts b/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts
index 18dc6d3dc73c6a..403d6738a4ce69 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_cardinality.ts
@@ -166,7 +166,7 @@ const validateFactory = (client: IScopedClusterClient, job: CombinedJob): Valida
                 }
               } else {
                 // only report uniqueFieldName as not aggregatable if it's not part
-                // of a valid categorization configuration and if it's not a scripted field or runtime mapping.
+                // of a valid categorization configuration and if it's not a scripted field or runtime field.
                 if (
                   !isValidCategorizationConfig(job, uniqueFieldName) &&
                   !isScriptField(job, uniqueFieldName) &&
diff --git a/x-pack/plugins/ml/server/routes/alerting.ts b/x-pack/plugins/ml/server/routes/alerting.ts
index a268a5200b35e7..15b7fb6fb4e96d 100644
--- a/x-pack/plugins/ml/server/routes/alerting.ts
+++ b/x-pack/plugins/ml/server/routes/alerting.ts
@@ -9,6 +9,7 @@ import { RouteInitialization } from '../types';
 import { wrapError } from '../client/error_wrapper';
 import { alertingServiceProvider } from '../lib/alerts/alerting_service';
 import { mlAnomalyDetectionAlertPreviewRequest } from './schemas/alerting_schema';
+import { datafeedsProvider } from '../models/job_service/datafeeds';
 
 export function alertingRoutes({ router, routeGuard }: RouteInitialization) {
   /**
@@ -32,7 +33,10 @@ export function alertingRoutes({ router, routeGuard }: RouteInitialization) {
     },
     routeGuard.fullLicenseAPIGuard(async ({ mlClient, request, response, client }) => {
       try {
-        const alertingService = alertingServiceProvider(mlClient, client.asInternalUser);
+        const alertingService = alertingServiceProvider(
+          mlClient,
+          datafeedsProvider(client, mlClient)
+        );
 
         const result = await alertingService.preview(request.body);
 
diff --git a/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts b/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts
index faf70f42e427e5..df22ccfe208217 100644
--- a/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts
@@ -26,13 +26,19 @@ export const mlAnomalyDetectionAlertParams = schema.object({
       },
     }
   ),
-  severity: schema.number(),
+  /** Anomaly score threshold  */
+  severity: schema.number({ min: 0, max: 100 }),
+  /** Result type to alert upon  */
   resultType: schema.oneOf([
     schema.literal(ANOMALY_RESULT_TYPE.RECORD),
     schema.literal(ANOMALY_RESULT_TYPE.BUCKET),
     schema.literal(ANOMALY_RESULT_TYPE.INFLUENCER),
   ]),
   includeInterim: schema.boolean({ defaultValue: true }),
+  /** User's override for the lookback interval */
+  lookbackInterval: schema.nullable(schema.string()),
+  /** User's override for the top N buckets  */
+  topNBuckets: schema.nullable(schema.number({ min: 1 })),
 });
 
 export const mlAnomalyDetectionAlertPreviewRequest = schema.object({
diff --git a/x-pack/plugins/ml/server/routes/schemas/data_visualizer_schema.ts b/x-pack/plugins/ml/server/routes/schemas/data_visualizer_schema.ts
index 0d7e55d29b1c5c..50b48aad9cee41 100644
--- a/x-pack/plugins/ml/server/routes/schemas/data_visualizer_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/data_visualizer_schema.ts
@@ -20,7 +20,7 @@ export const dataVisualizerFieldHistogramsSchema = schema.object({
   fields: schema.arrayOf(schema.any()),
   /** Number of documents to be collected in the sample processed on each shard, or -1 for no sampling. */
   samplerShardSize: schema.number(),
-  /** Optional search time runtime mappings */
+  /** Optional search time runtime fields */
   runtimeMappings: runtimeMappingsSchema,
 });
 
@@ -40,7 +40,7 @@ export const dataVisualizerFieldStatsSchema = schema.object({
   interval: schema.maybe(schema.number()),
   /** Maximum number of examples to return for text type fields.  */
   maxExamples: schema.number(),
-  /** Optional search time runtime mappings */
+  /** Optional search time runtime fields */
   runtimeMappings: runtimeMappingsSchema,
 });
 
@@ -59,6 +59,6 @@ export const dataVisualizerOverallStatsSchema = schema.object({
   earliest: schema.maybe(schema.number()),
   /** Latest timestamp for search, as epoch ms (optional). */
   latest: schema.maybe(schema.number()),
-  /** Optional search time runtime mappings */
+  /** Optional search time runtime fields */
   runtimeMappings: runtimeMappingsSchema,
 });
diff --git a/x-pack/plugins/ml/server/shared_services/providers/alerting_service.ts b/x-pack/plugins/ml/server/shared_services/providers/alerting_service.ts
index cbe22478e12d6c..fa08cdf81fe1cc 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/alerting_service.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/alerting_service.ts
@@ -8,6 +8,7 @@
 import { KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
 import { GetGuards } from '../shared_services';
 import { alertingServiceProvider, MlAlertingService } from '../../lib/alerts/alerting_service';
+import { datafeedsProvider } from '../../models/job_service/datafeeds';
 
 export function getAlertingServiceProvider(getGuards: GetGuards) {
   return {
@@ -21,7 +22,9 @@ export function getAlertingServiceProvider(getGuards: GetGuards) {
             .isFullLicense()
             .hasMlCapabilities(['canGetJobs'])
             .ok(({ mlClient, scopedClient }) =>
-              alertingServiceProvider(mlClient, scopedClient.asInternalUser).preview(...args)
+              alertingServiceProvider(mlClient, datafeedsProvider(scopedClient, mlClient)).preview(
+                ...args
+              )
             );
         },
         execute: async (
@@ -31,7 +34,9 @@ export function getAlertingServiceProvider(getGuards: GetGuards) {
             .isFullLicense()
             .hasMlCapabilities(['canGetJobs'])
             .ok(({ mlClient, scopedClient }) =>
-              alertingServiceProvider(mlClient, scopedClient.asInternalUser).execute(...args)
+              alertingServiceProvider(mlClient, datafeedsProvider(scopedClient, mlClient)).execute(
+                ...args
+              )
             );
         },
       };
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index 87134c765fbf96..6b47b47a213944 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -230,7 +230,7 @@ export class MonitoringPlugin
     if (this.cluster) {
       this.cluster.close();
     }
-    if (this.licenseService) {
+    if (this.licenseService && this.licenseService.stop) {
       this.licenseService.stop();
     }
     this.bulkUploader?.stop();
diff --git a/x-pack/plugins/observability/README.md b/x-pack/plugins/observability/README.md
index 0ef0543c2922e3..b882891921cde4 100644
--- a/x-pack/plugins/observability/README.md
+++ b/x-pack/plugins/observability/README.md
@@ -2,6 +2,28 @@
 
 This plugin provides shared components and services for use across observability solutions, as well as the observability landing page UI.
 
+## Rules, Alerts, and Cases
+
+The Observability plugin contains experimental support for improved alerting and
+case management.
+
+If you have:
+
+```yaml
+xpack.observability.unsafe.alertingExperience.enabled: true
+```
+
+In your Kibana configuration, the Alerts and Cases pages will be available.
+
+This will only enable the UI for these pages. In order to have alert data indexed
+you'll need to enable writing in the [Rule Registry plugin](../rule_registry/README.md):
+
+```yaml
+xpack.ruleRegistry.unsafe.write.enabled: true
+```
+
+When both of the these are set to `true`, your alerts should show on the alerts page.
+
 ## Unit testing
 
 Note: Run the following commands from `kibana/x-pack/plugins/observability`.
diff --git a/x-pack/plugins/observability/common/observability_rule_registry.ts b/x-pack/plugins/observability/common/observability_rule_registry.ts
deleted file mode 100644
index 9254401fc19c4c..00000000000000
--- a/x-pack/plugins/observability/common/observability_rule_registry.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { ecsFieldMap, pickWithPatterns } from '../../rule_registry/common';
-
-export const observabilityRuleRegistrySettings = {
-  name: 'observability',
-  fieldMap: {
-    ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
-    'kibana.observability.evaluation.value': {
-      type: 'scaled_float' as const,
-      scaling_factor: 1000,
-    },
-    'kibana.observability.evaluation.threshold': {
-      type: 'scaled_float' as const,
-      scaling_factor: 1000,
-    },
-  },
-};
diff --git a/x-pack/plugins/observability/common/rules/observability_rule_field_map.ts b/x-pack/plugins/observability/common/rules/observability_rule_field_map.ts
new file mode 100644
index 00000000000000..370f5d4ef79f20
--- /dev/null
+++ b/x-pack/plugins/observability/common/rules/observability_rule_field_map.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ecsFieldMap, pickWithPatterns } from '../../../rule_registry/common';
+
+export const observabilityRuleFieldMap = {
+  ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
+  'kibana.observability.evaluation.value': {
+    type: 'scaled_float' as const,
+    scaling_factor: 1000,
+  },
+  'kibana.observability.evaluation.threshold': {
+    type: 'scaled_float' as const,
+    scaling_factor: 1000,
+  },
+};
+
+export type ObservabilityRuleFieldMap = typeof observabilityRuleFieldMap;
diff --git a/x-pack/plugins/observability/common/rules/observability_rule_registry_settings.ts b/x-pack/plugins/observability/common/rules/observability_rule_registry_settings.ts
new file mode 100644
index 00000000000000..c901d912eb70ff
--- /dev/null
+++ b/x-pack/plugins/observability/common/rules/observability_rule_registry_settings.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const observabilityRuleRegistrySettings = {
+  name: 'observability',
+};
diff --git a/x-pack/plugins/observability/common/ui_settings_keys.ts b/x-pack/plugins/observability/common/ui_settings_keys.ts
index cb6ea799078a21..bd536474882565 100644
--- a/x-pack/plugins/observability/common/ui_settings_keys.ts
+++ b/x-pack/plugins/observability/common/ui_settings_keys.ts
@@ -5,5 +5,4 @@
  * 2.0.
  */
 
-export const enableAlertingExperience = 'observability:enableAlertingExperience';
 export const enableInspectEsQueries = 'observability:enableInspectEsQueries';
diff --git a/x-pack/plugins/observability/public/application/application.test.tsx b/x-pack/plugins/observability/public/application/application.test.tsx
index 34ee22e89e66b6..c0b51652a7d0e8 100644
--- a/x-pack/plugins/observability/public/application/application.test.tsx
+++ b/x-pack/plugins/observability/public/application/application.test.tsx
@@ -45,6 +45,7 @@ describe('renderApp', () => {
       uiSettings: { get: () => false },
       http: { basePath: { prepend: (path: string) => path } },
     } as unknown) as CoreStart;
+    const config = { unsafe: { alertingExperience: { enabled: true } } };
     const params = ({
       element: window.document.createElement('div'),
       history: createMemoryHistory(),
@@ -53,6 +54,7 @@ describe('renderApp', () => {
 
     expect(() => {
       const unmount = renderApp({
+        config,
         core,
         plugins,
         appMountParameters: params,
diff --git a/x-pack/plugins/observability/public/application/index.tsx b/x-pack/plugins/observability/public/application/index.tsx
index aa7d1d037d7b74..8607b57b42666f 100644
--- a/x-pack/plugins/observability/public/application/index.tsx
+++ b/x-pack/plugins/observability/public/application/index.tsx
@@ -22,6 +22,7 @@ import { ObservabilityPublicPluginsStart, ObservabilityRuleRegistry } from '../p
 import { HasDataContextProvider } from '../context/has_data_context';
 import { Breadcrumbs, routes } from '../routes';
 import { Storage } from '../../../../../src/plugins/kibana_utils/public';
+import { ConfigSchema } from '..';
 
 function getTitleFromBreadCrumbs(breadcrumbs: Breadcrumbs) {
   return breadcrumbs.map(({ text }) => text).reverse();
@@ -67,11 +68,13 @@ function App() {
 }
 
 export const renderApp = ({
+  config,
   core,
   plugins,
   appMountParameters,
   observabilityRuleRegistry,
 }: {
+  config: ConfigSchema;
   core: CoreStart;
   plugins: ObservabilityPublicPluginsStart;
   observabilityRuleRegistry: ObservabilityRuleRegistry;
@@ -91,7 +94,7 @@ export const renderApp = ({
   ReactDOM.render(
     <KibanaContextProvider services={{ ...core, ...plugins, storage: new Storage(localStorage) }}>
       <PluginContext.Provider
-        value={{ appMountParameters, core, plugins, observabilityRuleRegistry }}
+        value={{ appMountParameters, config, core, plugins, observabilityRuleRegistry }}
       >
         <Router history={history}>
           <EuiThemeProvider darkMode={isDarkMode}>
diff --git a/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx b/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx
index adc6a0208dc423..0adb9ceb6e9f89 100644
--- a/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/alerts/index.tsx
@@ -21,7 +21,6 @@ import React, { useState } from 'react';
 import { EuiSelect } from '@elastic/eui';
 import { uniqBy } from 'lodash';
 import { Alert } from '../../../../../../alerting/common';
-import { enableAlertingExperience } from '../../../../../common/ui_settings_keys';
 import { usePluginContext } from '../../../../hooks/use_plugin_context';
 import { SectionContainer } from '..';
 
@@ -38,10 +37,9 @@ interface Props {
 }
 
 export function AlertsSection({ alerts }: Props) {
-  const { core } = usePluginContext();
+  const { config, core } = usePluginContext();
   const [filter, setFilter] = useState(ALL_TYPES);
-
-  const href = core.uiSettings.get(enableAlertingExperience)
+  const href = config.unsafe.alertingExperience.enabled
     ? '/app/observability/alerts'
     : '/app/management/insightsAndAlerting/triggersActions/alerts';
 
diff --git a/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx b/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
index 8ff68a04660540..d41f131ef521b9 100644
--- a/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
@@ -40,6 +40,7 @@ describe('APMSection', () => {
         http: { basePath: { prepend: jest.fn() } },
       } as unknown) as CoreStart,
       appMountParameters: {} as AppMountParameters,
+      config: { unsafe: { alertingExperience: { enabled: true } } },
       observabilityRuleRegistry: ({
         registerType: jest.fn(),
         getTypeByRuleId: jest.fn(),
diff --git a/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx b/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx
index 290990a5c05a5c..fa4d1a744e3eae 100644
--- a/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/ux/index.test.tsx
@@ -40,6 +40,7 @@ describe('UXSection', () => {
         http: { basePath: { prepend: jest.fn() } },
       } as unknown) as CoreStart,
       appMountParameters: {} as AppMountParameters,
+      config: { unsafe: { alertingExperience: { enabled: true } } },
       plugins: ({
         data: {
           query: {
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx
index 17f1b039667d0b..69b8b6eb89e468 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx
@@ -6,27 +6,44 @@
  */
 
 import React from 'react';
-import { EuiImage } from '@elastic/eui';
+import { EuiImage, EuiProgress, EuiSpacer, EuiText } from '@elastic/eui';
 import styled from 'styled-components';
 import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { INITIATING_VIEW } from '../series_builder/series_builder';
 
-export function EmptyView() {
+export function EmptyView({ loading }: { loading: boolean }) {
   const {
     services: { http },
   } = useKibana();
 
   return (
     <Wrapper>
-      <EuiImage
+      {loading && (
+        <EuiProgress
+          size="xs"
+          color="accent"
+          position="absolute"
+          style={{
+            top: 'initial',
+          }}
+        />
+      )}
+      <EuiSpacer />
+      <ImageWrap
         alt="Visulization"
         url={http!.basePath.prepend(`/plugins/observability/assets/kibana_dashboard_light.svg`)}
       />
+      <EuiText>{INITIATING_VIEW}</EuiText>
     </Wrapper>
   );
 }
 
+const ImageWrap = styled(EuiImage)`
+  opacity: 0.4;
+`;
+
 const Wrapper = styled.div`
   text-align: center;
-  opacity: 0.4;
   height: 550px;
+  position: relative;
 `;
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
index 7b5dde852cf904..6bc91be876cf71 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
@@ -27,7 +27,7 @@ export function ExploratoryView() {
     null
   );
 
-  const { loadIndexPattern } = useAppIndexPatternContext();
+  const { loadIndexPattern, loading } = useAppIndexPatternContext();
 
   const LensComponent = lens?.EmbeddableComponent;
 
@@ -61,7 +61,7 @@ export function ExploratoryView() {
               attributes={lensAttributes}
             />
           ) : (
-            <EmptyView />
+            <EmptyView loading={loading} />
           )}
           <SeriesEditor />
         </>
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx
index 5831b8be04c38c..db6e075cc90fba 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx
@@ -228,9 +228,12 @@ export function SeriesBuilder() {
   );
 }
 
-const INITIATING_VIEW = i18n.translate('xpack.observability.expView.seriesBuilder.initView', {
-  defaultMessage: 'Initiating view ...',
-});
+export const INITIATING_VIEW = i18n.translate(
+  'xpack.observability.expView.seriesBuilder.initView',
+  {
+    defaultMessage: 'Initiating view ...',
+  }
+);
 
 const SELECT_REPORT_TYPE = i18n.translate(
   'xpack.observability.expView.seriesBuilder.selectReportType',
diff --git a/x-pack/plugins/observability/public/context/plugin_context.tsx b/x-pack/plugins/observability/public/context/plugin_context.tsx
index 7a6daca6e79236..eea259b36d5b95 100644
--- a/x-pack/plugins/observability/public/context/plugin_context.tsx
+++ b/x-pack/plugins/observability/public/context/plugin_context.tsx
@@ -8,9 +8,11 @@
 import { createContext } from 'react';
 import { AppMountParameters, CoreStart } from 'kibana/public';
 import { ObservabilityPublicPluginsStart, ObservabilityRuleRegistry } from '../plugin';
+import { ConfigSchema } from '..';
 
 export interface PluginContextValue {
   appMountParameters: AppMountParameters;
+  config: ConfigSchema;
   core: CoreStart;
   plugins: ObservabilityPublicPluginsStart;
   observabilityRuleRegistry: ObservabilityRuleRegistry;
diff --git a/x-pack/plugins/observability/public/hooks/use_time_range.test.ts b/x-pack/plugins/observability/public/hooks/use_time_range.test.ts
index 61505d4850dc44..43fbc18062b759 100644
--- a/x-pack/plugins/observability/public/hooks/use_time_range.test.ts
+++ b/x-pack/plugins/observability/public/hooks/use_time_range.test.ts
@@ -24,6 +24,7 @@ describe('useTimeRange', () => {
     jest.spyOn(pluginContext, 'usePluginContext').mockImplementation(() => ({
       core: {} as CoreStart,
       appMountParameters: {} as AppMountParameters,
+      config: { unsafe: { alertingExperience: { enabled: true } } },
       plugins: ({
         data: {
           query: {
@@ -65,6 +66,7 @@ describe('useTimeRange', () => {
         jest.spyOn(pluginContext, 'usePluginContext').mockImplementation(() => ({
           core: {} as CoreStart,
           appMountParameters: {} as AppMountParameters,
+          config: { unsafe: { alertingExperience: { enabled: true } } },
           plugins: ({
             data: {
               query: {
diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index ee2df9369aa392..b34b1f81467d93 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -21,12 +21,16 @@ export type {
 };
 export { enableInspectEsQueries } from '../common/ui_settings_keys';
 
+export interface ConfigSchema {
+  unsafe: { alertingExperience: { enabled: boolean } };
+}
+
 export const plugin: PluginInitializer<
   ObservabilityPublicSetup,
   ObservabilityPublicStart,
   ObservabilityPublicPluginsSetup,
   ObservabilityPublicPluginsStart
-> = (context: PluginInitializerContext) => {
+> = (context: PluginInitializerContext<ConfigSchema>) => {
   return new Plugin(context);
 };
 
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx
index 33eec65c40dce4..6940f6aaad6927 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts.stories.tsx
@@ -16,18 +16,12 @@ import { PluginContext, PluginContextValue } from '../../context/plugin_context'
 import { createObservabilityRuleRegistryMock } from '../../rules/observability_rule_registry_mock';
 import { createCallObservabilityApi } from '../../services/call_observability_api';
 import type { ObservabilityAPIReturnType } from '../../services/call_observability_api/types';
-import { AlertsFlyout } from './alerts_flyout';
-import { TopAlert } from './alerts_table';
-import { apmAlertResponseExample, dynamicIndexPattern, flyoutItemExample } from './example_data';
+import { apmAlertResponseExample, dynamicIndexPattern } from './example_data';
 
 interface PageArgs {
   items: ObservabilityAPIReturnType<'GET /api/observability/rules/alerts/top'>;
 }
 
-interface FlyoutArgs {
-  alert: TopAlert;
-}
-
 export default {
   title: 'app/Alerts',
   component: AlertsPage,
@@ -95,8 +89,3 @@ export function EmptyState(_args: PageArgs) {
   return <AlertsPage routeParams={{ query: {} }} />;
 }
 EmptyState.args = { items: [] } as PageArgs;
-
-export function Flyout({ alert }: FlyoutArgs) {
-  return <AlertsFlyout alert={alert} onClose={() => {}} />;
-}
-Flyout.args = { alert: flyoutItemExample } as FlyoutArgs;
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout.tsx
deleted file mode 100644
index 4b383283c4d4b4..00000000000000
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout.tsx
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiFlyout,
-  EuiFlyoutHeader,
-  EuiFlyoutProps,
-  EuiInMemoryTable,
-  EuiSpacer,
-  EuiTabbedContent,
-  EuiTitle,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React from 'react';
-import { asDuration } from '../../../common/utils/formatters';
-import { TopAlert } from './alerts_table';
-
-type AlertsFlyoutProps = { alert: TopAlert } & EuiFlyoutProps;
-
-export function AlertsFlyout(props: AlertsFlyoutProps) {
-  const { onClose, alert } = props;
-
-  const overviewListItems = [
-    {
-      title: 'Status',
-      description: alert.active ? 'Active' : 'Recovered',
-    },
-    {
-      title: 'Severity',
-      description: alert.severityLevel || '-', // TODO: badge and "(changed 2 min ago)"
-    },
-    // {
-    //   title: 'Affected entity',
-    //   description: affectedEntity || '-', // TODO: link to entity
-    // },
-    {
-      title: 'Triggered',
-      description: alert.start, // TODO: format date
-    },
-    {
-      title: 'Duration',
-      description: asDuration(alert.duration, { extended: true }) || '-', // TODO: format duration
-    },
-    // {
-    //   title: 'Expected value',
-    //   description: expectedValue || '-',
-    // },
-    // {
-    //   title: 'Actual value',
-    //   description: actualValue || '-',
-    // },
-    {
-      title: 'Rule type',
-      description: alert.ruleCategory || '-',
-    },
-  ];
-
-  const tabs = [
-    {
-      id: 'overview',
-      name: i18n.translate('xpack.observability.alerts.flyoutOverviewTabTitle', {
-        defaultMessage: 'Overview',
-      }),
-      content: (
-        <>
-          <EuiSpacer />
-          <EuiInMemoryTable
-            columns={[
-              { field: 'title', name: '' },
-              { field: 'description', name: '' },
-            ]}
-            items={overviewListItems}
-          />
-          {/* <EuiSpacer />
-          <EuiTitle size="xs">
-            <h4>Severity log</h4>
-          </EuiTitle>
-          <EuiInMemoryTable
-            columns={[
-              { field: '@timestamp', name: 'Timestamp', dataType: 'date' },
-              {
-                field: 'severity',
-                name: 'Severity',
-                render: (_, item) => (
-                  <>
-                    <EuiBadge>{item.severity}</EuiBadge> {item.message}
-                  </>
-                ),
-              },
-            ]}
-            items={severityLog ?? []}
-          /> */}
-        </>
-      ),
-    },
-    {
-      id: 'metadata',
-      name: i18n.translate('xpack.observability.alerts.flyoutMetadataTabTitle', {
-        defaultMessage: 'Metadata',
-      }),
-      disabled: true,
-      content: <></>,
-    },
-  ];
-
-  return (
-    <EuiFlyout onClose={onClose} size="s">
-      <EuiFlyoutHeader>
-        <EuiTitle size="xs">
-          <h2>{alert.ruleName}</h2>
-        </EuiTitle>
-        <EuiTabbedContent size="s" tabs={tabs} />
-      </EuiFlyoutHeader>
-    </EuiFlyout>
-  );
-}
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx
new file mode 100644
index 00000000000000..96d3c1fc9c3905
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/alerts_flyout.stories.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { ComponentType } from 'react';
+import { KibanaContextProvider } from '../../../../../../../src/plugins/kibana_react/public';
+import { PluginContext, PluginContextValue } from '../../../context/plugin_context';
+import { TopAlert } from '../';
+import { AlertsFlyout } from './';
+
+interface Args {
+  alert: TopAlert;
+}
+
+export default {
+  title: 'app/Alerts/AlertsFlyout',
+  component: AlertsFlyout,
+  decorators: [
+    (Story: ComponentType) => {
+      return (
+        <KibanaContextProvider
+          services={{
+            docLinks: { links: { query: {} } },
+            storage: { get: () => {} },
+            uiSettings: {
+              get: (setting: string) => {
+                if (setting === 'dateFormat') {
+                  return 'MMM D, YYYY @ HH:mm:ss.SSS';
+                }
+              },
+            },
+          }}
+        >
+          {' '}
+          <PluginContext.Provider
+            value={
+              ({
+                core: {
+                  http: { basePath: { prepend: (_: string) => '' } },
+                },
+              } as unknown) as PluginContextValue
+            }
+          >
+            <Story />
+          </PluginContext.Provider>
+        </KibanaContextProvider>
+        //
+      );
+    },
+  ],
+};
+
+export function Example({ alert }: Args) {
+  return <AlertsFlyout alert={alert} onClose={() => {}} />;
+}
+Example.args = {
+  alert: {
+    link: '/app/apm/services/opbeans-java?rangeFrom=now-15m&rangeTo=now',
+    reason: 'Error count for opbeans-java was above the threshold',
+    active: true,
+    start: 1618235449493,
+
+    'rule.id': 'apm.error_rate',
+    'service.environment': 'production',
+    'service.name': 'opbeans-java',
+    'rule.name': 'Error count threshold | opbeans-java (smith test)',
+    'kibana.rac.alert.duration.us': 61787000,
+    'kibana.observability.evaluation.threshold': 0,
+    'kibana.rac.alert.status': 'open',
+    tags: ['apm', 'service.name:opbeans-java'],
+    'kibana.rac.alert.uuid': 'c50fbc70-0d77-462d-ac0a-f2bd0b8512e4',
+    'rule.uuid': '474920d0-93e9-11eb-ac86-0b455460de81',
+    'event.action': 'active',
+    '@timestamp': '2021-04-14T21:43:42.966Z',
+    'kibana.rac.alert.id': 'apm.error_rate_opbeans-java_production',
+    'processor.event': 'error',
+    'kibana.rac.alert.start': '2021-04-14T21:42:41.179Z',
+    'kibana.rac.producer': 'apm',
+    'event.kind': 'state',
+    'rule.category': 'Error count threshold',
+    'kibana.observability.evaluation.value': 1,
+  },
+} as Args;
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
new file mode 100644
index 00000000000000..892274b2fb8b0d
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_flyout/index.tsx
@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiButton,
+  EuiDescriptionList,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFlyout,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiFlyoutHeader,
+  EuiFlyoutProps,
+  EuiSpacer,
+  EuiTabbedContent,
+  EuiText,
+  EuiTitle,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import moment from 'moment-timezone';
+import React from 'react';
+import { useUiSetting } from '../../../../../../../src/plugins/kibana_react/public';
+import { asDuration } from '../../../../common/utils/formatters';
+import { usePluginContext } from '../../../hooks/use_plugin_context';
+import { TopAlert } from '../';
+import { SeverityBadge } from '../severity_badge';
+
+type AlertsFlyoutProps = { alert: TopAlert } & EuiFlyoutProps;
+
+export function AlertsFlyout({ onClose, alert }: AlertsFlyoutProps) {
+  const dateFormat = useUiSetting<string>('dateFormat');
+  const { core } = usePluginContext();
+  const { prepend } = core.http.basePath;
+
+  const overviewListItems = [
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.statusLabel', {
+        defaultMessage: 'Status',
+      }),
+      description: alert.active ? 'Active' : 'Recovered',
+    },
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.severityLabel', {
+        defaultMessage: 'Severity',
+      }),
+      description: <SeverityBadge severityLevel={alert['kibana.rac.alert.severity.level']} />,
+    },
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.triggeredLabel', {
+        defaultMessage: 'Triggered',
+      }),
+      description: (
+        <span title={alert.start.toString()}>{moment(alert.start).format(dateFormat)}</span>
+      ),
+    },
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.durationLabel', {
+        defaultMessage: 'Duration',
+      }),
+      description: asDuration(alert['kibana.rac.alert.duration.us'], { extended: true }),
+    },
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.expectedValueLabel', {
+        defaultMessage: 'Expected value',
+      }),
+      description: alert['kibana.observability.evaluation.threshold'] ?? '-',
+    },
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.actualValueLabel', {
+        defaultMessage: 'Actual value',
+      }),
+      description: alert['kibana.observability.evaluation.value'] ?? '-',
+    },
+    {
+      title: i18n.translate('xpack.observability.alertsFlyout.ruleTypeLabel', {
+        defaultMessage: 'Rule type',
+      }),
+      description: alert['rule.category'] ?? '-',
+    },
+  ];
+
+  const tabs = [
+    {
+      id: 'overview',
+      name: i18n.translate('xpack.observability.alerts.flyoutOverviewTabTitle', {
+        defaultMessage: 'Overview',
+      }),
+      content: (
+        <>
+          <EuiSpacer />
+          <EuiDescriptionList type="responsiveColumn" listItems={overviewListItems} />
+        </>
+      ),
+    },
+  ];
+
+  return (
+    <EuiFlyout onClose={onClose} size="m">
+      <EuiFlyoutHeader>
+        <EuiTitle size="m">
+          <h2>{alert['rule.name']}</h2>
+        </EuiTitle>
+        <EuiSpacer size="s" />
+        <EuiText size="s">{alert.reason}</EuiText>
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>
+        <EuiTabbedContent size="s" tabs={tabs} />
+      </EuiFlyoutBody>
+      {alert.link && (
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="flexEnd">
+            <EuiFlexItem grow={false}>
+              <EuiButton href={prepend(alert.link)} fill>
+                View in app
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      )}
+    </EuiFlyout>
+  );
+}
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_search_bar.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_search_bar.tsx
index 97595b456d5037..c0a08fa7faac7a 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_search_bar.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_search_bar.tsx
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import React, { useMemo } from 'react';
+import React, { useMemo, useState } from 'react';
 import { SearchBar, TimeHistory } from '../../../../../../src/plugins/data/public';
 import { Storage } from '../../../../../../src/plugins/kibana_utils/public';
 import { useFetcher } from '../../hooks/use_fetcher';
@@ -29,6 +29,7 @@ export function AlertsSearchBar({
   const timeHistory = useMemo(() => {
     return new TimeHistory(new Storage(localStorage));
   }, []);
+  const [queryLanguage, setQueryLanguage] = useState<'lucene' | 'kuery'>('kuery');
 
   const { data: dynamicIndexPattern } = useFetcher(({ signal }) => {
     return callObservabilityApi({
@@ -43,7 +44,7 @@ export function AlertsSearchBar({
       placeholder={i18n.translate('xpack.observability.alerts.searchBarPlaceholder', {
         defaultMessage: '"domain": "ecommerce" AND ("service.name": "ProductCatalogService" …)',
       })}
-      query={{ query: query ?? '', language: 'kuery' }}
+      query={{ query: query ?? '', language: queryLanguage }}
       timeHistory={timeHistory}
       dateRangeFrom={rangeFrom}
       dateRangeTo={rangeTo}
@@ -55,6 +56,7 @@ export function AlertsSearchBar({
           dateRange,
           query: typeof nextQuery?.query === 'string' ? nextQuery.query : '',
         });
+        setQueryLanguage((nextQuery?.language || 'kuery') as 'kuery' | 'lucene');
       }}
     />
   );
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
index 0985597cc4b694..b0ff156fde377d 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_table.tsx
@@ -6,31 +6,22 @@
  */
 
 import {
+  CustomItemAction,
   EuiBasicTable,
   EuiBasicTableColumn,
   EuiBasicTableProps,
-  DefaultItemAction,
-  EuiTableSelectionType,
+  EuiButton,
+  EuiIconTip,
   EuiLink,
-  EuiBadge,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useState } from 'react';
 import { asDuration } from '../../../common/utils/formatters';
 import { TimestampTooltip } from '../../components/shared/timestamp_tooltip';
 import { usePluginContext } from '../../hooks/use_plugin_context';
+import type { TopAlert } from './';
 import { AlertsFlyout } from './alerts_flyout';
-
-export interface TopAlert {
-  start: number;
-  duration: number;
-  reason: string;
-  link?: string;
-  severityLevel?: string;
-  active: boolean;
-  ruleName: string;
-  ruleCategory: string;
-}
+import { SeverityBadge } from './severity_badge';
 
 type AlertsTableProps = Omit<
   EuiBasicTableProps<TopAlert>,
@@ -43,13 +34,18 @@ export function AlertsTable(props: AlertsTableProps) {
   const { core } = usePluginContext();
   const { prepend } = core.http.basePath;
 
-  const actions: Array<DefaultItemAction<TopAlert>> = [
+  const actions: Array<CustomItemAction<TopAlert>> = [
     {
-      name: 'Alert details',
-      description: 'Alert details',
-      onClick: (item) => {
-        setFlyoutAlert(item);
-      },
+      render: (alert) =>
+        alert.link ? (
+          <EuiButton href={prepend(alert.link)} size="s">
+            {i18n.translate('xpack.observability.alertsTable.viewInAppButtonLabel', {
+              defaultMessage: 'View in app',
+            })}
+          </EuiButton>
+        ) : (
+          <></>
+        ),
       isPrimary: true,
     },
   ];
@@ -57,54 +53,76 @@ export function AlertsTable(props: AlertsTableProps) {
   const columns: Array<EuiBasicTableColumn<TopAlert>> = [
     {
       field: 'active',
-      name: 'Status',
-      width: '112px',
-      render: (_, { active }) => {
-        const style = {
-          width: '96px',
-          textAlign: 'center' as const,
-        };
+      name: i18n.translate('xpack.observability.alertsTable.statusColumnDescription', {
+        defaultMessage: 'Status',
+      }),
+      align: 'center',
+      render: (_, alert) => {
+        const { active } = alert;
 
         return active ? (
-          <EuiBadge iconType="alert" color="danger" style={style}>
-            {i18n.translate('xpack.observability.alertsTable.status.active', {
+          <EuiIconTip
+            content={i18n.translate('xpack.observability.alertsTable.statusActiveDescription', {
               defaultMessage: 'Active',
             })}
-          </EuiBadge>
+            color="danger"
+            type="alert"
+          />
         ) : (
-          <EuiBadge iconType="check" color="hollow" style={style}>
-            {i18n.translate('xpack.observability.alertsTable.status.recovered', {
+          <EuiIconTip
+            content={i18n.translate('xpack.observability.alertsTable.statusRecoveredDescription', {
               defaultMessage: 'Recovered',
             })}
-          </EuiBadge>
+            type="check"
+          />
         );
       },
     },
     {
       field: 'start',
-      name: 'Triggered',
+      name: i18n.translate('xpack.observability.alertsTable.triggeredColumnDescription', {
+        defaultMessage: 'Triggered',
+      }),
       render: (_, item) => {
         return <TimestampTooltip time={new Date(item.start).getTime()} timeUnit="milliseconds" />;
       },
     },
     {
       field: 'duration',
-      name: 'Duration',
-      render: (_, { duration, active }) => {
-        return active ? null : asDuration(duration, { extended: true });
+      name: i18n.translate('xpack.observability.alertsTable.durationColumnDescription', {
+        defaultMessage: 'Duration',
+      }),
+      render: (_, alert) => {
+        const { active } = alert;
+        return active
+          ? null
+          : asDuration(alert['kibana.rac.alert.duration.us'], { extended: true });
+      },
+    },
+    {
+      field: 'severity',
+      name: i18n.translate('xpack.observability.alertsTable.severityColumnDescription', {
+        defaultMessage: 'Severity',
+      }),
+      render: (_, alert) => {
+        return <SeverityBadge severityLevel={alert['kibana.rac.alert.severity.level']} />;
       },
     },
     {
       field: 'reason',
-      name: 'Reason',
+      name: i18n.translate('xpack.observability.alertsTable.reasonColumnDescription', {
+        defaultMessage: 'Reason',
+      }),
       dataType: 'string',
       render: (_, item) => {
-        return item.link ? <EuiLink href={prepend(item.link)}>{item.reason}</EuiLink> : item.reason;
+        return <EuiLink onClick={() => setFlyoutAlert(item)}>{item.reason}</EuiLink>;
       },
     },
     {
       actions,
-      name: 'Actions',
+      name: i18n.translate('xpack.observability.alertsTable.actionsColumnDescription', {
+        defaultMessage: 'Actions',
+      }),
     },
   ];
 
@@ -113,8 +131,6 @@ export function AlertsTable(props: AlertsTableProps) {
       {flyoutAlert && <AlertsFlyout alert={flyoutAlert} onClose={handleFlyoutClose} />}
       <EuiBasicTable<TopAlert>
         {...props}
-        isSelectable={true}
-        selection={{} as EuiTableSelectionType<TopAlert>}
         columns={columns}
         tableLayout="auto"
         pagination={{ pageIndex: 0, pageSize: 0, totalItemCount: 0 }}
diff --git a/x-pack/plugins/observability/public/pages/alerts/example_data.ts b/x-pack/plugins/observability/public/pages/alerts/example_data.ts
index 860c8d059f00d4..dba6f1e9aaa2ff 100644
--- a/x-pack/plugins/observability/public/pages/alerts/example_data.ts
+++ b/x-pack/plugins/observability/public/pages/alerts/example_data.ts
@@ -12,6 +12,7 @@ export const apmAlertResponseExample = [
     'rule.name': 'Error count threshold | opbeans-java (smith test)',
     'kibana.rac.alert.duration.us': 180057000,
     'kibana.rac.alert.status': 'open',
+    'kibana.rac.alert.severity.level': 'warning',
     tags: ['apm', 'service.name:opbeans-java'],
     'kibana.rac.alert.uuid': '0175ec0a-a3b1-4d41-b557-e21c2d024352',
     'rule.uuid': '474920d0-93e9-11eb-ac86-0b455460de81',
@@ -47,16 +48,6 @@ export const apmAlertResponseExample = [
   },
 ];
 
-export const flyoutItemExample = {
-  link: '/app/apm/services/opbeans-java?rangeFrom=now-15m&rangeTo=now',
-  reason: 'Error count for opbeans-java was above the threshold',
-  active: true,
-  start: 1618235449493,
-  duration: 180057000,
-  ruleCategory: 'Error count threshold',
-  ruleName: 'Error count threshold | opbeans-java (smith test)',
-};
-
 export const dynamicIndexPattern = {
   fields: [
     {
diff --git a/x-pack/plugins/observability/public/pages/alerts/index.tsx b/x-pack/plugins/observability/public/pages/alerts/index.tsx
index 00894650033932..76e5d623690299 100644
--- a/x-pack/plugins/observability/public/pages/alerts/index.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/index.tsx
@@ -18,15 +18,26 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
 import { format, parse } from 'url';
+import type { ObservabilityAPIReturnType } from '../../services/call_observability_api/types';
 import { ExperimentalBadge } from '../../components/shared/experimental_badge';
 import { useFetcher } from '../../hooks/use_fetcher';
 import { usePluginContext } from '../../hooks/use_plugin_context';
 import { RouteParams } from '../../routes';
 import { callObservabilityApi } from '../../services/call_observability_api';
 import { getAbsoluteDateRange } from '../../utils/date';
+import { asDuration, asPercent } from '../../../common/utils/formatters';
 import { AlertsSearchBar } from './alerts_search_bar';
 import { AlertsTable } from './alerts_table';
 
+export type TopAlertResponse = ObservabilityAPIReturnType<'GET /api/observability/rules/alerts/top'>[number];
+
+export interface TopAlert extends TopAlertResponse {
+  start: number;
+  reason: string;
+  link?: string;
+  active: boolean;
+}
+
 interface AlertsPageProps {
   routeParams: RouteParams<'/alerts'>;
 }
@@ -68,12 +79,13 @@ export function AlertsPage({ routeParams }: AlertsPageProps) {
           const formatted = {
             link: undefined,
             reason: alert['rule.name'],
-            ...(ruleType?.format?.({ alert }) ?? {}),
+            ...(ruleType?.format?.({ alert, formatters: { asDuration, asPercent } }) ?? {}),
           };
 
           const parsedLink = formatted.link ? parse(formatted.link, true) : undefined;
 
           return {
+            ...alert,
             ...formatted,
             link: parsedLink
               ? format({
@@ -86,11 +98,7 @@ export function AlertsPage({ routeParams }: AlertsPageProps) {
                 })
               : undefined,
             active: alert['event.action'] !== 'close',
-            severityLevel: alert['kibana.rac.alert.severity.level'],
             start: new Date(alert['kibana.rac.alert.start']).getTime(),
-            duration: alert['kibana.rac.alert.duration.us'],
-            ruleCategory: alert['rule.category'],
-            ruleName: alert['rule.name'],
           };
         });
       });
diff --git a/x-pack/plugins/observability/public/pages/alerts/severity_badge.stories.tsx b/x-pack/plugins/observability/public/pages/alerts/severity_badge.stories.tsx
new file mode 100644
index 00000000000000..3f7357fe607e63
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/alerts/severity_badge.stories.tsx
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { ComponentProps } from 'react';
+import { SeverityBadge } from './severity_badge';
+
+type Args = ComponentProps<typeof SeverityBadge>;
+
+export default {
+  title: 'app/Alerts/SeverityBadge',
+  component: SeverityBadge,
+};
+
+export function Example({ severityLevel }: Args) {
+  return <SeverityBadge severityLevel={severityLevel} />;
+}
+Example.args = { severityLevel: 'critical' } as Args;
diff --git a/x-pack/plugins/observability/public/pages/alerts/severity_badge.tsx b/x-pack/plugins/observability/public/pages/alerts/severity_badge.tsx
new file mode 100644
index 00000000000000..931b9396f912a5
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/alerts/severity_badge.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiBadge } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+
+export interface SeverityBadgeProps {
+  severityLevel?: string;
+}
+
+const colorMap: { [key: string]: string } = {
+  critical: 'danger',
+  warning: 'warning',
+};
+
+export function SeverityBadge({ severityLevel }: SeverityBadgeProps) {
+  return (
+    <EuiBadge color={severityLevel ? colorMap[severityLevel] : 'default'}>
+      {severityLevel ??
+        i18n.translate('xpack.observability.severityBadge.unknownDescription', {
+          defaultMessage: 'unknown',
+        })}
+    </EuiBadge>
+  );
+}
diff --git a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
index 6fc573b11109a3..68c39a888692b5 100644
--- a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
@@ -45,6 +45,7 @@ const withCore = makeDecorator({
             appMountParameters: ({
               setHeaderActionMenu: () => {},
             } as unknown) as AppMountParameters,
+            config: { unsafe: { alertingExperience: { enabled: true } } },
             core: options as CoreStart,
             plugins: ({
               data: {
diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts
index 491eb36d01ac0f..517675fe1d525c 100644
--- a/x-pack/plugins/observability/public/plugin.ts
+++ b/x-pack/plugins/observability/public/plugin.ts
@@ -5,32 +5,34 @@
  * 2.0.
  */
 
-import { BehaviorSubject } from 'rxjs';
 import { i18n } from '@kbn/i18n';
-import type { RuleRegistryPublicPluginSetupContract } from '../../rule_registry/public';
-import type {
-  DataPublicPluginSetup,
-  DataPublicPluginStart,
-} from '../../../../src/plugins/data/public';
+import { BehaviorSubject } from 'rxjs';
 import {
   AppMountParameters,
   AppUpdater,
   CoreSetup,
+  CoreStart,
   DEFAULT_APP_CATEGORIES,
   Plugin as PluginClass,
   PluginInitializerContext,
-  CoreStart,
 } from '../../../../src/core/public';
+import type {
+  DataPublicPluginSetup,
+  DataPublicPluginStart,
+} from '../../../../src/plugins/data/public';
 import type {
   HomePublicPluginSetup,
   HomePublicPluginStart,
 } from '../../../../src/plugins/home/public';
-import { registerDataHandler } from './data_handler';
-import { toggleOverviewLinkInNav } from './toggle_overview_link_in_nav';
 import type { LensPublicStart } from '../../lens/public';
-import { createCallObservabilityApi } from './services/call_observability_api';
-import { observabilityRuleRegistrySettings } from '../common/observability_rule_registry';
+import type { RuleRegistryPublicPluginSetupContract } from '../../rule_registry/public';
+import type { ObservabilityRuleFieldMap } from '../common/rules/observability_rule_field_map';
+import { observabilityRuleRegistrySettings } from '../common/rules/observability_rule_registry_settings';
+import { registerDataHandler } from './data_handler';
 import { FormatterRuleRegistry } from './rules/formatter_rule_registry';
+import { createCallObservabilityApi } from './services/call_observability_api';
+import { toggleOverviewLinkInNav } from './toggle_overview_link_in_nav';
+import { ConfigSchema } from '.';
 
 export type ObservabilityPublicSetup = ReturnType<Plugin['setup']>;
 export type ObservabilityRuleRegistry = ObservabilityPublicSetup['ruleRegistry'];
@@ -59,7 +61,9 @@ export class Plugin
     > {
   private readonly appUpdater$ = new BehaviorSubject<AppUpdater>(() => ({}));
 
-  constructor(context: PluginInitializerContext) {}
+  constructor(private readonly initializerContext: PluginInitializerContext<ConfigSchema>) {
+    this.initializerContext = initializerContext;
+  }
 
   public setup(
     coreSetup: CoreSetup<ObservabilityPublicPluginsStart>,
@@ -67,11 +71,13 @@ export class Plugin
   ) {
     const category = DEFAULT_APP_CATEGORIES.observability;
     const euiIconType = 'logoObservability';
+    const config = this.initializerContext.config.get();
 
     createCallObservabilityApi(coreSetup.http);
 
     const observabilityRuleRegistry = pluginsSetup.ruleRegistry.registry.create({
       ...observabilityRuleRegistrySettings,
+      fieldMap: {} as ObservabilityRuleFieldMap,
       ctor: FormatterRuleRegistry,
     });
 
@@ -82,6 +88,7 @@ export class Plugin
       const [coreStart, pluginsStart] = await coreSetup.getStartServices();
 
       return renderApp({
+        config,
         core: coreStart,
         plugins: pluginsStart,
         appMountParameters: params,
@@ -102,7 +109,7 @@ export class Plugin
       updater$,
     });
 
-    if (coreSetup.uiSettings.get('observability:enableAlertingExperience')) {
+    if (config.unsafe.alertingExperience.enabled) {
       coreSetup.application.register({
         id: 'observability-alerts',
         title: 'Alerts',
@@ -159,6 +166,7 @@ export class Plugin
     return {
       dashboard: { register: registerDataHandler },
       ruleRegistry: observabilityRuleRegistry,
+      isAlertingExperienceEnabled: () => config.unsafe.alertingExperience.enabled,
     };
   }
   public start({ application }: CoreStart) {
diff --git a/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts b/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts
index 87e6b3c324634b..0d0d22cf750fb9 100644
--- a/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts
+++ b/x-pack/plugins/observability/public/rules/formatter_rule_registry.ts
@@ -7,12 +7,17 @@
 import type { RuleType } from '../../../rule_registry/public';
 import type { BaseRuleFieldMap, OutputOfFieldMap } from '../../../rule_registry/common';
 import { RuleRegistry } from '../../../rule_registry/public';
+import type { asDuration, asPercent } from '../../common/utils/formatters';
 
 type AlertTypeOf<TFieldMap extends BaseRuleFieldMap> = OutputOfFieldMap<TFieldMap>;
 
 type FormattableRuleType<TFieldMap extends BaseRuleFieldMap> = RuleType & {
   format?: (options: {
     alert: AlertTypeOf<TFieldMap>;
+    formatters: {
+      asDuration: typeof asDuration;
+      asPercent: typeof asPercent;
+    };
   }) => {
     reason?: string;
     link?: string;
diff --git a/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts b/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
index 939e3a3608f8bc..389b581b5fb600 100644
--- a/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
+++ b/x-pack/plugins/observability/public/rules/observability_rule_registry_mock.ts
@@ -9,7 +9,7 @@ import { ObservabilityRuleRegistry } from '../plugin';
 
 const createRuleRegistryMock = () => ({
   registerType: () => {},
-  getTypeByRuleId: () => {},
+  getTypeByRuleId: () => ({ format: () => ({ link: '/test/example' }) }),
   create: () => createRuleRegistryMock(),
 });
 
diff --git a/x-pack/plugins/observability/public/utils/test_helper.tsx b/x-pack/plugins/observability/public/utils/test_helper.tsx
index 97916b414330f8..63e34b018aed06 100644
--- a/x-pack/plugins/observability/public/utils/test_helper.tsx
+++ b/x-pack/plugins/observability/public/utils/test_helper.tsx
@@ -31,6 +31,8 @@ export const core = ({
   },
 } as unknown) as CoreStart;
 
+const config = { unsafe: { alertingExperience: { enabled: true } } };
+
 const plugins = ({
   data: { query: { timefilter: { timefilter: { setTime: jest.fn() } } } },
 } as unknown) as ObservabilityPublicPluginsStart;
@@ -42,7 +44,7 @@ export const render = (component: React.ReactNode) => {
     <IntlProvider locale="en-US" messages={translations.messages}>
       <KibanaContextProvider services={{ ...core }}>
         <PluginContext.Provider
-          value={{ appMountParameters, core, plugins, observabilityRuleRegistry }}
+          value={{ appMountParameters, config, core, plugins, observabilityRuleRegistry }}
         >
           <EuiThemeProvider>{component}</EuiThemeProvider>
         </PluginContext.Provider>
diff --git a/x-pack/plugins/observability/server/index.ts b/x-pack/plugins/observability/server/index.ts
index 6785436042f976..ec471df164fe1d 100644
--- a/x-pack/plugins/observability/server/index.ts
+++ b/x-pack/plugins/observability/server/index.ts
@@ -16,12 +16,18 @@ export { rangeQuery, kqlQuery } from './utils/queries';
 export * from './types';
 
 export const config = {
+  exposeToBrowser: {
+    unsafe: { alertingExperience: { enabled: true } },
+  },
   schema: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
     annotations: schema.object({
       enabled: schema.boolean({ defaultValue: true }),
       index: schema.string({ defaultValue: 'observability-annotations' }),
     }),
+    unsafe: schema.object({
+      alertingExperience: schema.object({ enabled: schema.boolean({ defaultValue: false }) }),
+    }),
   }),
 };
 
diff --git a/x-pack/plugins/observability/server/plugin.ts b/x-pack/plugins/observability/server/plugin.ts
index b167600e788a44..b5208260297d0d 100644
--- a/x-pack/plugins/observability/server/plugin.ts
+++ b/x-pack/plugins/observability/server/plugin.ts
@@ -16,7 +16,8 @@ import type { RuleRegistryPluginSetupContract } from '../../rule_registry/server
 import { uiSettings } from './ui_settings';
 import { registerRoutes } from './routes/register_routes';
 import { getGlobalObservabilityServerRouteRepository } from './routes/get_global_observability_server_route_repository';
-import { observabilityRuleRegistrySettings } from '../common/observability_rule_registry';
+import { observabilityRuleRegistrySettings } from '../common/rules/observability_rule_registry_settings';
+import { observabilityRuleFieldMap } from '../common/rules/observability_rule_field_map';
 
 export type ObservabilityPluginSetup = ReturnType<ObservabilityPlugin['setup']>;
 export type ObservabilityRuleRegistry = ObservabilityPluginSetup['ruleRegistry'];
@@ -50,9 +51,10 @@ export class ObservabilityPlugin implements Plugin<ObservabilityPluginSetup> {
       });
     }
 
-    const observabilityRuleRegistry = plugins.ruleRegistry.create(
-      observabilityRuleRegistrySettings
-    );
+    const observabilityRuleRegistry = plugins.ruleRegistry.create({
+      ...observabilityRuleRegistrySettings,
+      fieldMap: observabilityRuleFieldMap,
+    });
 
     registerRoutes({
       core: {
diff --git a/x-pack/plugins/observability/server/routes/rules.ts b/x-pack/plugins/observability/server/routes/rules.ts
index 10f2f50886f07c..cd3f4976e0af3e 100644
--- a/x-pack/plugins/observability/server/routes/rules.ts
+++ b/x-pack/plugins/observability/server/routes/rules.ts
@@ -35,7 +35,7 @@ const alertsListRoute = createObservabilityServerRoute({
     });
 
     if (!ruleRegistryClient) {
-      throw Boom.failedDependency();
+      throw Boom.failedDependency('xpack.ruleRegistry.unsafe.write.enabled is set to false');
     }
 
     const {
diff --git a/x-pack/plugins/observability/server/ui_settings.ts b/x-pack/plugins/observability/server/ui_settings.ts
index 43041280d02822..46ae106efe6bc0 100644
--- a/x-pack/plugins/observability/server/ui_settings.ts
+++ b/x-pack/plugins/observability/server/ui_settings.ts
@@ -8,27 +8,12 @@
 import { schema } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
 import { UiSettingsParams } from '../../../../src/core/types';
-import { enableAlertingExperience, enableInspectEsQueries } from '../common/ui_settings_keys';
+import { enableInspectEsQueries } from '../common/ui_settings_keys';
 
 /**
  * uiSettings definitions for Observability.
  */
 export const uiSettings: Record<string, UiSettingsParams<boolean>> = {
-  [enableAlertingExperience]: {
-    category: ['observability'],
-    name: i18n.translate('xpack.observability.enableAlertingExperienceExperimentName', {
-      defaultMessage: 'Observability alerting experience',
-    }),
-    value: false,
-    description: i18n.translate(
-      'xpack.observability.enableAlertingExperienceExperimentDescription',
-      {
-        defaultMessage:
-          'Enable the experimental alerting experience for Observability. Adds the Alerts and Cases pages.',
-      }
-    ),
-    schema: schema.boolean(),
-  },
   [enableInspectEsQueries]: {
     category: ['observability'],
     name: i18n.translate('xpack.observability.enableInspectEsQueriesExperimentName', {
diff --git a/x-pack/plugins/osquery/common/constants.ts b/x-pack/plugins/osquery/common/constants.ts
index 794ac5004c9f12..5354332fd89f87 100644
--- a/x-pack/plugins/osquery/common/constants.ts
+++ b/x-pack/plugins/osquery/common/constants.ts
@@ -7,3 +7,5 @@
 
 export const DEFAULT_MAX_TABLE_QUERY_SIZE = 10000;
 export const DEFAULT_DARK_MODE = 'theme:darkMode';
+export const OSQUERY_INTEGRATION_NAME = 'osquery_manager';
+export const BASE_PATH = '/app/osquery';
diff --git a/x-pack/plugins/osquery/kibana.json b/x-pack/plugins/osquery/kibana.json
index fea20d9fb3cb52..17d74b124f45b6 100644
--- a/x-pack/plugins/osquery/kibana.json
+++ b/x-pack/plugins/osquery/kibana.json
@@ -20,6 +20,8 @@
     "actions",
     "data",
     "dataEnhanced",
+    "discover",
+    "features",
     "fleet",
     "navigation",
     "triggersActionsUi"
diff --git a/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx b/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
new file mode 100644
index 00000000000000..9542286c860f2c
--- /dev/null
+++ b/x-pack/plugins/osquery/public/action_results/action_results_summary.tsx
@@ -0,0 +1,239 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/no-unused-vars */
+
+import { i18n } from '@kbn/i18n';
+import {
+  EuiLink,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiCard,
+  EuiTextColor,
+  EuiSpacer,
+  EuiDescriptionList,
+  EuiInMemoryTable,
+  EuiCodeBlock,
+} from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+
+import { pagePathGetters } from '../../../fleet/public';
+import { useActionResults } from './use_action_results';
+import { useAllResults } from '../results/use_all_results';
+import { Direction } from '../../common/search_strategy';
+import { useKibana } from '../common/lib/kibana';
+
+interface ActionResultsSummaryProps {
+  actionId: string;
+  agentIds?: string[];
+  isLive?: boolean;
+}
+
+const renderErrorMessage = (error: string) => (
+  <EuiCodeBlock language="shell" fontSize="s" paddingSize="none" transparentBackground>
+    {error}
+  </EuiCodeBlock>
+);
+
+const ActionResultsSummaryComponent: React.FC<ActionResultsSummaryProps> = ({
+  actionId,
+  agentIds,
+  isLive,
+}) => {
+  const getUrlForApp = useKibana().services.application.getUrlForApp;
+  // @ts-expect-error update types
+  const [pageIndex, setPageIndex] = useState(0);
+  // @ts-expect-error update types
+  const [pageSize, setPageSize] = useState(50);
+  const {
+    // @ts-expect-error update types
+    data: { aggregations, edges },
+  } = useActionResults({
+    actionId,
+    activePage: pageIndex,
+    agentIds,
+    limit: pageSize,
+    direction: Direction.asc,
+    sortField: '@timestamp',
+    isLive,
+  });
+
+  const { data: logsResults } = useAllResults({
+    actionId,
+    activePage: pageIndex,
+    limit: pageSize,
+    direction: Direction.asc,
+    sortField: '@timestamp',
+    isLive,
+  });
+
+  const notRespondedCount = useMemo(() => {
+    if (!agentIds || !aggregations.totalResponded) {
+      return '-';
+    }
+
+    return agentIds.length - aggregations.totalResponded;
+  }, [aggregations.totalResponded, agentIds]);
+
+  const listItems = useMemo(
+    () => [
+      {
+        title: i18n.translate(
+          'xpack.osquery.liveQueryActionResults.summary.agentsQueriedLabelText',
+          {
+            defaultMessage: 'Agents queried',
+          }
+        ),
+        description: agentIds?.length,
+      },
+      {
+        title: i18n.translate('xpack.osquery.liveQueryActionResults.summary.successfulLabelText', {
+          defaultMessage: 'Successful',
+        }),
+        description: aggregations.successful,
+      },
+      {
+        title: i18n.translate('xpack.osquery.liveQueryActionResults.summary.pendingLabelText', {
+          defaultMessage: 'Not yet responded',
+        }),
+        description: notRespondedCount,
+      },
+      {
+        title: i18n.translate('xpack.osquery.liveQueryActionResults.summary.failedLabelText', {
+          defaultMessage: 'Failed',
+        }),
+        description: (
+          <EuiTextColor color={aggregations.failed ? 'danger' : 'default'}>
+            {aggregations.failed}
+          </EuiTextColor>
+        ),
+      },
+    ],
+    [agentIds, aggregations.failed, aggregations.successful, notRespondedCount]
+  );
+
+  const renderAgentIdColumn = useCallback(
+    (agentId) => (
+      <EuiLink
+        className="eui-textTruncate"
+        href={getUrlForApp('fleet', {
+          path: `#` + pagePathGetters.fleet_agent_details({ agentId }),
+        })}
+        target="_blank"
+      >
+        {agentId}
+      </EuiLink>
+    ),
+    [getUrlForApp]
+  );
+
+  const renderRowsColumn = useCallback(
+    (_, item) => {
+      if (!logsResults) return '-';
+      const agentId = item.fields.agent_id[0];
+
+      return (
+        // @ts-expect-error update types
+        logsResults?.rawResponse?.aggregations?.count_by_agent_id?.buckets?.find(
+          // @ts-expect-error update types
+          (bucket) => bucket.key === agentId
+        )?.doc_count ?? '-'
+      );
+    },
+    [logsResults]
+  );
+
+  const renderStatusColumn = useCallback((_, item) => {
+    if (!item.fields.completed_at) {
+      return i18n.translate('xpack.osquery.liveQueryActionResults.table.pendingStatusText', {
+        defaultMessage: 'pending',
+      });
+    }
+
+    if (item.fields['error.keyword']) {
+      return i18n.translate('xpack.osquery.liveQueryActionResults.table.errorStatusText', {
+        defaultMessage: 'error',
+      });
+    }
+
+    return i18n.translate('xpack.osquery.liveQueryActionResults.table.successStatusText', {
+      defaultMessage: 'success',
+    });
+  }, []);
+
+  const columns = useMemo(
+    () => [
+      {
+        field: 'status',
+        name: i18n.translate('xpack.osquery.liveQueryActionResults.table.statusColumnTitle', {
+          defaultMessage: 'Status',
+        }),
+        render: renderStatusColumn,
+      },
+      {
+        field: 'fields.agent_id[0]',
+        name: i18n.translate('xpack.osquery.liveQueryActionResults.table.agentIdColumnTitle', {
+          defaultMessage: 'Agent Id',
+        }),
+        truncateText: true,
+        render: renderAgentIdColumn,
+      },
+      {
+        field: 'fields.rows[0]',
+        name: i18n.translate(
+          'xpack.osquery.liveQueryActionResults.table.resultRowsNumberColumnTitle',
+          {
+            defaultMessage: 'Number of result rows',
+          }
+        ),
+        render: renderRowsColumn,
+      },
+      {
+        field: 'fields.error[0]',
+        name: i18n.translate('xpack.osquery.liveQueryActionResults.table.errorColumnTitle', {
+          defaultMessage: 'Error',
+        }),
+        render: renderErrorMessage,
+      },
+    ],
+    [renderAgentIdColumn, renderRowsColumn, renderStatusColumn]
+  );
+
+  const pagination = useMemo(
+    () => ({
+      initialPageSize: 20,
+      pageSizeOptions: [10, 20, 50, 100],
+    }),
+    []
+  );
+
+  return (
+    <>
+      <EuiFlexGroup>
+        <EuiFlexItem grow={false}>
+          <EuiCard title="" description="" textAlign="left">
+            <EuiDescriptionList
+              compressed
+              textStyle="reverse"
+              type="responsiveColumn"
+              listItems={listItems}
+            />
+          </EuiCard>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+
+      {edges.length ? (
+        <>
+          <EuiSpacer />
+          <EuiInMemoryTable items={edges} columns={columns} pagination={pagination} />
+        </>
+      ) : null}
+    </>
+  );
+};
+
+export const ActionResultsSummary = React.memo(ActionResultsSummaryComponent);
diff --git a/x-pack/plugins/osquery/public/action_results/action_results_table.tsx b/x-pack/plugins/osquery/public/action_results/action_results_table.tsx
deleted file mode 100644
index 660b837da6d93b..00000000000000
--- a/x-pack/plugins/osquery/public/action_results/action_results_table.tsx
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { find, map } from 'lodash/fp';
-import {
-  EuiDataGrid,
-  EuiDataGridProps,
-  EuiDataGridColumn,
-  EuiDataGridSorting,
-  EuiHealth,
-  EuiIcon,
-  EuiLink,
-} from '@elastic/eui';
-import React, { createContext, useState, useCallback, useContext, useMemo } from 'react';
-
-import { useAllAgents } from './../agents/use_all_agents';
-import { useActionResults } from './use_action_results';
-import { useAllResults } from '../results/use_all_results';
-import { Direction, ResultEdges } from '../../common/search_strategy';
-import { useRouterNavigate } from '../common/lib/kibana';
-import { useOsqueryPolicies } from '../agents/use_osquery_policies';
-
-const DataContext = createContext<ResultEdges>([]);
-
-interface ActionResultsTableProps {
-  actionId: string;
-}
-
-const ActionResultsTableComponent: React.FC<ActionResultsTableProps> = ({ actionId }) => {
-  const [pagination, setPagination] = useState({ pageIndex: 0, pageSize: 50 });
-  const onChangeItemsPerPage = useCallback(
-    (pageSize) =>
-      setPagination((currentPagination) => ({
-        ...currentPagination,
-        pageSize,
-        pageIndex: 0,
-      })),
-    [setPagination]
-  );
-  const onChangePage = useCallback(
-    (pageIndex) => setPagination((currentPagination) => ({ ...currentPagination, pageIndex })),
-    [setPagination]
-  );
-
-  const [columns] = useState<EuiDataGridColumn[]>([
-    {
-      id: 'status',
-      displayAsText: 'status',
-      defaultSortDirection: Direction.asc,
-    },
-    {
-      id: 'rows_count',
-      displayAsText: '# rows',
-      defaultSortDirection: Direction.asc,
-    },
-    {
-      id: 'agent_status',
-      displayAsText: 'online',
-      defaultSortDirection: Direction.asc,
-    },
-    {
-      id: 'agent',
-      displayAsText: 'agent',
-      defaultSortDirection: Direction.asc,
-    },
-    {
-      id: '@timestamp',
-      displayAsText: '@timestamp',
-      defaultSortDirection: Direction.asc,
-    },
-  ]);
-
-  // ** Sorting config
-  const [sortingColumns, setSortingColumns] = useState<EuiDataGridSorting['columns']>([]);
-
-  const { data: actionResultsData } = useActionResults({
-    actionId,
-    activePage: pagination.pageIndex,
-    limit: pagination.pageSize,
-    direction: Direction.asc,
-    sortField: '@timestamp',
-  });
-
-  const [visibleColumns, setVisibleColumns] = useState<string[]>(() => map('id', columns)); // initialize to the full set of columns
-
-  const columnVisibility = useMemo(() => ({ visibleColumns, setVisibleColumns }), [
-    visibleColumns,
-    setVisibleColumns,
-  ]);
-
-  const osqueryPolicyData = useOsqueryPolicies();
-  const { agents } = useAllAgents(osqueryPolicyData);
-
-  const renderCellValue: EuiDataGridProps['renderCellValue'] = useMemo(
-    () => ({ rowIndex, columnId }) => {
-      // eslint-disable-next-line react-hooks/rules-of-hooks
-      const data = useContext(DataContext);
-      const value = data[rowIndex];
-
-      if (columnId === 'status') {
-        // eslint-disable-next-line react-hooks/rules-of-hooks
-        const linkProps = useRouterNavigate(
-          `/live_query/${actionId}/results/${value.fields?.agent_id[0]}`
-        );
-
-        return (
-          <>
-            <EuiIcon type="checkInCircleFilled" />
-            <EuiLink {...linkProps}>{'View results'}</EuiLink>
-          </>
-        );
-      }
-
-      if (columnId === 'rows_count') {
-        // eslint-disable-next-line react-hooks/rules-of-hooks
-        const { data: allResultsData } = useAllResults({
-          actionId,
-          agentId: value.fields?.agent_id[0],
-          activePage: pagination.pageIndex,
-          limit: pagination.pageSize,
-          direction: Direction.asc,
-          sortField: '@timestamp',
-        });
-        // @ts-expect-error update types
-        return allResultsData?.totalCount ?? '-';
-      }
-
-      if (columnId === 'agent_status') {
-        const agentIdValue = value.fields?.agent_id[0];
-        const agent = find(['_id', agentIdValue], agents);
-        const online = agent?.active;
-        const color = online ? 'success' : 'danger';
-        const label = online ? 'Online' : 'Offline';
-        return <EuiHealth color={color}>{label}</EuiHealth>;
-      }
-
-      if (columnId === 'agent') {
-        const agentIdValue = value.fields?.agent_id[0];
-        const agent = find(['_id', agentIdValue], agents);
-        const agentName = agent?.local_metadata.host.name;
-
-        // eslint-disable-next-line react-hooks/rules-of-hooks
-        const linkProps = useRouterNavigate(`/live_query/${actionId}/results/${agentIdValue}`);
-        return (
-          <EuiLink {...linkProps}>{`(${agent?.local_metadata.os.name}) ${agentName}`}</EuiLink>
-        );
-      }
-
-      if (columnId === '@timestamp') {
-        // @ts-expect-error fields is optional
-        return value.fields['@timestamp'];
-      }
-
-      return '-';
-    },
-    [actionId, agents, pagination.pageIndex, pagination.pageSize]
-  );
-
-  const tableSorting: EuiDataGridSorting = useMemo(
-    () => ({ columns: sortingColumns, onSort: setSortingColumns }),
-    [sortingColumns]
-  );
-
-  const tablePagination = useMemo(
-    () => ({
-      ...pagination,
-      pageSizeOptions: [10, 50, 100],
-      onChangeItemsPerPage,
-      onChangePage,
-    }),
-    [onChangeItemsPerPage, onChangePage, pagination]
-  );
-
-  return (
-    // @ts-expect-error update types
-    <DataContext.Provider value={actionResultsData?.results}>
-      <EuiDataGrid
-        aria-label="Osquery results"
-        columns={columns}
-        columnVisibility={columnVisibility}
-        // @ts-expect-error update types
-        rowCount={actionResultsData?.totalCount}
-        renderCellValue={renderCellValue}
-        sorting={tableSorting}
-        pagination={tablePagination}
-        height="300px"
-      />
-    </DataContext.Provider>
-  );
-};
-
-export const ActionResultsTable = React.memo(ActionResultsTableComponent);
diff --git a/x-pack/plugins/osquery/public/action_results/helpers.ts b/x-pack/plugins/osquery/public/action_results/helpers.ts
index 802674ee0398ce..171530a77299f9 100644
--- a/x-pack/plugins/osquery/public/action_results/helpers.ts
+++ b/x-pack/plugins/osquery/public/action_results/helpers.ts
@@ -16,15 +16,14 @@ export type InspectResponse = Inspect & { response: string[] };
 
 export const generateTablePaginationOptions = (
   activePage: number,
-  limit: number,
-  isBucketSort?: boolean
+  limit: number
 ): PaginationInputPaginated => {
   const cursorStart = activePage * limit;
   return {
     activePage,
     cursorStart,
     fakePossibleCount: 4 <= activePage && activePage > 0 ? limit * (activePage + 2) : limit * 5,
-    querySize: isBucketSort ? limit : limit + cursorStart,
+    querySize: limit,
   };
 };
 
diff --git a/x-pack/plugins/osquery/public/action_results/use_action_results.ts b/x-pack/plugins/osquery/public/action_results/use_action_results.ts
index 58a877e7997037..7cad8ca3fc4986 100644
--- a/x-pack/plugins/osquery/public/action_results/use_action_results.ts
+++ b/x-pack/plugins/osquery/public/action_results/use_action_results.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import deepEqual from 'fast-deep-equal';
-import { useEffect, useState } from 'react';
+import { flatten, reverse, uniqBy } from 'lodash/fp';
 import { useQuery } from 'react-query';
 
 import { createFilter } from '../common/helpers';
@@ -20,6 +19,7 @@ import {
   Direction,
 } from '../../common/search_strategy';
 import { ESTermQuery } from '../../common/typed_json';
+import { queryClient } from '../query_client';
 
 import { generateTablePaginationOptions, getInspectResponse, InspectResponse } from './helpers';
 
@@ -35,68 +35,91 @@ export interface ResultsArgs {
 interface UseActionResults {
   actionId: string;
   activePage: number;
+  agentIds?: string[];
   direction: Direction;
   limit: number;
   sortField: string;
   filterQuery?: ESTermQuery | string;
   skip?: boolean;
+  isLive?: boolean;
 }
 
 export const useActionResults = ({
   actionId,
   activePage,
+  agentIds,
   direction,
   limit,
   sortField,
   filterQuery,
   skip = false,
+  isLive = false,
 }: UseActionResults) => {
   const { data } = useKibana().services;
 
-  const [resultsRequest, setHostRequest] = useState<ResultsRequestOptions | null>(null);
-
-  const response = useQuery(
-    ['actionResults', { actionId, activePage, direction, limit, sortField }],
+  return useQuery(
+    ['actionResults', { actionId }],
     async () => {
-      if (!resultsRequest) return Promise.resolve();
-
       const responseData = await data.search
-        .search<ResultsRequestOptions, ResultsStrategyResponse>(resultsRequest, {
-          strategy: 'osquerySearchStrategy',
-        })
+        .search<ResultsRequestOptions, ResultsStrategyResponse>(
+          {
+            actionId,
+            factoryQueryType: OsqueryQueries.actionResults,
+            filterQuery: createFilter(filterQuery),
+            pagination: generateTablePaginationOptions(activePage, limit),
+            sort: {
+              direction,
+              field: sortField,
+            },
+          },
+          {
+            strategy: 'osquerySearchStrategy',
+          }
+        )
         .toPromise();
 
+      const totalResponded =
+        // @ts-expect-error update types
+        responseData.rawResponse?.aggregations?.aggs.responses_by_action_id?.doc_count;
+      const aggsBuckets =
+        // @ts-expect-error update types
+        responseData.rawResponse?.aggregations?.aggs.responses_by_action_id?.responses.buckets;
+
+      const cachedData = queryClient.getQueryData(['actionResults', { actionId }]);
+
+      // @ts-expect-error update types
+      const previousEdges = cachedData?.edges.length
+        ? // @ts-expect-error update types
+          cachedData?.edges
+        : agentIds?.map((agentId) => ({ fields: { agent_id: [agentId] } })) ?? [];
+
       return {
         ...responseData,
-        results: responseData.edges,
+        edges: reverse(uniqBy('fields.agent_id[0]', flatten([responseData.edges, previousEdges]))),
+        aggregations: {
+          totalResponded,
+          // @ts-expect-error update types
+          successful: aggsBuckets.find((bucket) => bucket.key === 'success')?.doc_count ?? 0,
+          // @ts-expect-error update types
+          failed: aggsBuckets.find((bucket) => bucket.key === 'error')?.doc_count ?? 0,
+        },
         inspect: getInspectResponse(responseData, {} as InspectResponse),
       };
     },
     {
-      refetchInterval: 1000,
-      enabled: !skip && !!resultsRequest,
+      initialData: {
+        edges: [],
+        aggregations: {
+          totalResponded: 0,
+          successful: 0,
+          // @ts-expect-error update types
+          pending: agentIds?.length ?? 0,
+          failed: 0,
+        },
+      },
+      refetchInterval: isLive ? 1000 : false,
+      keepPreviousData: true,
+      enabled: !skip && !!agentIds?.length,
     }
   );
-
-  useEffect(() => {
-    setHostRequest((prevRequest) => {
-      const myRequest = {
-        ...(prevRequest ?? {}),
-        actionId,
-        factoryQueryType: OsqueryQueries.actionResults,
-        filterQuery: createFilter(filterQuery),
-        pagination: generateTablePaginationOptions(activePage, limit),
-        sort: {
-          direction,
-          field: sortField,
-        },
-      };
-      if (!deepEqual(prevRequest, myRequest)) {
-        return myRequest;
-      }
-      return prevRequest;
-    });
-  }, [actionId, activePage, direction, filterQuery, limit, sortField]);
-
-  return response;
 };
diff --git a/x-pack/plugins/osquery/public/actions/actions_table.tsx b/x-pack/plugins/osquery/public/actions/actions_table.tsx
index ca856938496514..5d1b9b723d98b6 100644
--- a/x-pack/plugins/osquery/public/actions/actions_table.tsx
+++ b/x-pack/plugins/osquery/public/actions/actions_table.tsx
@@ -5,128 +5,123 @@
  * 2.0.
  */
 
-import { isEmpty, isEqual, keys, map } from 'lodash/fp';
-import {
-  EuiLink,
-  EuiDataGrid,
-  EuiDataGridProps,
-  EuiDataGridColumn,
-  EuiDataGridSorting,
-  EuiLoadingContent,
-} from '@elastic/eui';
-import React, { createContext, useEffect, useState, useCallback, useContext, useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiBasicTable, EuiButtonIcon, EuiCodeBlock, formatDate } from '@elastic/eui';
+import React, { useState, useCallback, useMemo } from 'react';
 
 import { useAllActions } from './use_all_actions';
-import { ActionEdges, Direction } from '../../common/search_strategy';
+import { Direction } from '../../common/search_strategy';
 import { useRouterNavigate } from '../common/lib/kibana';
 
-const DataContext = createContext<ActionEdges>([]);
+interface ActionTableResultsButtonProps {
+  actionId: string;
+}
 
-const ActionsTableComponent = () => {
-  const [pagination, setPagination] = useState({ pageIndex: 0, pageSize: 50 });
-  const onChangeItemsPerPage = useCallback(
-    (pageSize) =>
-      setPagination((currentPagination) => ({
-        ...currentPagination,
-        pageSize,
-        pageIndex: 0,
-      })),
-    [setPagination]
-  );
-  const onChangePage = useCallback(
-    (pageIndex) => setPagination((currentPagination) => ({ ...currentPagination, pageIndex })),
-    [setPagination]
-  );
+const ActionTableResultsButton = React.memo<ActionTableResultsButtonProps>(({ actionId }) => {
+  const navProps = useRouterNavigate(`live_queries/${actionId}`);
+
+  return <EuiButtonIcon iconType="visTable" {...navProps} />;
+});
 
-  const [columns, setColumns] = useState<EuiDataGridColumn[]>([]);
+ActionTableResultsButton.displayName = 'ActionTableResultsButton';
 
-  // ** Sorting config
-  const [sortingColumns, setSortingColumns] = useState<EuiDataGridSorting['columns']>([]);
+const ActionsTableComponent = () => {
+  const [pageIndex, setPageIndex] = useState(0);
+  const [pageSize, setPageSize] = useState(20);
 
-  const { isLoading: actionsLoading, data: actionsData } = useAllActions({
-    activePage: pagination.pageIndex,
-    limit: pagination.pageSize,
+  const { data: actionsData } = useAllActions({
+    activePage: pageIndex,
+    limit: pageSize,
     direction: Direction.desc,
     sortField: '@timestamp',
   });
 
-  // Column visibility
-  const [visibleColumns, setVisibleColumns] = useState<string[]>([]); // initialize to the full set of columns
-
-  const columnVisibility = useMemo(() => ({ visibleColumns, setVisibleColumns }), [
-    visibleColumns,
-    setVisibleColumns,
-  ]);
-
-  const renderCellValue: EuiDataGridProps['renderCellValue'] = useMemo(
-    () => ({ rowIndex, columnId }) => {
-      // eslint-disable-next-line react-hooks/rules-of-hooks
-      const data = useContext(DataContext);
-      // @ts-expect-error fields is optional
-      const value = data[rowIndex].fields[columnId];
-
-      if (columnId === 'action_id') {
-        // eslint-disable-next-line react-hooks/rules-of-hooks
-        const linkProps = useRouterNavigate(`/live_query/${value}`);
-        return <EuiLink {...linkProps}>{value}</EuiLink>;
-      }
-
-      return !isEmpty(value) ? value : '-';
-    },
+  const onTableChange = useCallback(({ page = {} }) => {
+    const { index, size } = page;
+
+    setPageIndex(index);
+    setPageSize(size);
+  }, []);
+
+  const renderQueryColumn = useCallback(
+    (_, item) => (
+      <EuiCodeBlock language="sql" fontSize="s" paddingSize="none" transparentBackground>
+        {item._source.data.query}
+      </EuiCodeBlock>
+    ),
     []
   );
 
-  const tableSorting: EuiDataGridSorting = useMemo(
-    () => ({ columns: sortingColumns, onSort: setSortingColumns }),
-    [setSortingColumns, sortingColumns]
+  const renderAgentsColumn = useCallback((_, item) => <>{item.fields.agents?.length ?? 0}</>, []);
+
+  const renderTimestampColumn = useCallback(
+    (_, item) => <>{formatDate(item.fields['@timestamp'][0])}</>,
+    []
+  );
+
+  const renderActionsColumn = useCallback(
+    (item) => <ActionTableResultsButton actionId={item.fields.action_id[0]} />,
+    []
   );
 
-  const tablePagination = useMemo(
+  const columns = useMemo(
+    () => [
+      {
+        field: 'query',
+        name: i18n.translate('xpack.osquery.liveQueryActions.table.queryColumnTitle', {
+          defaultMessage: 'Query',
+        }),
+        truncateText: true,
+        render: renderQueryColumn,
+      },
+      {
+        field: 'agents',
+        name: i18n.translate('xpack.osquery.liveQueryActions.table.agentsColumnTitle', {
+          defaultMessage: 'Agents',
+        }),
+        width: '100px',
+        render: renderAgentsColumn,
+      },
+      {
+        field: 'created_at',
+        name: i18n.translate('xpack.osquery.liveQueryActions.table.createdAtColumnTitle', {
+          defaultMessage: 'Created at',
+        }),
+        width: '200px',
+        render: renderTimestampColumn,
+      },
+      {
+        name: i18n.translate('xpack.osquery.liveQueryActions.table.viewDetailsColumnTitle', {
+          defaultMessage: 'View details',
+        }),
+        actions: [
+          {
+            render: renderActionsColumn,
+          },
+        ],
+      },
+    ],
+    [renderActionsColumn, renderAgentsColumn, renderQueryColumn, renderTimestampColumn]
+  );
+
+  const pagination = useMemo(
     () => ({
-      ...pagination,
-      pageSizeOptions: [10, 50, 100],
-      onChangeItemsPerPage,
-      onChangePage,
+      pageIndex,
+      pageSize,
+      totalItemCount: actionsData?.totalCount ?? 0,
+      pageSizeOptions: [20, 50, 100],
     }),
-    [onChangeItemsPerPage, onChangePage, pagination]
+    [actionsData?.totalCount, pageIndex, pageSize]
   );
 
-  useEffect(() => {
-    // @ts-expect-error update types
-    const newColumns = keys(actionsData?.actions[0]?.fields)
-      .sort()
-      .map((fieldName) => ({
-        id: fieldName,
-        displayAsText: fieldName.split('.')[1],
-        defaultSortDirection: Direction.asc,
-      }));
-
-    if (!isEqual(columns, newColumns)) {
-      setColumns(newColumns);
-      setVisibleColumns(map('id', newColumns));
-    }
-    // @ts-expect-error update types
-  }, [columns, actionsData?.actions]);
-
-  if (actionsLoading) {
-    return <EuiLoadingContent lines={10} />;
-  }
-
   return (
-    // @ts-expect-error update types
-    // eslint-disable-next-line react-perf/jsx-no-new-array-as-prop
-    <DataContext.Provider value={actionsData?.actions ?? []}>
-      <EuiDataGrid
-        aria-label="Osquery actions"
-        columns={columns}
-        columnVisibility={columnVisibility}
-        // @ts-expect-error update types
-        rowCount={actionsData?.totalCount ?? 0}
-        renderCellValue={renderCellValue}
-        sorting={tableSorting}
-        pagination={tablePagination}
-      />
-    </DataContext.Provider>
+    <EuiBasicTable
+      // eslint-disable-next-line react-perf/jsx-no-new-array-as-prop
+      items={actionsData?.actions ?? []}
+      columns={columns}
+      pagination={pagination}
+      onChange={onTableChange}
+    />
   );
 };
 
diff --git a/x-pack/plugins/osquery/public/actions/helpers.ts b/x-pack/plugins/osquery/public/actions/helpers.ts
index 802674ee0398ce..171530a77299f9 100644
--- a/x-pack/plugins/osquery/public/actions/helpers.ts
+++ b/x-pack/plugins/osquery/public/actions/helpers.ts
@@ -16,15 +16,14 @@ export type InspectResponse = Inspect & { response: string[] };
 
 export const generateTablePaginationOptions = (
   activePage: number,
-  limit: number,
-  isBucketSort?: boolean
+  limit: number
 ): PaginationInputPaginated => {
   const cursorStart = activePage * limit;
   return {
     activePage,
     cursorStart,
     fakePossibleCount: 4 <= activePage && activePage > 0 ? limit * (activePage + 2) : limit * 5,
-    querySize: isBucketSort ? limit : limit + cursorStart,
+    querySize: limit,
   };
 };
 
diff --git a/x-pack/plugins/osquery/public/actions/use_action_details.ts b/x-pack/plugins/osquery/public/actions/use_action_details.ts
index eb5317f6c40e05..2e5fa79cae9923 100644
--- a/x-pack/plugins/osquery/public/actions/use_action_details.ts
+++ b/x-pack/plugins/osquery/public/actions/use_action_details.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import deepEqual from 'fast-deep-equal';
-import { useEffect, useState } from 'react';
 import { useQuery } from 'react-query';
 
 import { createFilter } from '../common/helpers';
@@ -36,17 +34,20 @@ interface UseActionDetails {
 export const useActionDetails = ({ actionId, filterQuery, skip = false }: UseActionDetails) => {
   const { data } = useKibana().services;
 
-  const [actionDetailsRequest, setHostRequest] = useState<ActionDetailsRequestOptions | null>(null);
-
-  const response = useQuery(
-    ['action', { actionId }],
+  return useQuery(
+    ['actionDetails', { actionId, filterQuery }],
     async () => {
-      if (!actionDetailsRequest) return Promise.resolve();
-
       const responseData = await data.search
-        .search<ActionDetailsRequestOptions, ActionDetailsStrategyResponse>(actionDetailsRequest, {
-          strategy: 'osquerySearchStrategy',
-        })
+        .search<ActionDetailsRequestOptions, ActionDetailsStrategyResponse>(
+          {
+            actionId,
+            factoryQueryType: OsqueryQueries.actionDetails,
+            filterQuery: createFilter(filterQuery),
+          },
+          {
+            strategy: 'osquerySearchStrategy',
+          }
+        )
         .toPromise();
 
       return {
@@ -55,24 +56,7 @@ export const useActionDetails = ({ actionId, filterQuery, skip = false }: UseAct
       };
     },
     {
-      enabled: !skip && !!actionDetailsRequest,
+      enabled: !skip,
     }
   );
-
-  useEffect(() => {
-    setHostRequest((prevRequest) => {
-      const myRequest = {
-        ...(prevRequest ?? {}),
-        actionId,
-        factoryQueryType: OsqueryQueries.actionDetails,
-        filterQuery: createFilter(filterQuery),
-      };
-      if (!deepEqual(prevRequest, myRequest)) {
-        return myRequest;
-      }
-      return prevRequest;
-    });
-  }, [actionId, filterQuery]);
-
-  return response;
 };
diff --git a/x-pack/plugins/osquery/public/actions/use_all_actions.ts b/x-pack/plugins/osquery/public/actions/use_all_actions.ts
index 2b76435efff0af..a58f45b8e99a2d 100644
--- a/x-pack/plugins/osquery/public/actions/use_all_actions.ts
+++ b/x-pack/plugins/osquery/public/actions/use_all_actions.ts
@@ -5,9 +5,7 @@
  * 2.0.
  */
 
-import { useEffect, useState } from 'react';
 import { useQuery } from 'react-query';
-import deepEqual from 'fast-deep-equal';
 
 import { createFilter } from '../common/helpers';
 import { useKibana } from '../common/lib/kibana';
@@ -51,17 +49,24 @@ export const useAllActions = ({
 }: UseAllActions) => {
   const { data } = useKibana().services;
 
-  const [actionsRequest, setHostRequest] = useState<ActionsRequestOptions | null>(null);
-
-  const response = useQuery(
+  return useQuery(
     ['actions', { activePage, direction, limit, sortField }],
     async () => {
-      if (!actionsRequest) return Promise.resolve();
-
       const responseData = await data.search
-        .search<ActionsRequestOptions, ActionsStrategyResponse>(actionsRequest, {
-          strategy: 'osquerySearchStrategy',
-        })
+        .search<ActionsRequestOptions, ActionsStrategyResponse>(
+          {
+            factoryQueryType: OsqueryQueries.actions,
+            filterQuery: createFilter(filterQuery),
+            pagination: generateTablePaginationOptions(activePage, limit),
+            sort: {
+              direction,
+              field: sortField,
+            },
+          },
+          {
+            strategy: 'osquerySearchStrategy',
+          }
+        )
         .toPromise();
 
       return {
@@ -71,28 +76,8 @@ export const useAllActions = ({
       };
     },
     {
-      enabled: !skip && !!actionsRequest,
+      keepPreviousData: true,
+      enabled: !skip,
     }
   );
-
-  useEffect(() => {
-    setHostRequest((prevRequest) => {
-      const myRequest = {
-        ...(prevRequest ?? {}),
-        factoryQueryType: OsqueryQueries.actions,
-        filterQuery: createFilter(filterQuery),
-        pagination: generateTablePaginationOptions(activePage, limit),
-        sort: {
-          direction,
-          field: sortField,
-        },
-      };
-      if (!deepEqual(prevRequest, myRequest)) {
-        return myRequest;
-      }
-      return prevRequest;
-    });
-  }, [activePage, direction, filterQuery, limit, sortField]);
-
-  return response;
 };
diff --git a/x-pack/plugins/osquery/public/agent_policies/agents_policy_link.tsx b/x-pack/plugins/osquery/public/agent_policies/agents_policy_link.tsx
new file mode 100644
index 00000000000000..549e70aa1f6346
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agent_policies/agents_policy_link.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiLink } from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
+
+import { pagePathGetters } from '../../../fleet/public';
+import { useKibana, isModifiedEvent, isLeftClickEvent } from '../common/lib/kibana';
+import { useAgentPolicy } from './use_agent_policy';
+
+interface AgentsPolicyLinkProps {
+  policyId: string;
+}
+
+const AgentsPolicyLinkComponent: React.FC<AgentsPolicyLinkProps> = ({ policyId }) => {
+  const {
+    application: { getUrlForApp, navigateToApp },
+  } = useKibana().services;
+
+  const { data } = useAgentPolicy({ policyId });
+
+  const href = useMemo(
+    () =>
+      getUrlForApp('fleet', {
+        path: `#` + pagePathGetters.policy_details({ policyId }),
+      }),
+    [getUrlForApp, policyId]
+  );
+
+  const handleClick = useCallback(
+    (event) => {
+      if (!isModifiedEvent(event) && isLeftClickEvent(event)) {
+        event.preventDefault();
+
+        return navigateToApp('fleet', {
+          path: `#` + pagePathGetters.policy_details({ policyId }),
+        });
+      }
+    },
+    [navigateToApp, policyId]
+  );
+
+  return (
+    // eslint-disable-next-line @elastic/eui/href-or-on-click
+    <EuiLink href={href} onClick={handleClick}>
+      {data?.name ?? policyId}
+    </EuiLink>
+  );
+};
+
+export const AgentsPolicyLink = React.memo(AgentsPolicyLinkComponent);
diff --git a/x-pack/plugins/osquery/public/agent_policies/index.tsx b/x-pack/plugins/osquery/public/agent_policies/index.tsx
new file mode 100644
index 00000000000000..c010c8f10f9b62
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agent_policies/index.tsx
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './use_agent_policies';
+export * from './use_agent_policy';
diff --git a/x-pack/plugins/osquery/public/agent_policies/use_agent_policies.ts b/x-pack/plugins/osquery/public/agent_policies/use_agent_policies.ts
new file mode 100644
index 00000000000000..95323dd23f4d29
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agent_policies/use_agent_policies.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useQuery } from 'react-query';
+
+import { useKibana } from '../common/lib/kibana';
+import {
+  agentPolicyRouteService,
+  GetAgentPoliciesResponse,
+  GetAgentPoliciesResponseItem,
+} from '../../../fleet/common';
+
+export const useAgentPolicies = () => {
+  const { http } = useKibana().services;
+
+  return useQuery<GetAgentPoliciesResponse, unknown, GetAgentPoliciesResponseItem[]>(
+    ['agentPolicies'],
+    () =>
+      http.get(agentPolicyRouteService.getListPath(), {
+        query: {
+          perPage: 100,
+        },
+      }),
+    {
+      initialData: { items: [], total: 0, page: 1, perPage: 100 },
+      placeholderData: [],
+      keepPreviousData: true,
+      select: (response) => response.items,
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/agent_policies/use_agent_policy.ts b/x-pack/plugins/osquery/public/agent_policies/use_agent_policy.ts
new file mode 100644
index 00000000000000..5fdc317d3f6f16
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agent_policies/use_agent_policy.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useQuery } from 'react-query';
+
+import { useKibana } from '../common/lib/kibana';
+import { agentPolicyRouteService } from '../../../fleet/common';
+
+interface UseAgentPolicy {
+  policyId: string;
+  skip?: boolean;
+}
+
+export const useAgentPolicy = ({ policyId, skip }: UseAgentPolicy) => {
+  const { http } = useKibana().services;
+
+  return useQuery(
+    ['agentPolicy', { policyId }],
+    () => http.get(agentPolicyRouteService.getInfoPath(policyId)),
+    {
+      enabled: !skip,
+      keepPreviousData: true,
+      select: (response) => response.item,
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/agents/agents_table.tsx b/x-pack/plugins/osquery/public/agents/agents_table.tsx
index 38132957c341f9..88e3bda7bac4b6 100644
--- a/x-pack/plugins/osquery/public/agents/agents_table.tsx
+++ b/x-pack/plugins/osquery/public/agents/agents_table.tsx
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect, useMemo, useState } from 'react';
-import { EuiComboBox, EuiHealth, EuiHighlight } from '@elastic/eui';
+import { find } from 'lodash/fp';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { EuiComboBox, EuiHealth, EuiHighlight, EuiSpacer } from '@elastic/eui';
 
 import { useDebounce } from 'react-use';
 import { useAllAgents } from './use_all_agents';
@@ -38,7 +39,7 @@ interface AgentsTableProps {
 const perPage = 10;
 const DEBOUNCE_DELAY = 100; // ms
 
-const AgentsTableComponent: React.FC<AgentsTableProps> = ({ onChange }) => {
+const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onChange }) => {
   // search related
   const [searchValue, setSearchValue] = useState<string>('');
   const [modifyingSearch, setModifyingSearch] = useState<boolean>(false);
@@ -67,13 +68,34 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ onChange }) => {
   const [options, setOptions] = useState<GroupOption[]>([]);
   const [selectedOptions, setSelectedOptions] = useState<GroupOption[]>([]);
   const [numAgentsSelected, setNumAgentsSelected] = useState<number>(0);
+  const defaultValueInitialized = useRef(false);
+
+  useEffect(() => {
+    if (agentSelection && !defaultValueInitialized.current && options.length) {
+      if (agentSelection.policiesSelected) {
+        const policyOptions = find(['label', 'Policy'], options);
+
+        if (policyOptions) {
+          const defaultOptions = policyOptions.options?.filter((option) =>
+            agentSelection.policiesSelected.includes(option.label)
+          );
+
+          if (defaultOptions?.length) {
+            setSelectedOptions(defaultOptions);
+          }
+          defaultValueInitialized.current = true;
+        }
+      }
+    }
+  }, [agentSelection, options]);
 
   useEffect(() => {
     // update the groups when groups or agents have changed
     grouper.setTotalAgents(totalNumAgents);
     grouper.updateGroup(AGENT_GROUP_KEY.Platform, groups.platforms);
     grouper.updateGroup(AGENT_GROUP_KEY.Policy, groups.policies);
-    grouper.updateGroup(AGENT_GROUP_KEY.Agent, agents);
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    grouper.updateGroup(AGENT_GROUP_KEY.Agent, agents!);
     const newOptions = grouper.generateOptions();
     setOptions(newOptions);
   }, [groups.platforms, groups.policies, totalNumAgents, groupsLoading, agents, grouper]);
@@ -134,8 +156,6 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ onChange }) => {
 
   return (
     <div>
-      {numAgentsSelected > 0 ? <span>{generateSelectedAgentsMessage(numAgentsSelected)}</span> : ''}
-      &nbsp;
       <EuiComboBox
         placeholder={SELECT_AGENT_LABEL}
         isLoading={modifyingSearch || groupsLoading || agentsLoading}
@@ -147,6 +167,8 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ onChange }) => {
         onChange={onSelection}
         renderOption={renderOption}
       />
+      <EuiSpacer size="xs" />
+      {numAgentsSelected > 0 ? <span>{generateSelectedAgentsMessage(numAgentsSelected)}</span> : ''}
     </div>
   );
 };
diff --git a/x-pack/plugins/osquery/public/agents/helpers.ts b/x-pack/plugins/osquery/public/agents/helpers.ts
index 14a8dd64fb4da4..948e2a0ea50b01 100644
--- a/x-pack/plugins/osquery/public/agents/helpers.ts
+++ b/x-pack/plugins/osquery/public/agents/helpers.ts
@@ -159,15 +159,14 @@ export const generateAgentSelection = (selection: GroupOption[]) => {
 
 export const generateTablePaginationOptions = (
   activePage: number,
-  limit: number,
-  isBucketSort?: boolean
+  limit: number
 ): PaginationInputPaginated => {
   const cursorStart = activePage * limit;
   return {
     activePage,
     cursorStart,
     fakePossibleCount: 4 <= activePage && activePage > 0 ? limit * (activePage + 2) : limit * 5,
-    querySize: isBucketSort ? limit : limit + cursorStart,
+    querySize: limit,
   };
 };
 
diff --git a/x-pack/plugins/osquery/public/agents/use_agent_policies.ts b/x-pack/plugins/osquery/public/agents/use_agent_policies.ts
index 3045423ccbe2d2..c8b3ef064c0388 100644
--- a/x-pack/plugins/osquery/public/agents/use_agent_policies.ts
+++ b/x-pack/plugins/osquery/public/agents/use_agent_policies.ts
@@ -5,13 +5,10 @@
  * 2.0.
  */
 
+import { mapKeys } from 'lodash';
 import { useQueries, UseQueryResult } from 'react-query';
 import { useKibana } from '../common/lib/kibana';
-import {
-  AgentPolicy,
-  agentPolicyRouteService,
-  GetOneAgentPolicyResponse,
-} from '../../../fleet/common';
+import { agentPolicyRouteService, GetOneAgentPolicyResponse } from '../../../fleet/common';
 
 export const useAgentPolicies = (policyIds: string[] = []) => {
   const { http } = useKibana().services;
@@ -26,13 +23,7 @@ export const useAgentPolicies = (policyIds: string[] = []) => {
 
   const agentPoliciesLoading = agentResponse.some((p) => p.isLoading);
   const agentPolicies = agentResponse.map((p) => p.data?.item);
-  const agentPolicyById = agentPolicies.reduce((acc, p) => {
-    if (!p) {
-      return acc;
-    }
-    acc[p.id] = p;
-    return acc;
-  }, {} as { [key: string]: AgentPolicy });
+  const agentPolicyById = mapKeys(agentPolicies, 'id');
 
   return { agentPoliciesLoading, agentPolicies, agentPolicyById };
 };
diff --git a/x-pack/plugins/osquery/public/agents/use_agent_status.ts b/x-pack/plugins/osquery/public/agents/use_agent_status.ts
new file mode 100644
index 00000000000000..c26adb908f6bed
--- /dev/null
+++ b/x-pack/plugins/osquery/public/agents/use_agent_status.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useQuery } from 'react-query';
+
+import { GetAgentStatusResponse, agentRouteService } from '../../../fleet/common';
+import { useKibana } from '../common/lib/kibana';
+
+interface UseAgentStatus {
+  policyId?: string;
+  skip?: boolean;
+}
+
+export const useAgentStatus = ({ policyId, skip }: UseAgentStatus) => {
+  const { http } = useKibana().services;
+
+  return useQuery<GetAgentStatusResponse, unknown, GetAgentStatusResponse['results']>(
+    ['agentStatus', policyId],
+    () =>
+      http.get(
+        agentRouteService.getStatusPath(),
+        policyId
+          ? {
+              query: {
+                policyId,
+              },
+            }
+          : {}
+      ),
+    {
+      enabled: !skip,
+      select: (response) => response.results,
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/agents/use_all_agents.ts b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
index bd9b1c32412e6d..4086175046c1c9 100644
--- a/x-pack/plugins/osquery/public/agents/use_all_agents.ts
+++ b/x-pack/plugins/osquery/public/agents/use_all_agents.ts
@@ -7,6 +7,7 @@
 
 import { useQuery } from 'react-query';
 
+import { GetAgentsResponse, agentRouteService } from '../../../fleet/common';
 import { useKibana } from '../common/lib/kibana';
 
 interface UseAllAgents {
@@ -27,14 +28,14 @@ export const useAllAgents = (
 ) => {
   const { perPage } = opts;
   const { http } = useKibana().services;
-  const { isLoading: agentsLoading, data: agentData } = useQuery(
+  const { isLoading: agentsLoading, data: agentData } = useQuery<GetAgentsResponse>(
     ['agents', osqueryPolicies, searchValue, perPage],
-    async () => {
+    () => {
       let kuery = `(${osqueryPolicies.map((p) => `policy_id:${p}`).join(' or ')})`;
       if (searchValue) {
         kuery += ` and (local_metadata.host.hostname:/${searchValue}/ or local_metadata.elastic.agent.id:/${searchValue}/)`;
       }
-      return await http.get('/api/fleet/agents', {
+      return http.get(agentRouteService.getListPath(), {
         query: {
           kuery,
           perPage,
diff --git a/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts b/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts
index f786e9167d2f83..2937c57b50a3d5 100644
--- a/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts
+++ b/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts
@@ -7,20 +7,20 @@
 
 import { useQuery } from 'react-query';
 import { useKibana } from '../common/lib/kibana';
-import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../fleet/common';
+import { packagePolicyRouteService, PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../fleet/common';
+import { OSQUERY_INTEGRATION_NAME } from '../../common';
 
 export const useOsqueryPolicies = () => {
   const { http } = useKibana().services;
 
   const { isLoading: osqueryPoliciesLoading, data: osqueryPolicies } = useQuery(
     ['osqueryPolicies'],
-    async () => {
-      return await http.get('/api/fleet/package_policies', {
+    () =>
+      http.get(packagePolicyRouteService.getListPath(), {
         query: {
-          kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name:osquery_manager`,
+          kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name:${OSQUERY_INTEGRATION_NAME}`,
         },
-      });
-    },
+      }),
     { select: (data) => data.items.map((p: { policy_id: string }) => p.policy_id) }
   );
 
diff --git a/x-pack/plugins/osquery/public/application.tsx b/x-pack/plugins/osquery/public/application.tsx
index d72a788b162452..3e959132e21a83 100644
--- a/x-pack/plugins/osquery/public/application.tsx
+++ b/x-pack/plugins/osquery/public/application.tsx
@@ -13,7 +13,7 @@ import ReactDOM from 'react-dom';
 import { Router } from 'react-router-dom';
 import { I18nProvider } from '@kbn/i18n/react';
 import { ThemeProvider } from 'styled-components';
-import { QueryClient, QueryClientProvider } from 'react-query';
+import { QueryClientProvider } from 'react-query';
 import { ReactQueryDevtools } from 'react-query/devtools';
 
 import { useUiSetting$ } from '../../../../src/plugins/kibana_react/public';
@@ -23,8 +23,7 @@ import { AppPluginStartDependencies } from './types';
 import { OsqueryApp } from './components/app';
 import { DEFAULT_DARK_MODE, PLUGIN_NAME } from '../common';
 import { KibanaContextProvider } from './common/lib/kibana';
-
-const queryClient = new QueryClient();
+import { queryClient } from './query_client';
 
 const OsqueryAppContext = () => {
   const [darkMode] = useUiSetting$<boolean>(DEFAULT_DARK_MODE);
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_date/schema.gql.ts b/x-pack/plugins/osquery/public/common/hooks/index.tsx
similarity index 76%
rename from x-pack/plugins/security_solution/server/graphql/scalar_date/schema.gql.ts
rename to x-pack/plugins/osquery/public/common/hooks/index.tsx
index 3c1ba4fedcf36f..750e09b44d89b8 100644
--- a/x-pack/plugins/security_solution/server/graphql/scalar_date/schema.gql.ts
+++ b/x-pack/plugins/osquery/public/common/hooks/index.tsx
@@ -5,8 +5,5 @@
  * 2.0.
  */
 
-import gql from 'graphql-tag';
-
-export const dateSchema = gql`
-  scalar Date
-`;
+export * from './use_discover_link';
+export * from './use_osquery_integration';
diff --git a/x-pack/plugins/osquery/public/common/hooks/use_breadcrumbs.tsx b/x-pack/plugins/osquery/public/common/hooks/use_breadcrumbs.tsx
new file mode 100644
index 00000000000000..660ef87fb57e3e
--- /dev/null
+++ b/x-pack/plugins/osquery/public/common/hooks/use_breadcrumbs.tsx
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import type { ChromeBreadcrumb } from 'src/core/public';
+
+import { BASE_PATH } from '../../../common/constants';
+import type { Page, DynamicPagePathValues } from '../page_paths';
+import { pagePathGetters } from '../page_paths';
+
+import { useKibana } from '../lib/kibana';
+
+const BASE_BREADCRUMB: ChromeBreadcrumb = {
+  href: pagePathGetters.overview(),
+  text: i18n.translate('xpack.osquery.breadcrumbs.appTitle', {
+    defaultMessage: 'Osquery',
+  }),
+};
+
+const breadcrumbGetters: {
+  [key in Page]?: (values: DynamicPagePathValues) => ChromeBreadcrumb[];
+} = {
+  base: () => [BASE_BREADCRUMB],
+  overview: () => [
+    BASE_BREADCRUMB,
+    {
+      text: i18n.translate('xpack.osquery.breadcrumbs.overviewPageTitle', {
+        defaultMessage: 'Overview',
+      }),
+    },
+  ],
+  live_queries: () => [
+    BASE_BREADCRUMB,
+    {
+      text: i18n.translate('xpack.osquery.breadcrumbs.liveQueriesPageTitle', {
+        defaultMessage: 'Live queries',
+      }),
+    },
+  ],
+  live_query_new: () => [
+    BASE_BREADCRUMB,
+    {
+      href: pagePathGetters.live_queries(),
+      text: i18n.translate('xpack.osquery.breadcrumbs.liveQueriesPageTitle', {
+        defaultMessage: 'Live queries',
+      }),
+    },
+    {
+      text: i18n.translate('xpack.osquery.breadcrumbs.newLiveQueryPageTitle', {
+        defaultMessage: 'New',
+      }),
+    },
+  ],
+  live_query_details: ({ liveQueryId }) => [
+    BASE_BREADCRUMB,
+    {
+      href: pagePathGetters.live_queries(),
+      text: i18n.translate('xpack.osquery.breadcrumbs.liveQueriesPageTitle', {
+        defaultMessage: 'Live queries',
+      }),
+    },
+    {
+      text: liveQueryId,
+    },
+  ],
+  scheduled_query_groups: () => [
+    BASE_BREADCRUMB,
+    {
+      text: i18n.translate('xpack.osquery.breadcrumbs.scheduledQueryGroupsPageTitle', {
+        defaultMessage: 'Scheduled query groups',
+      }),
+    },
+  ],
+  scheduled_query_group_add: () => [
+    BASE_BREADCRUMB,
+    {
+      href: pagePathGetters.scheduled_query_groups(),
+      text: i18n.translate('xpack.osquery.breadcrumbs.scheduledQueryGroupsPageTitle', {
+        defaultMessage: 'Scheduled query groups',
+      }),
+    },
+    {
+      text: i18n.translate('xpack.osquery.breadcrumbs.addScheduledQueryGroupsPageTitle', {
+        defaultMessage: 'Add',
+      }),
+    },
+  ],
+  scheduled_query_group_details: ({ scheduledQueryGroupName }) => [
+    BASE_BREADCRUMB,
+    {
+      href: pagePathGetters.scheduled_query_groups(),
+      text: i18n.translate('xpack.osquery.breadcrumbs.scheduledQueryGroupsPageTitle', {
+        defaultMessage: 'Scheduled query groups',
+      }),
+    },
+    {
+      text: scheduledQueryGroupName,
+    },
+  ],
+  scheduled_query_group_edit: ({ scheduledQueryGroupName, scheduledQueryGroupId }) => [
+    BASE_BREADCRUMB,
+    {
+      href: pagePathGetters.scheduled_query_groups(),
+      text: i18n.translate('xpack.osquery.breadcrumbs.scheduledQueryGroupsPageTitle', {
+        defaultMessage: 'Scheduled query groups',
+      }),
+    },
+    {
+      href: pagePathGetters.scheduled_query_group_details({ scheduledQueryGroupId }),
+      text: scheduledQueryGroupName,
+    },
+    {
+      text: i18n.translate('xpack.osquery.breadcrumbs.editScheduledQueryGroupsPageTitle', {
+        defaultMessage: 'Edit',
+      }),
+    },
+  ],
+};
+
+export function useBreadcrumbs(page: Page, values: DynamicPagePathValues = {}) {
+  const { chrome, http } = useKibana().services;
+  const breadcrumbs: ChromeBreadcrumb[] =
+    breadcrumbGetters[page]?.(values).map((breadcrumb) => ({
+      ...breadcrumb,
+      href: breadcrumb.href ? http.basePath.prepend(`${BASE_PATH}${breadcrumb.href}`) : undefined,
+    })) || [];
+  const docTitle: string[] = [...breadcrumbs]
+    .reverse()
+    .map((breadcrumb) => breadcrumb.text as string);
+  chrome.docTitle.change(docTitle);
+  chrome.setBreadcrumbs(breadcrumbs);
+}
diff --git a/x-pack/plugins/osquery/public/common/hooks/use_discover_link.tsx b/x-pack/plugins/osquery/public/common/hooks/use_discover_link.tsx
new file mode 100644
index 00000000000000..dd091d80ce62ed
--- /dev/null
+++ b/x-pack/plugins/osquery/public/common/hooks/use_discover_link.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useEffect, useState } from 'react';
+
+import { FilterStateStore } from '../../../../../../src/plugins/data/common';
+import { useKibana, isModifiedEvent, isLeftClickEvent } from '../lib/kibana';
+
+interface UseDiscoverLink {
+  filters: Array<{ key: string; value: string | number }>;
+}
+
+export const useDiscoverLink = ({ filters }: UseDiscoverLink) => {
+  const {
+    application: { navigateToUrl },
+  } = useKibana().services;
+  const urlGenerator = useKibana().services.discover?.urlGenerator;
+  const [discoverUrl, setDiscoverUrl] = useState<string>('');
+
+  useEffect(() => {
+    const getDiscoverUrl = async () => {
+      if (!urlGenerator?.createUrl) return;
+
+      const newUrl = await urlGenerator.createUrl({
+        indexPatternId: 'logs-*',
+        filters: filters.map((filter) => ({
+          meta: {
+            index: 'logs-*',
+            alias: null,
+            negate: false,
+            disabled: false,
+            type: 'phrase',
+            key: filter.key,
+            params: { query: filter.value },
+          },
+          query: { match_phrase: { action_id: filter.value } },
+          $state: { store: FilterStateStore.APP_STATE },
+        })),
+      });
+      setDiscoverUrl(newUrl);
+    };
+    getDiscoverUrl();
+  }, [filters, urlGenerator]);
+
+  const onClick = useCallback(
+    (event: React.MouseEvent) => {
+      if (!isModifiedEvent(event) && isLeftClickEvent(event) && discoverUrl) {
+        event.preventDefault();
+
+        return navigateToUrl(discoverUrl);
+      }
+    },
+    [discoverUrl, navigateToUrl]
+  );
+
+  return {
+    href: discoverUrl,
+    onClick,
+  };
+};
diff --git a/x-pack/plugins/osquery/public/common/hooks/use_osquery_integration.tsx b/x-pack/plugins/osquery/public/common/hooks/use_osquery_integration.tsx
new file mode 100644
index 00000000000000..d8bed30b969ade
--- /dev/null
+++ b/x-pack/plugins/osquery/public/common/hooks/use_osquery_integration.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { find } from 'lodash/fp';
+import { useQuery } from 'react-query';
+
+import { GetPackagesResponse, epmRouteService } from '../../../../fleet/common';
+import { OSQUERY_INTEGRATION_NAME } from '../../../common';
+import { useKibana } from '../lib/kibana';
+
+export const useOsqueryIntegration = () => {
+  const { http } = useKibana().services;
+
+  return useQuery(
+    'integrations',
+    () =>
+      http.get(epmRouteService.getListPath(), {
+        query: {
+          experimental: true,
+        },
+      }),
+    {
+      select: ({ response }: GetPackagesResponse) =>
+        find(['name', OSQUERY_INTEGRATION_NAME], response),
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/common/lib/kibana/kibana_react.ts b/x-pack/plugins/osquery/public/common/lib/kibana/kibana_react.ts
index 63288507b29d45..dc49bfcee6dda7 100644
--- a/x-pack/plugins/osquery/public/common/lib/kibana/kibana_react.ts
+++ b/x-pack/plugins/osquery/public/common/lib/kibana/kibana_react.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import React from 'react';
 import { useHistory } from 'react-router-dom';
 import {
   KibanaContextProvider,
@@ -24,6 +25,11 @@ export interface WithKibanaProps {
 
 const useTypedKibana = () => useKibana<StartServices>();
 
+const isModifiedEvent = (event: React.MouseEvent) =>
+  !!(event.metaKey || event.altKey || event.ctrlKey || event.shiftKey);
+
+const isLeftClickEvent = (event: React.MouseEvent) => event.button === 0;
+
 const useRouterNavigate = (
   to: Parameters<typeof reactRouterNavigate>[1],
   onClickCallback?: Parameters<typeof reactRouterNavigate>[2]
@@ -35,6 +41,8 @@ const useRouterNavigate = (
 export {
   KibanaContextProvider,
   useRouterNavigate,
+  isLeftClickEvent,
+  isModifiedEvent,
   useTypedKibana as useKibana,
   useUiSetting,
   useUiSetting$,
diff --git a/x-pack/plugins/osquery/public/common/page_paths.ts b/x-pack/plugins/osquery/public/common/page_paths.ts
new file mode 100644
index 00000000000000..b4c7963fb9a02a
--- /dev/null
+++ b/x-pack/plugins/osquery/public/common/page_paths.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type StaticPage =
+  | 'base'
+  | 'overview'
+  | 'live_queries'
+  | 'live_query_new'
+  | 'scheduled_query_groups'
+  | 'scheduled_query_group_add';
+
+export type DynamicPage =
+  | 'live_query_details'
+  | 'scheduled_query_group_details'
+  | 'scheduled_query_group_edit';
+
+export type Page = StaticPage | DynamicPage;
+
+export interface DynamicPagePathValues {
+  [key: string]: string;
+}
+
+export const BASE_PATH = '/app/fleet';
+
+// If routing paths are changed here, please also check to see if
+// `pagePathGetters()`, below, needs any modifications
+export const PAGE_ROUTING_PATHS = {
+  overview: '/',
+  live_queries: '/live_queries',
+  live_query_new: '/live_queries/new',
+  live_query_details: '/live_queries/:liveQueryId',
+  scheduled_query_groups: '/scheduled_query_groups',
+  scheduled_query_group_add: '/scheduled_query_groups/add',
+  scheduled_query_group_details: '/scheduled_query_groups/:scheduledQueryGroupId',
+  scheduled_query_group_edit: '/scheduled_query_groups/:scheduledQueryGroupId/edit',
+};
+
+export const pagePathGetters: {
+  [key in StaticPage]: () => string;
+} &
+  {
+    [key in DynamicPage]: (values: DynamicPagePathValues) => string;
+  } = {
+  base: () => '/',
+  overview: () => '/',
+  live_queries: () => '/live_queries',
+  live_query_new: () => '/live_queries/new',
+  live_query_details: ({ liveQueryId }) => `/live_queries/${liveQueryId}`,
+  scheduled_query_groups: () => '/scheduled_query_groups',
+  scheduled_query_group_add: () => '/scheduled_query_groups/add',
+  scheduled_query_group_details: ({ scheduledQueryGroupId }) =>
+    `/scheduled_query_groups/${scheduledQueryGroupId}`,
+  scheduled_query_group_edit: ({ scheduledQueryGroupId }) =>
+    `/scheduled_query_groups/${scheduledQueryGroupId}/edit`,
+};
diff --git a/x-pack/plugins/osquery/public/components/app.tsx b/x-pack/plugins/osquery/public/components/app.tsx
index a4a1f51fdd02b8..d56aacc99ad53b 100644
--- a/x-pack/plugins/osquery/public/components/app.tsx
+++ b/x-pack/plugins/osquery/public/components/app.tsx
@@ -7,14 +7,15 @@
 
 import React, { useMemo } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiFlexGroup, EuiFlexItem, EuiTabs, EuiTab } from '@elastic/eui';
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiTabs, EuiTab } from '@elastic/eui';
 import { useLocation } from 'react-router-dom';
 
 import { Container, Nav, Wrapper } from './layouts';
 import { OsqueryAppRoutes } from '../routes';
 import { useRouterNavigate } from '../common/lib/kibana';
+import { ManageIntegrationLink } from './manage_integration_link';
 
-export const OsqueryAppComponent = () => {
+const OsqueryAppComponent = () => {
   const location = useLocation();
   const section = useMemo(() => location.pathname.split('/')[1] ?? 'overview', [location.pathname]);
 
@@ -25,20 +26,49 @@ export const OsqueryAppComponent = () => {
           <EuiFlexGroup gutterSize="l" alignItems="center">
             <EuiFlexItem>
               <EuiTabs display="condensed">
-                <EuiTab isSelected={section === 'overview'} {...useRouterNavigate('overview')}>
+                {/* <EuiTab isSelected={section === 'overview'} {...useRouterNavigate('overview')}>
                   <FormattedMessage
                     id="xpack.osquery.appNavigation.overviewLinkText"
                     defaultMessage="Overview"
                   />
+                </EuiTab> */}
+                <EuiTab
+                  isSelected={section === 'live_queries'}
+                  {...useRouterNavigate('live_queries')}
+                >
+                  <FormattedMessage
+                    id="xpack.osquery.appNavigation.liveQueriesLinkText"
+                    defaultMessage="Live queries"
+                  />
                 </EuiTab>
-                <EuiTab isSelected={section === 'live_query'} {...useRouterNavigate('live_query')}>
+                <EuiTab
+                  isSelected={section === 'scheduled_query_groups'}
+                  {...useRouterNavigate('scheduled_query_groups')}
+                >
                   <FormattedMessage
-                    id="xpack.osquery.appNavigation.liveQueryLinkText"
-                    defaultMessage="Live Query"
+                    id="xpack.osquery.appNavigation.scheduledQueryGroupsLinkText"
+                    defaultMessage="Scheduled query groups"
                   />
                 </EuiTab>
               </EuiTabs>
             </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiFlexGroup gutterSize="s" direction="row">
+                <EuiFlexItem>
+                  <EuiButtonEmpty
+                    iconType="popout"
+                    href="https://ela.st/osquery-feedback"
+                    target="_blank"
+                  >
+                    <FormattedMessage
+                      id="xpack.osquery.appNavigation.sendFeedbackButton"
+                      defaultMessage="Send feedback"
+                    />
+                  </EuiButtonEmpty>
+                </EuiFlexItem>
+                <ManageIntegrationLink />
+              </EuiFlexGroup>
+            </EuiFlexItem>
           </EuiFlexGroup>
         </Nav>
         <OsqueryAppRoutes />
diff --git a/x-pack/plugins/osquery/public/components/beta_badge.tsx b/x-pack/plugins/osquery/public/components/beta_badge.tsx
new file mode 100644
index 00000000000000..f63c80168b487c
--- /dev/null
+++ b/x-pack/plugins/osquery/public/components/beta_badge.tsx
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiBetaBadge, EuiText } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import styled from 'styled-components';
+
+export const BetaBadgeRowWrapper = styled(EuiText)`
+  display: flex;
+  align-items: center;
+`;
+
+const Wrapper = styled.div`
+  padding-left: ${({ theme }) => theme.eui.paddingSizes.s};
+`;
+
+const betaBadgeLabel = i18n.translate('xpack.osquery.common.tabBetaBadgeLabel', {
+  defaultMessage: 'Beta',
+});
+
+const betaBadgeTooltipContent = i18n.translate('xpack.osquery.common.tabBetaBadgeTooltipContent', {
+  defaultMessage:
+    'This feature is under active development. Extra functionality is coming, and some functionality may change.',
+});
+
+const BetaBadgeComponent = () => (
+  <Wrapper>
+    <EuiBetaBadge label={betaBadgeLabel} tooltipContent={betaBadgeTooltipContent} />
+  </Wrapper>
+);
+
+export const BetaBadge = React.memo(BetaBadgeComponent);
diff --git a/x-pack/plugins/osquery/public/components/manage_integration_link.tsx b/x-pack/plugins/osquery/public/components/manage_integration_link.tsx
new file mode 100644
index 00000000000000..db201611baed51
--- /dev/null
+++ b/x-pack/plugins/osquery/public/components/manage_integration_link.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useMemo } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiButtonEmpty, EuiFlexItem } from '@elastic/eui';
+
+import { pagePathGetters } from '../../../fleet/public';
+
+import { useKibana, isModifiedEvent, isLeftClickEvent } from '../common/lib/kibana';
+import { useOsqueryIntegration } from '../common/hooks';
+
+const ManageIntegrationLinkComponent = () => {
+  const {
+    application: {
+      getUrlForApp,
+      navigateToApp,
+      capabilities: {
+        osquery: { save: hasSaveUICapabilities },
+      },
+    },
+  } = useKibana().services;
+  const { data: osqueryIntegration } = useOsqueryIntegration();
+
+  const integrationHref = useMemo(() => {
+    if (osqueryIntegration) {
+      return getUrlForApp('fleet', {
+        path:
+          '#' +
+          pagePathGetters.integration_details_policies({
+            pkgkey: `${osqueryIntegration.name}-${osqueryIntegration.version}`,
+          }),
+      });
+    }
+  }, [getUrlForApp, osqueryIntegration]);
+
+  const integrationClick = useCallback(
+    (event) => {
+      if (!isModifiedEvent(event) && isLeftClickEvent(event)) {
+        event.preventDefault();
+        if (osqueryIntegration) {
+          return navigateToApp('fleet', {
+            path:
+              '#' +
+              pagePathGetters.integration_details_policies({
+                pkgkey: `${osqueryIntegration.name}-${osqueryIntegration.version}`,
+              }),
+          });
+        }
+      }
+    },
+    [navigateToApp, osqueryIntegration]
+  );
+
+  return hasSaveUICapabilities && integrationHref ? (
+    <EuiFlexItem>
+      {
+        // eslint-disable-next-line @elastic/eui/href-or-on-click
+        <EuiButtonEmpty iconType="gear" href={integrationHref} onClick={integrationClick}>
+          <FormattedMessage
+            id="xpack.osquery.appNavigation.manageIntegrationButton"
+            defaultMessage="Manage integration"
+          />
+        </EuiButtonEmpty>
+      }
+    </EuiFlexItem>
+  ) : null;
+};
+
+export const ManageIntegrationLink = React.memo(ManageIntegrationLinkComponent);
diff --git a/x-pack/plugins/osquery/public/editor/index.tsx b/x-pack/plugins/osquery/public/editor/index.tsx
index 4cdb027480f983..70da55ca3f007b 100644
--- a/x-pack/plugins/osquery/public/editor/index.tsx
+++ b/x-pack/plugins/osquery/public/editor/index.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback } from 'react';
+import React from 'react';
 import { EuiCodeEditor } from '@elastic/eui';
 import 'brace/theme/tomorrow';
 
@@ -22,30 +22,27 @@ const EDITOR_PROPS = {
 
 interface OsqueryEditorProps {
   defaultValue: string;
+  disabled?: boolean;
   onChange: (newValue: string) => void;
 }
 
-const OsqueryEditorComponent: React.FC<OsqueryEditorProps> = ({ defaultValue, onChange }) => {
-  const handleChange = useCallback(
-    (newValue) => {
-      onChange(newValue);
-    },
-    [onChange]
-  );
-
-  return (
-    <EuiCodeEditor
-      value={defaultValue}
-      mode="osquery"
-      theme="tomorrow"
-      onChange={handleChange}
-      name="osquery_editor"
-      setOptions={EDITOR_SET_OPTIONS}
-      editorProps={EDITOR_PROPS}
-      height="100px"
-      width="100%"
-    />
-  );
-};
+const OsqueryEditorComponent: React.FC<OsqueryEditorProps> = ({
+  defaultValue,
+  // disabled,
+  onChange,
+}) => (
+  <EuiCodeEditor
+    value={defaultValue}
+    mode="osquery"
+    // isReadOnly={disabled}
+    theme="tomorrow"
+    onChange={onChange}
+    name="osquery_editor"
+    setOptions={EDITOR_SET_OPTIONS}
+    editorProps={EDITOR_PROPS}
+    height="200px"
+    width="100%"
+  />
+);
 
 export const OsqueryEditor = React.memo(OsqueryEditorComponent);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/add_new_query_flyout.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/add_new_query_flyout.tsx
deleted file mode 100644
index b02b3d288256e1..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/add_new_query_flyout.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable react/jsx-no-bind */
-
-/* eslint-disable react-perf/jsx-no-new-function-as-prop */
-
-import { produce } from 'immer';
-import { EuiFlyout, EuiTitle, EuiFlyoutBody, EuiFlyoutHeader, EuiPortal } from '@elastic/eui';
-import React from 'react';
-
-import { AddPackQueryForm } from '../../packs/common/add_pack_query';
-
-// @ts-expect-error update types
-export const AddNewQueryFlyout = ({ data, handleChange, onClose }) => {
-  // @ts-expect-error update types
-  const handleSubmit = (payload) => {
-    // @ts-expect-error update types
-    const updatedPolicy = produce(data, (draft) => {
-      draft.inputs[0].streams.push({
-        data_stream: {
-          type: 'logs',
-          dataset: 'osquery_elastic_managed.osquery',
-        },
-        vars: {
-          query: {
-            type: 'text',
-            value: payload.query.attributes.query,
-          },
-          interval: {
-            type: 'text',
-            value: `${payload.interval}`,
-          },
-          id: {
-            type: 'text',
-            value: payload.query.id,
-          },
-        },
-        enabled: true,
-      });
-    });
-
-    onClose();
-    handleChange({
-      isValid: true,
-      updatedPolicy,
-    });
-  };
-
-  return (
-    <EuiPortal>
-      <EuiFlyout ownFocus onClose={onClose} aria-labelledby="flyoutTitle">
-        <EuiFlyoutHeader hasBorder>
-          <EuiTitle size="s">
-            <h2 id="flyoutTitle">Attach next query</h2>
-          </EuiTitle>
-        </EuiFlyoutHeader>
-        <EuiFlyoutBody>
-          <AddPackQueryForm handleSubmit={handleSubmit} />
-        </EuiFlyoutBody>
-      </EuiFlyout>
-    </EuiPortal>
-  );
-};
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/custom_tab_tabs.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/custom_tab_tabs.tsx
deleted file mode 100644
index 9d2df5bbb0960a..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/custom_tab_tabs.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useMemo } from 'react';
-import { useLocation } from 'react-router-dom';
-import qs from 'query-string';
-
-import { Queries } from '../../queries';
-import { Packs } from '../../packs';
-import { LiveQuery } from '../../live_query';
-
-const CustomTabTabsComponent = () => {
-  const location = useLocation();
-
-  const selectedTab = useMemo(() => qs.parse(location.search)?.tab, [location.search]);
-
-  if (selectedTab === 'packs') {
-    return <Packs />;
-  }
-
-  if (selectedTab === 'saved_queries') {
-    return <Queries />;
-  }
-
-  if (selectedTab === 'live_query') {
-    return <LiveQuery />;
-  }
-
-  return <Packs />;
-};
-
-export const CustomTabTabs = React.memo(CustomTabTabsComponent);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/form.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/form.tsx
deleted file mode 100644
index bb9bf066a9f924..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/form.tsx
+++ /dev/null
@@ -1,240 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable @typescript-eslint/naming-convention */
-
-import produce from 'immer';
-import { find } from 'lodash/fp';
-import { EuiSpacer, EuiText, EuiHorizontalRule, EuiSuperSelect } from '@elastic/eui';
-import React, { useCallback, useMemo } from 'react';
-import deepEqual from 'fast-deep-equal';
-import { useQuery } from 'react-query';
-
-import {
-  // UseField,
-  useForm,
-  useFormData,
-  UseArray,
-  getUseField,
-  Field,
-  ToggleField,
-  Form,
-} from '../../shared_imports';
-
-// import { OsqueryStreamField } from '../../scheduled_query/common/osquery_stream_field';
-import { useKibana } from '../../common/lib/kibana';
-import { ScheduledQueryQueriesTable } from './scheduled_queries_table';
-import { schema } from './schema';
-
-const CommonUseField = getUseField({ component: Field });
-
-const EDIT_SCHEDULED_QUERY_FORM_ID = 'editScheduledQueryForm';
-
-interface EditScheduledQueryFormProps {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  data: Array<Record<string, any>>;
-  handleSubmit: () => Promise<void>;
-}
-
-const EditScheduledQueryFormComponent: React.FC<EditScheduledQueryFormProps> = ({
-  data,
-  handleSubmit,
-}) => {
-  const { http } = useKibana().services;
-
-  const {
-    data: { saved_objects: packs } = {
-      saved_objects: [],
-    },
-  } = useQuery('packs', () => http.get('/internal/osquery/pack'));
-
-  const { form } = useForm({
-    id: EDIT_SCHEDULED_QUERY_FORM_ID,
-    onSubmit: handleSubmit,
-    schema,
-    defaultValue: data,
-    options: {
-      stripEmptyFields: false,
-    },
-    // @ts-expect-error update types
-    deserializer: (payload) => {
-      const deserialized = produce(payload, (draft) => {
-        // @ts-expect-error update types
-        draft.streams = draft.inputs[0].streams.map(({ data_stream, enabled, vars }) => ({
-          data: {
-            data_stream,
-            enabled,
-            vars,
-          },
-        }));
-      });
-
-      return deserialized;
-    },
-    // @ts-expect-error update types
-    serializer: (payload) => {
-      const serialized = produce(payload, (draft) => {
-        // @ts-expect-error update types
-        if (draft.inputs) {
-          // @ts-expect-error update types
-          draft.inputs[0].config = {
-            pack: {
-              type: 'id',
-              value: 'e33f5f30-705e-11eb-9e99-9f6b4d0d9506',
-            },
-          };
-          // @ts-expect-error update types
-          draft.inputs[0].type = 'osquery';
-          // @ts-expect-error update types
-          draft.inputs[0].streams = draft.inputs[0].streams?.map((stream) => stream.data) ?? [];
-        }
-      });
-
-      return serialized;
-    },
-  });
-
-  const { setFieldValue } = form;
-
-  const handlePackChange = useCallback(
-    (value) => {
-      const newPack = find(['id', value], packs);
-
-      setFieldValue(
-        'streams',
-        // @ts-expect-error update types
-        newPack.queries.map((packQuery, index) => ({
-          id: index,
-          isNew: true,
-          path: `streams[${index}]`,
-          data: {
-            data_stream: {
-              type: 'logs',
-              dataset: 'osquery_elastic_managed.osquery',
-            },
-            id: 'osquery-osquery_elastic_managed.osquery-7065c2dc-f835-4d13-9486-6eec515f39bd',
-            vars: {
-              query: {
-                type: 'text',
-                value: packQuery.query,
-              },
-              interval: {
-                type: 'text',
-                value: `${packQuery.interval}`,
-              },
-              id: {
-                type: 'text',
-                value: packQuery.id,
-              },
-            },
-            enabled: true,
-          },
-        }))
-      );
-    },
-    [packs, setFieldValue]
-  );
-
-  const [formData] = useFormData({ form, watch: ['streams'] });
-
-  const scheduledQueries = useMemo(() => {
-    if (formData.inputs) {
-      // @ts-expect-error update types
-      return formData.streams.reduce((acc, stream) => {
-        if (!stream.data) {
-          return acc;
-        }
-
-        return [...acc, stream.data];
-      }, []);
-    }
-
-    return [];
-  }, [formData]);
-
-  return (
-    <Form form={form}>
-      <EuiSuperSelect
-        // @ts-expect-error update types
-        options={packs.map((pack) => ({
-          value: pack.id,
-          inputDisplay: (
-            <>
-              <EuiText>{pack.name}</EuiText>
-              <EuiText size="s" color="subdued">
-                <p className="euiTextColor--subdued">{pack.description}</p>
-              </EuiText>
-            </>
-          ),
-        }))}
-        valueOfSelected={packs[0]?.id}
-        onChange={handlePackChange}
-      />
-      <ScheduledQueryQueriesTable data={scheduledQueries} />
-      <CommonUseField path="enabled" component={ToggleField} />
-      <EuiHorizontalRule />
-      <EuiSpacer />
-      <UseArray path="streams" readDefaultValueOnForm={true}>
-        {
-          // eslint-disable-next-line @typescript-eslint/no-unused-vars
-          ({ items, form: streamsForm, addItem, removeItem }) => {
-            return (
-              <>
-                {/* {items.map((item) => {
-                return (
-                  <UseField
-                    key={item.path}
-                    path={`${item.path}.data`}
-                    component={OsqueryStreamField}
-                    // eslint-disable-next-line react/jsx-no-bind, react-perf/jsx-no-new-function-as-prop
-                    removeItem={() => removeItem(item.id)}
-                    // readDefaultValueOnForm={true}
-                    defaultValue={
-                      item.isNew
-                        ? // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
-                          {
-                            data_stream: {
-                              type: 'logs',
-                              dataset: 'osquery_elastic_managed.osquery',
-                            },
-                            vars: {
-                              query: {
-                                type: 'text',
-                                value: 'select * from uptime',
-                              },
-                              interval: {
-                                type: 'text',
-                                value: '120',
-                              },
-                              id: {
-                                type: 'text',
-                                value: uuid.v4(),
-                              },
-                            },
-                            enabled: true,
-                          }
-                        : get(item.path, streamsForm.getFormData())
-                    }
-                  />
-                );
-              })} */}
-                {/* <EuiButtonEmpty onClick={addItem} iconType="plusInCircleFilled">
-                {'Add query'}
-              </EuiButtonEmpty> */}
-              </>
-            );
-          }
-        }
-      </UseArray>
-    </Form>
-  );
-};
-
-export const EditScheduledQueryForm = React.memo(
-  EditScheduledQueryFormComponent,
-  (prevProps, nextProps) => deepEqual(prevProps.data, nextProps.data)
-);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/input_stream_form.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/input_stream_form.tsx
deleted file mode 100644
index 34508c93e73bd3..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/input_stream_form.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-
-import { useForm, Form, getUseField, Field, FIELD_TYPES } from '../../shared_imports';
-
-const CommonUseField = getUseField({ component: Field });
-
-const FORM_ID = 'inputStreamForm';
-
-const schema = {
-  data_stream: {
-    dataset: {
-      type: FIELD_TYPES.TEXT,
-    },
-    type: {
-      type: FIELD_TYPES.TEXT,
-    },
-  },
-  enabled: {
-    type: FIELD_TYPES.TOGGLE,
-    label: 'Active',
-  },
-  id: {
-    type: FIELD_TYPES.TEXT,
-  },
-  vars: {
-    id: {
-      type: {
-        type: FIELD_TYPES.TEXT,
-      },
-      value: { type: FIELD_TYPES.TEXT },
-    },
-    interval: {
-      type: {
-        type: FIELD_TYPES.TEXT,
-      },
-      value: { type: FIELD_TYPES.TEXT },
-    },
-    query: {
-      type: {
-        type: FIELD_TYPES.TEXT,
-      },
-      value: { type: FIELD_TYPES.TEXT },
-    },
-  },
-};
-
-// @ts-expect-error update types
-const InputStreamFormComponent = ({ data }) => {
-  const { form } = useForm({
-    id: FORM_ID,
-    schema,
-    defaultValue: data,
-  });
-
-  return (
-    <Form form={form}>
-      <CommonUseField path="vars.query.value" />
-    </Form>
-  );
-};
-
-export const InputStreamForm = React.memo(InputStreamFormComponent);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/input_type.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/input_type.tsx
deleted file mode 100644
index 4a4e2a799ae42a..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/input_type.tsx
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable react-perf/jsx-no-new-object-as-prop */
-
-/* eslint-disable react-perf/jsx-no-new-array-as-prop */
-
-import React, { useCallback } from 'react';
-import produce from 'immer';
-import { EuiRadioGroup } from '@elastic/eui';
-
-// @ts-expect-error update types
-export const ScheduledQueryInputType = ({ data, handleChange }) => {
-  const radios = [
-    {
-      id: 'pack',
-      label: 'Pack',
-    },
-    {
-      id: 'saved_queries',
-      label: 'Saved queries',
-    },
-  ];
-
-  const onChange = useCallback(
-    (optionId: string) => {
-      // @ts-expect-error update types
-      const updatedPolicy = produce(data, (draft) => {
-        if (!draft.inputs[0].config) {
-          draft.inputs[0].config = {
-            input_source: {
-              type: 'text',
-              value: optionId,
-            },
-          };
-        } else {
-          draft.inputs[0].config.input_source.value = optionId;
-        }
-      });
-
-      handleChange({
-        isValid: true,
-        updatedPolicy,
-      });
-    },
-    [data, handleChange]
-  );
-
-  return (
-    <EuiRadioGroup
-      options={radios}
-      idSelected={data.inputs[0].config?.input_source?.value ?? 'saved_queries'}
-      onChange={onChange}
-      name="radio group"
-      legend={{
-        children: <span>{'Choose input type'}</span>,
-      }}
-    />
-  );
-};
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/navigation.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/navigation.tsx
deleted file mode 100644
index 5f5d5c0c8b546e..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/navigation.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { snakeCase } from 'lodash/fp';
-import { EuiIcon, EuiSideNav } from '@elastic/eui';
-import React, { useCallback, useMemo } from 'react';
-import { useHistory, useLocation } from 'react-router-dom';
-import qs from 'query-string';
-
-export const Navigation = () => {
-  const { push } = useHistory();
-  const location = useLocation();
-
-  const selectedItemName = useMemo(() => qs.parse(location.search)?.tab, [location.search]);
-
-  const handleTabClick = useCallback(
-    (tab) => {
-      push({
-        search: qs.stringify({ tab }),
-      });
-    },
-    [push]
-  );
-
-  const createItem = useCallback(
-    (name, data = {}) => ({
-      ...data,
-      id: snakeCase(name),
-      name,
-      isSelected: selectedItemName === name,
-      onClick: () => handleTabClick(snakeCase(name)),
-    }),
-    [handleTabClick, selectedItemName]
-  );
-
-  const sideNav = useMemo(
-    () => [
-      createItem('Packs', {
-        forceOpen: true,
-        items: [
-          createItem('List', {
-            icon: <EuiIcon type="list" />,
-          }),
-          createItem('New pack', {
-            icon: <EuiIcon type="listAdd" />,
-          }),
-        ],
-      }),
-      createItem('Saved Queries', {
-        forceOpen: true,
-        items: [
-          createItem('List', {
-            icon: <EuiIcon type="list" />,
-          }),
-          createItem('New query', {
-            icon: <EuiIcon type="listAdd" />,
-          }),
-        ],
-      }),
-      // createItem('Scheduled Queries', {
-      //   forceOpen: true,
-      //   items: [
-      //     createItem('List', {
-      //       icon: <EuiIcon type="list" />,
-      //     }),
-      //     createItem('Schedule new query', {
-      //       icon: <EuiIcon type="listAdd" />,
-      //     }),
-      //   ],
-      // }),
-      createItem('Live Query', {
-        forceOpen: true,
-        items: [
-          createItem('Run', {
-            icon: <EuiIcon type="play" />,
-          }),
-          createItem('History', {
-            icon: <EuiIcon type="tableDensityNormal" />,
-          }),
-        ],
-      }),
-    ],
-    [createItem]
-  );
-
-  // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
-  return <EuiSideNav items={sideNav} style={{ width: 200 }} />;
-};
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/pack_selector.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/pack_selector.tsx
deleted file mode 100644
index 7d3f7debace72e..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/pack_selector.tsx
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable react/jsx-no-bind */
-
-/* eslint-disable react-perf/jsx-no-new-function-as-prop */
-
-import { find } from 'lodash/fp';
-import { produce } from 'immer';
-import { EuiText, EuiSuperSelect } from '@elastic/eui';
-import React from 'react';
-import { useQuery } from 'react-query';
-
-import { useKibana } from '../../common/lib/kibana';
-
-// @ts-expect-error update types
-export const ScheduledQueryPackSelector = ({ data, handleChange }) => {
-  const { http } = useKibana().services;
-  const {
-    data: { saved_objects: packs } = {
-      saved_objects: [],
-    },
-  } = useQuery('packs', () => http.get('/internal/osquery/pack'));
-
-  // @ts-expect-error update types
-  const handlePackChange = (value) => {
-    const newPack = find(['id', value], packs);
-
-    // @ts-expect-error update types
-    const updatedPolicy = produce(data, (draft) => {
-      draft.inputs[0].config.pack = {
-        type: 'text',
-        value: newPack.id,
-      };
-      // @ts-expect-error update types
-      draft.inputs[0].streams = newPack.queries.map((packQuery) => ({
-        data_stream: {
-          type: 'logs',
-          dataset: 'osquery_elastic_managed.osquery',
-        },
-        vars: {
-          query: {
-            type: 'text',
-            value: packQuery.query,
-          },
-          interval: {
-            type: 'text',
-            value: `${packQuery.interval}`,
-          },
-          id: {
-            type: 'text',
-            value: packQuery.id,
-          },
-        },
-        enabled: true,
-      }));
-    });
-
-    handleChange({
-      isValid: true,
-      updatedPolicy,
-    });
-  };
-
-  return (
-    <EuiSuperSelect
-      // @ts-expect-error update types
-      options={packs.map((pack) => ({
-        value: pack.id,
-        inputDisplay: (
-          <>
-            <EuiText>{pack.name}</EuiText>
-            <EuiText size="s" color="subdued">
-              <p className="euiTextColor--subdued">{pack.description}</p>
-            </EuiText>
-          </>
-        ),
-      }))}
-      valueOfSelected={data.inputs[0].config}
-      onChange={handlePackChange}
-    />
-  );
-};
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/scheduled_queries_table.tsx b/x-pack/plugins/osquery/public/fleet_integration/components/scheduled_queries_table.tsx
deleted file mode 100644
index 67a94ec518d601..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/scheduled_queries_table.tsx
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable react-perf/jsx-no-new-function-as-prop */
-
-/* eslint-disable react/jsx-no-bind */
-
-/* eslint-disable react-perf/jsx-no-new-object-as-prop */
-
-/* eslint-disable react/display-name */
-
-/* eslint-disable react-perf/jsx-no-new-array-as-prop */
-
-import React, { useState } from 'react';
-import {
-  EuiBasicTable,
-  EuiButtonIcon,
-  EuiHealth,
-  EuiDescriptionList,
-  RIGHT_ALIGNMENT,
-} from '@elastic/eui';
-
-// @ts-expect-error update types
-export const ScheduledQueryQueriesTable = ({ data }) => {
-  const [pageIndex, setPageIndex] = useState(0);
-  const [pageSize, setPageSize] = useState(5);
-  const [sortField, setSortField] = useState('firstName');
-  const [sortDirection, setSortDirection] = useState('asc');
-  const [itemIdToExpandedRowMap, setItemIdToExpandedRowMap] = useState({});
-
-  const onTableChange = ({ page = {}, sort = {} }) => {
-    // @ts-expect-error update types
-    const { index, size } = page;
-    // @ts-expect-error update types
-    const { field, direction } = sort;
-
-    setPageIndex(index);
-    setPageSize(size);
-    setSortField(field);
-    setSortDirection(direction);
-  };
-
-  // @ts-expect-error update types
-  const toggleDetails = (item) => {
-    const itemIdToExpandedRowMapValues = { ...itemIdToExpandedRowMap };
-    // @ts-expect-error update types
-    if (itemIdToExpandedRowMapValues[item.id]) {
-      // @ts-expect-error update types
-      delete itemIdToExpandedRowMapValues[item.id];
-    } else {
-      const { online } = item;
-      const color = online ? 'success' : 'danger';
-      const label = online ? 'Online' : 'Offline';
-      const listItems = [
-        {
-          title: 'Online',
-          description: <EuiHealth color={color}>{label}</EuiHealth>,
-        },
-      ];
-      // @ts-expect-error update types
-      itemIdToExpandedRowMapValues[item.id] = <EuiDescriptionList listItems={listItems} />;
-    }
-    setItemIdToExpandedRowMap(itemIdToExpandedRowMapValues);
-  };
-
-  const columns = [
-    {
-      field: 'vars.id.value',
-      name: 'ID',
-    },
-    {
-      field: 'vars.interval.value',
-      name: 'Interval',
-    },
-    {
-      field: 'enabled',
-      name: 'Active',
-    },
-    {
-      name: 'Actions',
-      actions: [
-        {
-          name: 'Clone',
-          description: 'Clone this person',
-          type: 'icon',
-          icon: 'copy',
-          onClick: () => '',
-        },
-      ],
-    },
-    {
-      align: RIGHT_ALIGNMENT,
-      width: '40px',
-      isExpander: true,
-      // @ts-expect-error update types
-      render: (item) => (
-        <EuiButtonIcon
-          onClick={() => toggleDetails(item)}
-          // @ts-expect-error update types
-          aria-label={itemIdToExpandedRowMap[item.id] ? 'Collapse' : 'Expand'}
-          // @ts-expect-error update types
-          iconType={itemIdToExpandedRowMap[item.id] ? 'arrowUp' : 'arrowDown'}
-        />
-      ),
-    },
-  ];
-
-  const pagination = {
-    pageIndex,
-    pageSize,
-    totalItemCount: data.inputs[0].streams.length,
-    pageSizeOptions: [3, 5, 8],
-  };
-
-  const sorting = {
-    sort: {
-      field: sortField,
-      direction: sortDirection,
-    },
-  };
-
-  return (
-    <EuiBasicTable
-      items={data.inputs[0].streams}
-      itemId="id"
-      itemIdToExpandedRowMap={itemIdToExpandedRowMap}
-      isExpandable={true}
-      hasActions={true}
-      // @ts-expect-error update types
-      columns={columns}
-      pagination={pagination}
-      // @ts-expect-error update types
-      sorting={sorting}
-      isSelectable={true}
-      onChange={onTableChange}
-    />
-  );
-};
diff --git a/x-pack/plugins/osquery/public/fleet_integration/components/schema.ts b/x-pack/plugins/osquery/public/fleet_integration/components/schema.ts
deleted file mode 100644
index 9a59c443b0a506..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/components/schema.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FIELD_TYPES } from '../../shared_imports';
-
-export const schema = {
-  name: {
-    type: FIELD_TYPES.TEXT,
-    label: 'Name',
-  },
-  description: {
-    type: FIELD_TYPES.TEXT,
-    label: 'Description',
-  },
-  namespace: {
-    type: FIELD_TYPES.TEXT,
-  },
-  enabled: {
-    type: FIELD_TYPES.TOGGLE,
-  },
-  policy_id: {
-    type: FIELD_TYPES.TEXT,
-  },
-  streams: {
-    type: FIELD_TYPES.MULTI_SELECT,
-    vars: {
-      query: {
-        type: {
-          type: FIELD_TYPES.TEXT,
-        },
-        value: {
-          type: FIELD_TYPES.TEXT,
-        },
-      },
-    },
-  },
-};
diff --git a/x-pack/plugins/osquery/public/fleet_integration/index.ts b/x-pack/plugins/osquery/public/fleet_integration/index.ts
index b36a2698b83374..e27c2712c7d8cf 100644
--- a/x-pack/plugins/osquery/public/fleet_integration/index.ts
+++ b/x-pack/plugins/osquery/public/fleet_integration/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export * from './lazy_osquery_managed_empty_create_policy_extension';
-export * from './lazy_osquery_managed_empty_edit_policy_extension';
-export * from './lazy_osquery_managed_policy_create_extension';
+export * from './lazy_osquery_managed_policy_create_import_extension';
 export * from './lazy_osquery_managed_policy_edit_extension';
-export * from './lazy_osquery_managed_custom_extension';
+export * from './lazy_osquery_managed_custom_button_extension';
diff --git a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_custom_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_custom_button_extension.tsx
similarity index 53%
rename from x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_custom_extension.tsx
rename to x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_custom_button_extension.tsx
index 1493182cdbaa69..e547686c0166be 100644
--- a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_custom_extension.tsx
+++ b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_custom_button_extension.tsx
@@ -8,9 +8,13 @@
 import { lazy } from 'react';
 import { PackageCustomExtensionComponent } from '../../../fleet/public';
 
-export const LazyOsqueryManagedCustomExtension = lazy<PackageCustomExtensionComponent>(async () => {
-  const { OsqueryManagedCustomExtension } = await import('./osquery_managed_custom_extension');
-  return {
-    default: OsqueryManagedCustomExtension,
-  };
-});
+export const LazyOsqueryManagedCustomButtonExtension = lazy<PackageCustomExtensionComponent>(
+  async () => {
+    const { OsqueryManagedCustomButtonExtension } = await import(
+      './osquery_managed_custom_button_extension'
+    );
+    return {
+      default: OsqueryManagedCustomButtonExtension,
+    };
+  }
+);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_empty_edit_policy_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_empty_edit_policy_extension.tsx
deleted file mode 100644
index 3f9ef42e971048..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_empty_edit_policy_extension.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { lazy } from 'react';
-import { PackagePolicyEditExtensionComponent } from '../../../fleet/public';
-
-export const LazyOsqueryManagedEmptyEditPolicyExtension = lazy<PackagePolicyEditExtensionComponent>(
-  async () => {
-    const { OsqueryManagedEmptyEditPolicyExtension } = await import(
-      './osquery_managed_empty_edit_policy_extension'
-    );
-    return {
-      default: OsqueryManagedEmptyEditPolicyExtension,
-    };
-  }
-);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_create_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_create_extension.tsx
deleted file mode 100644
index 8f0726fdbe2095..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_create_extension.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { lazy } from 'react';
-import { PackagePolicyCreateExtensionComponent } from '../../../fleet/public';
-
-export const LazyOsqueryManagedPolicyCreateExtension = lazy<PackagePolicyCreateExtensionComponent>(
-  async () => {
-    const { OsqueryManagedPolicyCreateExtension } = await import(
-      './osquery_managed_policy_create_extension'
-    );
-    return {
-      default: OsqueryManagedPolicyCreateExtension,
-    };
-  }
-);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_empty_create_policy_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_create_import_extension.tsx
similarity index 58%
rename from x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_empty_create_policy_extension.tsx
rename to x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_create_import_extension.tsx
index 21f59c505952b3..95220e8251707a 100644
--- a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_empty_create_policy_extension.tsx
+++ b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_create_import_extension.tsx
@@ -8,13 +8,13 @@
 import { lazy } from 'react';
 import { PackagePolicyCreateExtensionComponent } from '../../../fleet/public';
 
-export const LazyOsqueryManagedEmptyCreatePolicyExtension = lazy<PackagePolicyCreateExtensionComponent>(
+export const LazyOsqueryManagedPolicyCreateImportExtension = lazy<PackagePolicyCreateExtensionComponent>(
   async () => {
-    const { OsqueryManagedEmptyCreatePolicyExtension } = await import(
-      './osquery_managed_empty_create_policy_extension'
+    const { OsqueryManagedPolicyCreateImportExtension } = await import(
+      './osquery_managed_policy_create_import_extension'
     );
     return {
-      default: OsqueryManagedEmptyCreatePolicyExtension,
+      default: OsqueryManagedPolicyCreateImportExtension,
     };
   }
 );
diff --git a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_edit_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_edit_extension.tsx
index 4289bcccdbc563..787a39f3a34b70 100644
--- a/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_edit_extension.tsx
+++ b/x-pack/plugins/osquery/public/fleet_integration/lazy_osquery_managed_policy_edit_extension.tsx
@@ -10,11 +10,11 @@ import { PackagePolicyEditExtensionComponent } from '../../../fleet/public';
 
 export const LazyOsqueryManagedPolicyEditExtension = lazy<PackagePolicyEditExtensionComponent>(
   async () => {
-    const { OsqueryManagedPolicyCreateExtension } = await import(
-      './osquery_managed_policy_create_extension'
+    const { OsqueryManagedPolicyCreateImportExtension } = await import(
+      './osquery_managed_policy_create_import_extension'
     );
     return {
-      default: OsqueryManagedPolicyCreateExtension,
+      default: OsqueryManagedPolicyCreateImportExtension,
     };
   }
 );
diff --git a/x-pack/plugins/osquery/public/fleet_integration/navigation_buttons.tsx b/x-pack/plugins/osquery/public/fleet_integration/navigation_buttons.tsx
new file mode 100644
index 00000000000000..808718c55d1994
--- /dev/null
+++ b/x-pack/plugins/osquery/public/fleet_integration/navigation_buttons.tsx
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiCard, EuiIcon } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useCallback, useMemo } from 'react';
+
+import { useKibana, isModifiedEvent, isLeftClickEvent } from '../common/lib/kibana';
+
+interface NavigationButtonsProps {
+  isDisabled?: boolean;
+  integrationPolicyId?: string;
+  agentPolicyId?: string;
+}
+
+const NavigationButtonsComponent: React.FC<NavigationButtonsProps> = ({
+  isDisabled,
+  integrationPolicyId,
+  agentPolicyId,
+}) => {
+  const {
+    application: { getUrlForApp, navigateToApp },
+  } = useKibana().services;
+
+  const liveQueryHref = useMemo(
+    () =>
+      getUrlForApp('osquery', {
+        path: agentPolicyId
+          ? `/live_queries/new?agentPolicyId=${agentPolicyId}`
+          : ' `/live_queries/new',
+      }),
+    [agentPolicyId, getUrlForApp]
+  );
+
+  const liveQueryClick = useCallback(
+    (event) => {
+      if (!isModifiedEvent(event) && isLeftClickEvent(event)) {
+        event.preventDefault();
+        navigateToApp('osquery', {
+          path: agentPolicyId
+            ? `/live_queries/new?agentPolicyId=${agentPolicyId}`
+            : ' `/live_queries/new',
+        });
+      }
+    },
+    [agentPolicyId, navigateToApp]
+  );
+
+  const scheduleQueryGroupsHref = getUrlForApp('osquery', {
+    path: integrationPolicyId
+      ? `/scheduled_query_groups/${integrationPolicyId}/edit`
+      : `/scheduled_query_groups`,
+  });
+
+  const scheduleQueryGroupsClick = useCallback(
+    (event) => {
+      if (!isModifiedEvent(event) && isLeftClickEvent(event)) {
+        event.preventDefault();
+        navigateToApp('osquery', {
+          path: integrationPolicyId
+            ? `/scheduled_query_groups/${integrationPolicyId}/edit`
+            : `/scheduled_query_groups`,
+        });
+      }
+    },
+    [navigateToApp, integrationPolicyId]
+  );
+
+  return (
+    <EuiFlexGroup gutterSize="l">
+      <EuiFlexItem>
+        <EuiCard
+          icon={<EuiIcon size="xl" type="console" />}
+          title={i18n.translate('xpack.osquery.fleetIntegration.runLiveQueriesButtonText', {
+            defaultMessage: 'Run live queries',
+          })}
+          href={liveQueryHref}
+          onClick={liveQueryClick}
+          description={''}
+          isDisabled={isDisabled}
+        />
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiCard
+          icon={<EuiIcon size="xl" type="clock" />}
+          title={i18n.translate('xpack.osquery.fleetIntegration.scheduleQueryGroupsButtonText', {
+            defaultMessage: 'Schedule query groups',
+          })}
+          description={''}
+          isDisabled={isDisabled}
+          href={scheduleQueryGroupsHref}
+          onClick={scheduleQueryGroupsClick}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+NavigationButtonsComponent.displayName = 'NavigationButtonsComponent';
+
+export const NavigationButtons = React.memo(NavigationButtonsComponent);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_custom_button_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_custom_button_extension.tsx
new file mode 100644
index 00000000000000..775b5c7a06d216
--- /dev/null
+++ b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_custom_button_extension.tsx
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { PackageCustomExtensionComponentProps } from '../../../fleet/public';
+import { NavigationButtons } from './navigation_buttons';
+
+/**
+ * Exports Osquery-specific package policy instructions
+ * for use in the Fleet app custom tab
+ */
+export const OsqueryManagedCustomButtonExtension = React.memo<PackageCustomExtensionComponentProps>(
+  () => <NavigationButtons />
+);
+OsqueryManagedCustomButtonExtension.displayName = 'OsqueryManagedCustomButtonExtension';
diff --git a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_custom_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_custom_extension.tsx
deleted file mode 100644
index 1295699a270a5c..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_custom_extension.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import React from 'react';
-import { QueryClient, QueryClientProvider } from 'react-query';
-
-import { PackageCustomExtensionComponentProps } from '../../../fleet/public';
-import { CustomTabTabs } from './components/custom_tab_tabs';
-import { Navigation } from './components/navigation';
-
-const queryClient = new QueryClient();
-
-/**
- * Exports Osquery-specific package policy instructions
- * for use in the Fleet app custom tab
- */
-export const OsqueryManagedCustomExtension = React.memo<PackageCustomExtensionComponentProps>(
-  () => (
-    <QueryClientProvider client={queryClient}>
-      <EuiFlexGroup>
-        <EuiFlexItem grow={false}>
-          <Navigation />
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <CustomTabTabs />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </QueryClientProvider>
-  )
-);
-OsqueryManagedCustomExtension.displayName = 'OsqueryManagedCustomExtension';
diff --git a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_empty_create_policy_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_empty_create_policy_extension.tsx
deleted file mode 100644
index 828edfc0a29b45..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_empty_create_policy_extension.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useEffect } from 'react';
-import { produce } from 'immer';
-import deepEqual from 'fast-deep-equal';
-
-import { PackagePolicyCreateExtensionComponentProps } from '../../../fleet/public';
-
-/**
- * Exports Osquery-specific package policy instructions
- * for use in the Fleet app create / edit package policy
- */
-const OsqueryManagedEmptyCreatePolicyExtensionComponent: React.FC<PackagePolicyCreateExtensionComponentProps> = ({
-  onChange,
-  newPolicy,
-}) => {
-  useEffect(() => {
-    const updatedPolicy = produce(newPolicy, (draft) => {
-      draft.inputs.forEach((input) => (input.streams = []));
-    });
-
-    onChange({
-      isValid: true,
-      updatedPolicy,
-    });
-  });
-
-  return <></>;
-};
-
-OsqueryManagedEmptyCreatePolicyExtensionComponent.displayName =
-  'OsqueryManagedEmptyCreatePolicyExtension';
-
-export const OsqueryManagedEmptyCreatePolicyExtension = React.memo(
-  OsqueryManagedEmptyCreatePolicyExtensionComponent,
-  // we don't want to update the component if onChange has changed
-  (prevProps, nextProps) => deepEqual(prevProps.newPolicy, nextProps.newPolicy)
-);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_empty_edit_policy_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_empty_edit_policy_extension.tsx
deleted file mode 100644
index c8304ea5f0d1e8..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_empty_edit_policy_extension.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-
-import { PackagePolicyEditExtensionComponentProps } from '../../../fleet/public';
-
-/**
- * Exports Osquery-specific package policy instructions
- * for use in the Fleet app edit package policy
- */
-const OsqueryManagedEmptyEditPolicyExtensionComponent = () => <></>;
-
-OsqueryManagedEmptyEditPolicyExtensionComponent.displayName =
-  'OsqueryManagedEmptyEditPolicyExtension';
-
-export const OsqueryManagedEmptyEditPolicyExtension = React.memo<PackagePolicyEditExtensionComponentProps>(
-  OsqueryManagedEmptyEditPolicyExtensionComponent
-);
diff --git a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_policy_create_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_policy_create_extension.tsx
deleted file mode 100644
index 09653b09365ced..00000000000000
--- a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_policy_create_extension.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButton } from '@elastic/eui';
-import React, { useCallback, useState } from 'react';
-import { QueryClient, QueryClientProvider } from 'react-query';
-
-import { PackagePolicyCreateExtensionComponentProps } from '../../../fleet/public';
-import { ScheduledQueryInputType } from './components/input_type';
-import { ScheduledQueryPackSelector } from './components/pack_selector';
-import { ScheduledQueryQueriesTable } from './components/scheduled_queries_table';
-import { AddNewQueryFlyout } from './components/add_new_query_flyout';
-
-const queryClient = new QueryClient();
-
-/**
- * Exports Osquery-specific package policy instructions
- * for use in the Fleet app create / edit package policy
- */
-export const OsqueryManagedPolicyCreateExtension = React.memo<PackagePolicyCreateExtensionComponentProps>(
-  ({ onChange, newPolicy }) => {
-    const [showAddQueryFlyout, setShowAddQueryFlyout] = useState(false);
-
-    const handleShowFlyout = useCallback(() => setShowAddQueryFlyout(true), []);
-    const handleHideFlyout = useCallback(() => setShowAddQueryFlyout(false), []);
-
-    return (
-      <QueryClientProvider client={queryClient}>
-        <ScheduledQueryInputType data={newPolicy} handleChange={onChange} />
-        {newPolicy.inputs[0].config?.input_source?.value === 'pack' && (
-          <ScheduledQueryPackSelector data={newPolicy} handleChange={onChange} />
-        )}
-        {newPolicy.inputs[0].streams.length && (
-          // @ts-expect-error update types
-          <ScheduledQueryQueriesTable data={newPolicy} handleChange={onChange} />
-        )}
-        {newPolicy.inputs[0].config?.input_source?.value !== 'pack' && (
-          <EuiButton fill onClick={handleShowFlyout}>
-            {'Attach next query'}
-          </EuiButton>
-        )}
-        {showAddQueryFlyout && (
-          <AddNewQueryFlyout data={newPolicy} handleChange={onChange} onClose={handleHideFlyout} />
-        )}
-      </QueryClientProvider>
-    );
-  }
-);
-OsqueryManagedPolicyCreateExtension.displayName = 'OsqueryManagedPolicyCreateExtension';
diff --git a/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_policy_create_import_extension.tsx b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_policy_create_import_extension.tsx
new file mode 100644
index 00000000000000..3b99e1d46855f0
--- /dev/null
+++ b/x-pack/plugins/osquery/public/fleet_integration/osquery_managed_policy_create_import_extension.tsx
@@ -0,0 +1,202 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { filter } from 'lodash/fp';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiCallOut, EuiLink } from '@elastic/eui';
+import React, { useEffect, useMemo, useState } from 'react';
+import { useHistory } from 'react-router-dom';
+import { produce } from 'immer';
+
+import { i18n } from '@kbn/i18n';
+import {
+  agentRouteService,
+  agentPolicyRouteService,
+  PackagePolicy,
+  AgentPolicy,
+} from '../../../fleet/common';
+import {
+  pagePathGetters,
+  CreatePackagePolicyRouteState,
+  PackagePolicyCreateExtensionComponentProps,
+  PackagePolicyEditExtensionComponentProps,
+} from '../../../fleet/public';
+import { ScheduledQueryGroupQueriesTable } from '../scheduled_query_groups/scheduled_query_group_queries_table';
+import { useKibana } from '../common/lib/kibana';
+import { NavigationButtons } from './navigation_buttons';
+
+/**
+ * Exports Osquery-specific package policy instructions
+ * for use in the Fleet app create / edit package policy
+ */
+
+export const OsqueryManagedPolicyCreateImportExtension = React.memo<
+  PackagePolicyCreateExtensionComponentProps & {
+    policy?: PackagePolicyEditExtensionComponentProps['policy'];
+  }
+>(({ onChange, policy, newPolicy }) => {
+  const [policyAgentsCount, setPolicyAgentsCount] = useState<number | null>(null);
+  const [agentPolicy, setAgentPolicy] = useState<AgentPolicy | null>(null);
+  const [editMode] = useState(!!policy);
+  const {
+    application: { getUrlForApp },
+    http,
+  } = useKibana().services;
+  const { replace } = useHistory();
+
+  const agentsLinkHref = useMemo(() => {
+    if (!policy?.policy_id) return '#';
+
+    return getUrlForApp('fleet', {
+      path:
+        `#` +
+        pagePathGetters.policy_details({ policyId: policy?.policy_id }) +
+        '?openEnrollmentFlyout=true',
+    });
+  }, [getUrlForApp, policy?.policy_id]);
+
+  useEffect(() => {
+    if (editMode && policyAgentsCount === null) {
+      const fetchAgentsCount = async () => {
+        try {
+          const response = await http.fetch(agentRouteService.getStatusPath(), {
+            query: {
+              policyId: policy?.policy_id,
+            },
+          });
+          if (response.results) {
+            setPolicyAgentsCount(response.results.total);
+          }
+          // eslint-disable-next-line no-empty
+        } catch (e) {}
+      };
+
+      const fetchAgentPolicyDetails = async () => {
+        if (policy?.policy_id) {
+          try {
+            const response = await http.fetch(
+              agentPolicyRouteService.getInfoPath(policy?.policy_id)
+            );
+            if (response.item) {
+              setAgentPolicy(response.item);
+            }
+            // eslint-disable-next-line no-empty
+          } catch (e) {}
+        }
+      };
+
+      fetchAgentsCount();
+      fetchAgentPolicyDetails();
+    }
+  }, [editMode, http, policy?.policy_id, policyAgentsCount]);
+
+  useEffect(() => {
+    /*
+      by default Fleet set up streams with an empty scheduled query,
+      this code removes that, so the user can schedule queries
+      in the next step
+    */
+    if (!editMode) {
+      const updatedPolicy = produce(newPolicy, (draft) => {
+        draft.inputs[0].streams = [];
+        return draft;
+      });
+      onChange({
+        isValid: true,
+        updatedPolicy,
+      });
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  useEffect(() => {
+    if (!editMode) {
+      replace({
+        state: {
+          onSaveNavigateTo: (newPackagePolicy) => [
+            'fleet',
+            {
+              path:
+                '#' +
+                pagePathGetters.integration_policy_edit({
+                  packagePolicyId: newPackagePolicy.id,
+                }),
+            },
+          ],
+        } as CreatePackagePolicyRouteState,
+      });
+    }
+  }, [editMode, replace]);
+
+  const scheduledQueryGroupTableData = useMemo(() => {
+    const policyWithoutEmptyQueries = produce(newPolicy, (draft) => {
+      draft.inputs[0].streams = filter(['compiled_stream.id', null], draft.inputs[0].streams);
+      return draft;
+    });
+
+    return policyWithoutEmptyQueries;
+  }, [newPolicy]);
+
+  return (
+    <>
+      {!editMode ? (
+        <>
+          <EuiFlexGroup>
+            <EuiFlexItem>
+              <EuiCallOut
+                title={i18n.translate(
+                  'xpack.osquery.fleetIntegration.saveIntegrationCalloutTitle',
+                  { defaultMessage: 'Save the integration to access the options below' }
+                )}
+                iconType="save"
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+          <EuiSpacer />
+        </>
+      ) : null}
+      {policyAgentsCount === 0 ? (
+        <>
+          <EuiFlexGroup>
+            <EuiFlexItem>
+              <EuiCallOut title="No agents in the policy" color="warning" iconType="help">
+                <p>
+                  {`Fleet has detected that you have not assigned yet any agent to the `}
+                  {
+                    <EuiLink href={agentsLinkHref}>
+                      {agentPolicy?.name ?? policy?.policy_id}
+                    </EuiLink>
+                  }
+                  {`. `}
+                  <br />
+                  <strong>{`Only agents within the policy with active Osquery Manager integration support the functionality presented below.`}</strong>
+                </p>
+              </EuiCallOut>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+          <EuiSpacer />
+        </>
+      ) : null}
+
+      <NavigationButtons
+        isDisabled={!editMode}
+        integrationPolicyId={policy?.id}
+        agentPolicyId={policy?.policy_id}
+      />
+      <EuiSpacer />
+
+      {editMode && scheduledQueryGroupTableData.inputs[0].streams.length ? (
+        <EuiFlexGroup>
+          <EuiFlexItem>
+            <ScheduledQueryGroupQueriesTable data={scheduledQueryGroupTableData as PackagePolicy} />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      ) : null}
+    </>
+  );
+});
+
+OsqueryManagedPolicyCreateImportExtension.displayName = 'OsqueryManagedPolicyCreateImportExtension';
diff --git a/x-pack/plugins/osquery/public/live_query/agent_results/index.tsx b/x-pack/plugins/osquery/public/live_queries/agent_results/index.tsx
similarity index 89%
rename from x-pack/plugins/osquery/public/live_query/agent_results/index.tsx
rename to x-pack/plugins/osquery/public/live_queries/agent_results/index.tsx
index 63dbca98d648f6..272e65d9cc0fa8 100644
--- a/x-pack/plugins/osquery/public/live_query/agent_results/index.tsx
+++ b/x-pack/plugins/osquery/public/live_queries/agent_results/index.tsx
@@ -19,10 +19,7 @@ const QueryAgentResultsComponent = () => {
   return (
     <>
       <EuiCodeBlock language="sql" fontSize="m" paddingSize="m">
-        {
-          // @ts-expect-error update types
-          data?.actionDetails._source?.data?.query
-        }
+        {data?.actionDetails._source?.data?.query}
       </EuiCodeBlock>
       <EuiSpacer />
       <ResultsTable actionId={actionId} agentId={agentId} />
diff --git a/x-pack/plugins/osquery/public/live_query/form/agents_table_field.tsx b/x-pack/plugins/osquery/public/live_queries/form/agents_table_field.tsx
similarity index 100%
rename from x-pack/plugins/osquery/public/live_query/form/agents_table_field.tsx
rename to x-pack/plugins/osquery/public/live_queries/form/agents_table_field.tsx
diff --git a/x-pack/plugins/osquery/public/live_queries/form/index.tsx b/x-pack/plugins/osquery/public/live_queries/form/index.tsx
new file mode 100644
index 00000000000000..056bbc75f3b76b
--- /dev/null
+++ b/x-pack/plugins/osquery/public/live_queries/form/index.tsx
@@ -0,0 +1,174 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButton, EuiSteps, EuiSpacer, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiContainedStepProps } from '@elastic/eui/src/components/steps/steps';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+import { useMutation } from 'react-query';
+
+import { UseField, Form, FormData, useForm, useFormData } from '../../shared_imports';
+import { AgentsTableField } from './agents_table_field';
+import { LiveQueryQueryField } from './live_query_query_field';
+import { useKibana } from '../../common/lib/kibana';
+import { ResultTabs } from '../../queries/edit/tabs';
+
+const FORM_ID = 'liveQueryForm';
+
+interface LiveQueryFormProps {
+  defaultValue?: Partial<FormData> | undefined;
+  onSubmit?: (payload: Record<string, string>) => Promise<void>;
+  onSuccess?: () => void;
+}
+
+const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
+  defaultValue,
+  // onSubmit,
+  onSuccess,
+}) => {
+  const { http } = useKibana().services;
+
+  const {
+    data,
+    isLoading,
+    mutateAsync,
+    isError,
+    isSuccess,
+    // error
+  } = useMutation(
+    (payload: Record<string, unknown>) =>
+      http.post('/internal/osquery/action', {
+        body: JSON.stringify(payload),
+      }),
+    {
+      onSuccess,
+    }
+  );
+
+  const { form } = useForm({
+    id: FORM_ID,
+    // schema: formSchema,
+    onSubmit: (payload) => {
+      return mutateAsync(payload);
+    },
+    options: {
+      stripEmptyFields: false,
+    },
+    defaultValue: defaultValue ?? {
+      query: {
+        id: null,
+        query: '',
+      },
+    },
+  });
+
+  const { submit } = form;
+
+  const actionId = useMemo(() => data?.actions[0].action_id, [data?.actions]);
+  const agentIds = useMemo(() => data?.actions[0].agents, [data?.actions]);
+  const [{ agentSelection, query }] = useFormData({ form, watch: ['agentSelection', 'query'] });
+
+  const agentSelected = useMemo(
+    () =>
+      agentSelection &&
+      !!(
+        agentSelection.allAgentsSelected ||
+        agentSelection.agents?.length ||
+        agentSelection.platformsSelected?.length ||
+        agentSelection.policiesSelected?.length
+      ),
+    [agentSelection]
+  );
+
+  const queryValueProvided = useMemo(() => !!query?.query?.length, [query]);
+
+  const queryStatus = useMemo(() => {
+    if (!agentSelected) return 'disabled';
+    if (isError) return 'danger';
+    if (isLoading) return 'loading';
+    if (isSuccess) return 'complete';
+
+    return 'incomplete';
+  }, [agentSelected, isError, isLoading, isSuccess]);
+
+  const resultsStatus = useMemo(() => (queryStatus === 'complete' ? 'incomplete' : 'disabled'), [
+    queryStatus,
+  ]);
+
+  const queryComponentProps = useMemo(
+    () => ({
+      disabled: queryStatus === 'disabled',
+    }),
+    [queryStatus]
+  );
+
+  const formSteps: EuiContainedStepProps[] = useMemo(
+    () => [
+      {
+        title: i18n.translate('xpack.osquery.liveQueryForm.steps.agentsStepHeading', {
+          defaultMessage: 'Select agents',
+        }),
+        children: <UseField path="agentSelection" component={AgentsTableField} />,
+        status: agentSelected ? 'complete' : 'incomplete',
+      },
+      {
+        title: i18n.translate('xpack.osquery.liveQueryForm.steps.queryStepHeading', {
+          defaultMessage: 'Enter query',
+        }),
+        children: (
+          <>
+            <UseField
+              path="query"
+              component={LiveQueryQueryField}
+              componentProps={queryComponentProps}
+            />
+            <EuiSpacer />
+            <EuiFlexGroup justifyContent="flexEnd">
+              <EuiFlexItem grow={false}>
+                <EuiButton disabled={!agentSelected || !queryValueProvided} onClick={submit}>
+                  <FormattedMessage
+                    id="xpack.osquery.liveQueryForm.form.submitButtonLabel"
+                    defaultMessage="Submit"
+                  />
+                </EuiButton>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </>
+        ),
+        status: queryStatus,
+      },
+      {
+        title: i18n.translate('xpack.osquery.liveQueryForm.steps.resultsStepHeading', {
+          defaultMessage: 'Check results',
+        }),
+        children: actionId ? (
+          <ResultTabs actionId={actionId} agentIds={agentIds} isLive={true} />
+        ) : null,
+        status: resultsStatus,
+      },
+    ],
+    [
+      actionId,
+      agentIds,
+      agentSelected,
+      queryComponentProps,
+      queryStatus,
+      queryValueProvided,
+      resultsStatus,
+      submit,
+    ]
+  );
+
+  return (
+    <Form form={form}>
+      <EuiSteps steps={formSteps} />
+    </Form>
+  );
+};
+
+export const LiveQueryForm = React.memo(LiveQueryFormComponent);
diff --git a/x-pack/plugins/osquery/public/live_query/form/live_query_query_field.tsx b/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
similarity index 93%
rename from x-pack/plugins/osquery/public/live_query/form/live_query_query_field.tsx
rename to x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
index bc3da3ea372097..68207200dc7897 100644
--- a/x-pack/plugins/osquery/public/live_query/form/live_query_query_field.tsx
+++ b/x-pack/plugins/osquery/public/live_queries/form/live_query_query_field.tsx
@@ -15,13 +15,14 @@ import { FieldHook } from '../../shared_imports';
 import { OsqueryEditor } from '../../editor';
 
 interface LiveQueryQueryFieldProps {
+  disabled?: boolean;
   field: FieldHook<{
     id: string | null;
     query: string;
   }>;
 }
 
-const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({ field }) => {
+const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({ disabled, field }) => {
   // const { http } = useKibana().services;
   // const { data } = useQuery('savedQueryList', () =>
   //   http.get('/internal/osquery/saved_query', {
@@ -82,7 +83,7 @@ const LiveQueryQueryFieldComponent: React.FC<LiveQueryQueryFieldProps> = ({ fiel
         onChange={handleSavedQueryChange}
       />
       <EuiSpacer /> */}
-      <OsqueryEditor defaultValue={value.query} onChange={handleEditorChange} />
+      <OsqueryEditor defaultValue={value.query} disabled={disabled} onChange={handleEditorChange} />
     </>
   );
 };
diff --git a/x-pack/plugins/osquery/public/live_query/form/schema.ts b/x-pack/plugins/osquery/public/live_queries/form/schema.ts
similarity index 100%
rename from x-pack/plugins/osquery/public/live_query/form/schema.ts
rename to x-pack/plugins/osquery/public/live_queries/form/schema.ts
diff --git a/x-pack/plugins/osquery/public/live_queries/index.tsx b/x-pack/plugins/osquery/public/live_queries/index.tsx
new file mode 100644
index 00000000000000..3fb36f57ef82ff
--- /dev/null
+++ b/x-pack/plugins/osquery/public/live_queries/index.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { LiveQueryForm } from './form';
+import { FormData } from '../shared_imports';
+
+interface LiveQueryProps {
+  defaultValue?: Partial<FormData> | undefined;
+  onSuccess?: () => void;
+}
+
+const LiveQueryComponent: React.FC<LiveQueryProps> = ({ defaultValue, onSuccess }) => (
+  <LiveQueryForm defaultValue={defaultValue} onSuccess={onSuccess} />
+);
+
+export const LiveQuery = React.memo(LiveQueryComponent);
diff --git a/x-pack/plugins/osquery/public/live_query/form/index.tsx b/x-pack/plugins/osquery/public/live_query/form/index.tsx
deleted file mode 100644
index 7e19bee530ec59..00000000000000
--- a/x-pack/plugins/osquery/public/live_query/form/index.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButton, EuiSpacer } from '@elastic/eui';
-import React from 'react';
-
-import { UseField, Form, useForm } from '../../shared_imports';
-import { AgentsTableField } from './agents_table_field';
-import { LiveQueryQueryField } from './live_query_query_field';
-
-const FORM_ID = 'liveQueryForm';
-
-interface LiveQueryFormProps {
-  defaultValue?: unknown;
-  onSubmit: (payload: Record<string, string>) => Promise<void>;
-}
-
-const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({ defaultValue, onSubmit }) => {
-  const { form } = useForm({
-    id: FORM_ID,
-    // schema: formSchema,
-    onSubmit,
-    options: {
-      stripEmptyFields: false,
-    },
-    defaultValue: {
-      // @ts-expect-error update types
-      query: defaultValue ?? {
-        id: null,
-        query: '',
-      },
-    },
-  });
-
-  const { submit } = form;
-
-  return (
-    <Form form={form}>
-      <UseField path="agentSelection" component={AgentsTableField} />
-      <EuiSpacer />
-      <UseField path="query" component={LiveQueryQueryField} />
-      <EuiSpacer />
-      <EuiButton onClick={submit}>{'Send query'}</EuiButton>
-    </Form>
-  );
-};
-
-export const LiveQueryForm = React.memo(LiveQueryFormComponent);
diff --git a/x-pack/plugins/osquery/public/live_query/index.tsx b/x-pack/plugins/osquery/public/live_query/index.tsx
deleted file mode 100644
index 324f9896cbd961..00000000000000
--- a/x-pack/plugins/osquery/public/live_query/index.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiSpacer } from '@elastic/eui';
-import React from 'react';
-import { useMutation } from 'react-query';
-import { useLocation } from 'react-router-dom';
-
-import { useKibana } from '../common/lib/kibana';
-import { LiveQueryForm } from './form';
-import { ResultTabs } from '../queries/edit/tabs';
-
-const LiveQueryComponent = () => {
-  const location = useLocation();
-  const { http } = useKibana().services;
-
-  const createActionMutation = useMutation((payload: Record<string, unknown>) =>
-    http.post('/internal/osquery/action', {
-      body: JSON.stringify(payload),
-    })
-  );
-
-  return (
-    <>
-      {
-        <LiveQueryForm
-          defaultValue={location.state?.query}
-          // @ts-expect-error update types
-          onSubmit={createActionMutation.mutate}
-        />
-      }
-
-      {createActionMutation.data && (
-        <>
-          <EuiSpacer />
-          <ResultTabs actionId={createActionMutation.data?.action.action_id} />
-        </>
-      )}
-    </>
-  );
-};
-
-export const LiveQuery = React.memo(LiveQueryComponent);
diff --git a/x-pack/plugins/osquery/public/osquery_action_type/example_params_fields.tsx b/x-pack/plugins/osquery/public/osquery_action_type/example_params_fields.tsx
deleted file mode 100644
index 898806ea542a82..00000000000000
--- a/x-pack/plugins/osquery/public/osquery_action_type/example_params_fields.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable react-perf/jsx-no-new-function-as-prop, react/jsx-no-bind */
-
-import React, { Fragment } from 'react';
-import { EuiTextArea } from '@elastic/eui';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { ActionParamsProps } from '../../../triggers_actions_ui/public/types';
-
-interface ExampleActionParams {
-  message: string;
-}
-
-const ExampleParamsFields: React.FunctionComponent<ActionParamsProps<ExampleActionParams>> = ({
-  actionParams,
-  editAction,
-  index,
-  errors,
-}) => {
-  // console.error('actionParams', actionParams, index, errors);
-  const { message } = actionParams;
-  return (
-    <Fragment>
-      <EuiTextArea
-        fullWidth
-        isInvalid={errors.message.length > 0 && message !== undefined}
-        name="message"
-        value={message || ''}
-        onChange={(e) => {
-          editAction('message', e.target.value, index);
-        }}
-        onBlur={() => {
-          if (!message) {
-            editAction('message', '', index);
-          }
-        }}
-      />
-    </Fragment>
-  );
-};
-
-// Export as default in order to support lazy loading
-// eslint-disable-next-line import/no-default-export
-export { ExampleParamsFields as default };
diff --git a/x-pack/plugins/osquery/public/osquery_action_type/index.tsx b/x-pack/plugins/osquery/public/osquery_action_type/index.tsx
deleted file mode 100644
index 2e162b34ab96d4..00000000000000
--- a/x-pack/plugins/osquery/public/osquery_action_type/index.tsx
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { lazy } from 'react';
-import { i18n } from '@kbn/i18n';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { ActionTypeModel, ValidationResult } from '../../../triggers_actions_ui/public/types';
-
-interface ExampleActionParams {
-  message: string;
-}
-
-export function getActionType(): ActionTypeModel {
-  return {
-    id: '.osquery',
-    iconClass: 'logoOsquery',
-    selectMessage: i18n.translate(
-      'xpack.osquery.components.builtinActionTypes.exampleAction.selectMessageText',
-      {
-        defaultMessage: 'Example Action is used to show how to create new action type UI.',
-      }
-    ),
-    actionTypeTitle: i18n.translate(
-      'xpack.osquery.components.builtinActionTypes.exampleAction.actionTypeTitle',
-      {
-        defaultMessage: 'Example Action',
-      }
-    ),
-    // @ts-expect-error update types
-    validateConnector: (action): ValidationResult => {
-      const validationResult = { errors: {} };
-      const errors = {
-        someConnectorField: new Array<string>(),
-      };
-      validationResult.errors = errors;
-      if (!action.config.someConnectorField) {
-        errors.someConnectorField.push(
-          i18n.translate(
-            'xpack.osquery.components.builtinActionTypes.error.requiredSomeConnectorFieldeText',
-            {
-              defaultMessage: 'SomeConnectorField is required.',
-            }
-          )
-        );
-      }
-      return validationResult;
-    },
-    validateParams: (actionParams: ExampleActionParams): ValidationResult => {
-      const validationResult = { errors: {} };
-      const errors = {
-        message: new Array<string>(),
-      };
-      validationResult.errors = errors;
-      if (!actionParams.message?.length) {
-        errors.message.push(
-          i18n.translate(
-            'xpack.osquery.components.builtinActionTypes.error.requiredExampleMessageText',
-            {
-              defaultMessage: 'Message is required.',
-            }
-          )
-        );
-      }
-      return validationResult;
-    },
-    actionConnectorFields: null,
-    actionParamsFields: lazy(() => import('./example_params_fields')),
-  };
-}
diff --git a/x-pack/plugins/osquery/public/packs/edit/index.tsx b/x-pack/plugins/osquery/public/packs/edit/index.tsx
index 478152bb8b4a3b..3cbd80c9f4db01 100644
--- a/x-pack/plugins/osquery/public/packs/edit/index.tsx
+++ b/x-pack/plugins/osquery/public/packs/edit/index.tsx
@@ -26,6 +26,7 @@ const EditPackPageComponent: React.FC<EditPackPageProps> = ({ onSuccess, packId
       queries: [],
     },
   } = useQuery(['pack', { id: packId }], ({ queryKey }) => {
+    // @ts-expect-error update types
     return http.get(`/internal/osquery/pack/${queryKey[1].id}`);
   });
 
diff --git a/x-pack/plugins/osquery/public/plugin.ts b/x-pack/plugins/osquery/public/plugin.ts
index b807e93236df6b..c0a097cb3ba28a 100644
--- a/x-pack/plugins/osquery/public/plugin.ts
+++ b/x-pack/plugins/osquery/public/plugin.ts
@@ -14,6 +14,7 @@ import {
   CoreStart,
   DEFAULT_APP_CATEGORIES,
   AppStatus,
+  AppNavLinkStatus,
   AppUpdater,
 } from '../../../../src/core/public';
 import { Storage } from '../../../../src/plugins/kibana_utils/public';
@@ -24,28 +25,51 @@ import {
   StartPlugins,
   AppPluginStartDependencies,
 } from './types';
-import { PLUGIN_NAME } from '../common';
+import { OSQUERY_INTEGRATION_NAME, PLUGIN_NAME } from '../common';
+import { epmRouteService, GetPackagesResponse } from '../../fleet/common';
 import {
-  LazyOsqueryManagedEmptyCreatePolicyExtension,
-  LazyOsqueryManagedEmptyEditPolicyExtension,
+  LazyOsqueryManagedPolicyCreateImportExtension,
+  LazyOsqueryManagedPolicyEditExtension,
+  LazyOsqueryManagedCustomButtonExtension,
 } from './fleet_integration';
-// import { getActionType } from './osquery_action_type';
-
-export function toggleOsqueryPlugin(updater$: Subject<AppUpdater>, http: CoreStart['http']) {
-  http.fetch('/api/fleet/epm/packages', { query: { experimental: true } }).then(({ response }) => {
-    const installed = response.find(
-      // @ts-expect-error update types
-      (integration) =>
-        integration?.name === 'osquery_elastic_managed' && integration?.status === 'installed'
-    );
-    updater$.next(() => ({
-      status: installed ? AppStatus.accessible : AppStatus.inaccessible,
-    }));
-  });
+
+export function toggleOsqueryPlugin(
+  updater$: Subject<AppUpdater>,
+  http: CoreStart['http'],
+  registerExtension?: StartPlugins['fleet']['registerExtension']
+) {
+  http
+    .fetch<GetPackagesResponse>(epmRouteService.getListPath(), { query: { experimental: true } })
+    .then(({ response }) => {
+      const installed = response.find(
+        (integration) =>
+          integration?.name === OSQUERY_INTEGRATION_NAME && integration?.status === 'installed'
+      );
+
+      if (installed && registerExtension) {
+        registerExtension({
+          package: OSQUERY_INTEGRATION_NAME,
+          view: 'package-detail-custom',
+          component: LazyOsqueryManagedCustomButtonExtension,
+        });
+      }
+
+      updater$.next(() => ({
+        navLinkStatus: installed ? AppNavLinkStatus.visible : AppNavLinkStatus.hidden,
+      }));
+    })
+    .catch(() => {
+      updater$.next(() => ({
+        status: AppStatus.inaccessible,
+        navLinkStatus: AppNavLinkStatus.hidden,
+      }));
+    });
 }
 
 export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginStart> {
-  private readonly appUpdater$ = new BehaviorSubject<AppUpdater>(() => ({}));
+  private readonly appUpdater$ = new BehaviorSubject<AppUpdater>(() => ({
+    navLinkStatus: AppNavLinkStatus.hidden,
+  }));
   private kibanaVersion: string;
   private storage = new Storage(localStorage);
 
@@ -53,11 +77,14 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
     this.kibanaVersion = this.initializerContext.env.packageInfo.version;
   }
 
-  public setup(
-    core: CoreSetup
-    // plugins: SetupPlugins
-  ): OsqueryPluginSetup {
-    const config = this.initializerContext.config.get<{ enabled: boolean }>();
+  public setup(core: CoreSetup): OsqueryPluginSetup {
+    const config = this.initializerContext.config.get<{
+      enabled: boolean;
+      actionEnabled: boolean;
+      scheduledQueries: boolean;
+      savedQueries: boolean;
+      packs: boolean;
+    }>();
 
     if (!config.enabled) {
       return {};
@@ -71,6 +98,7 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
       title: PLUGIN_NAME,
       order: 9030,
       updater$: this.appUpdater$,
+      navLinkStatus: AppNavLinkStatus.hidden,
       category: DEFAULT_APP_CATEGORIES.management,
       async mount(params: AppMountParameters) {
         // Get start services as specified in kibana.json
@@ -88,41 +116,37 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
       },
     });
 
-    // plugins.triggersActionsUi.actionTypeRegistry.register(getActionType());
-
     // Return methods that should be available to other plugins
     return {};
   }
 
   public start(core: CoreStart, plugins: StartPlugins): OsqueryPluginStart {
-    const config = this.initializerContext.config.get<{ enabled: boolean }>();
-
-    if (!config.enabled) {
-      return {};
-    }
+    const config = this.initializerContext.config.get<{
+      enabled: boolean;
+      actionEnabled: boolean;
+      scheduledQueries: boolean;
+      savedQueries: boolean;
+      packs: boolean;
+    }>();
 
     if (plugins.fleet) {
       const { registerExtension } = plugins.fleet;
 
-      toggleOsqueryPlugin(this.appUpdater$, core.http);
+      if (config.enabled) {
+        toggleOsqueryPlugin(this.appUpdater$, core.http, registerExtension);
+      }
 
       registerExtension({
-        package: 'osquery_elastic_managed',
+        package: OSQUERY_INTEGRATION_NAME,
         view: 'package-policy-create',
-        component: LazyOsqueryManagedEmptyCreatePolicyExtension,
+        component: LazyOsqueryManagedPolicyCreateImportExtension,
       });
 
       registerExtension({
-        package: 'osquery_elastic_managed',
+        package: OSQUERY_INTEGRATION_NAME,
         view: 'package-policy-edit',
-        component: LazyOsqueryManagedEmptyEditPolicyExtension,
+        component: LazyOsqueryManagedPolicyEditExtension,
       });
-
-      // registerExtension({
-      //   package: 'osquery_elastic_managed',
-      //   view: 'package-detail-custom',
-      //   component: LazyOsqueryManagedCustomExtension,
-      // });
     } else {
       this.appUpdater$.next(() => ({
         status: AppStatus.inaccessible,
diff --git a/x-pack/plugins/osquery/public/queries/edit/tabs.tsx b/x-pack/plugins/osquery/public/queries/edit/tabs.tsx
index 4aa9d20d111231..1a6b317653c980 100644
--- a/x-pack/plugins/osquery/public/queries/edit/tabs.tsx
+++ b/x-pack/plugins/osquery/public/queries/edit/tabs.tsx
@@ -9,13 +9,15 @@ import { EuiTabbedContent, EuiSpacer } from '@elastic/eui';
 import React, { useMemo } from 'react';
 
 import { ResultsTable } from '../../results/results_table';
-import { ActionResultsTable } from '../../action_results/action_results_table';
+import { ActionResultsSummary } from '../../action_results/action_results_summary';
 
 interface ResultTabsProps {
   actionId: string;
+  agentIds?: string[];
+  isLive?: boolean;
 }
 
-const ResultTabsComponent: React.FC<ResultTabsProps> = ({ actionId }) => {
+const ResultTabsComponent: React.FC<ResultTabsProps> = ({ actionId, agentIds, isLive }) => {
   const tabs = useMemo(
     () => [
       {
@@ -24,7 +26,7 @@ const ResultTabsComponent: React.FC<ResultTabsProps> = ({ actionId }) => {
         content: (
           <>
             <EuiSpacer />
-            <ActionResultsTable actionId={actionId} />
+            <ActionResultsSummary actionId={actionId} agentIds={agentIds} isLive={isLive} />
           </>
         ),
       },
@@ -34,12 +36,12 @@ const ResultTabsComponent: React.FC<ResultTabsProps> = ({ actionId }) => {
         content: (
           <>
             <EuiSpacer />
-            <ResultsTable actionId={actionId} />
+            <ResultsTable actionId={actionId} isLive={isLive} />
           </>
         ),
       },
     ],
-    [actionId]
+    [actionId, agentIds, isLive]
   );
 
   return (
diff --git a/x-pack/plugins/osquery/public/queries/form/code_editor_field.tsx b/x-pack/plugins/osquery/public/queries/form/code_editor_field.tsx
index 5a564af9875623..a56e747355c5b1 100644
--- a/x-pack/plugins/osquery/public/queries/form/code_editor_field.tsx
+++ b/x-pack/plugins/osquery/public/queries/form/code_editor_field.tsx
@@ -5,6 +5,9 @@
  * 2.0.
  */
 
+import { FormattedMessage } from '@kbn/i18n/react';
+import { isEmpty } from 'lodash/fp';
+import { EuiFormRow, EuiLink, EuiText } from '@elastic/eui';
 import React from 'react';
 
 import { OsqueryEditor } from '../../editor';
@@ -14,10 +17,34 @@ interface CodeEditorFieldProps {
   field: FieldHook<string>;
 }
 
+const OsquerySchemaLink = React.memo(() => (
+  <EuiText size="xs">
+    <EuiLink href="https://osquery.io/schema/4.7.0" target="_blank">
+      <FormattedMessage
+        id="xpack.osquery.codeEditorField.osquerySchemaLinkLabel"
+        defaultMessage="Osquery schema"
+      />
+    </EuiLink>
+  </EuiText>
+));
+
+OsquerySchemaLink.displayName = 'OsquerySchemaLink';
+
 const CodeEditorFieldComponent: React.FC<CodeEditorFieldProps> = ({ field }) => {
-  const { value, setValue } = field;
+  const { value, label, labelAppend, helpText, setValue } = field;
 
-  return <OsqueryEditor defaultValue={value} onChange={setValue} />;
+  return (
+    <EuiFormRow
+      label={label}
+      labelAppend={!isEmpty(labelAppend) ? labelAppend : <OsquerySchemaLink />}
+      helpText={helpText}
+      // isInvalid={typeof error === 'string'}
+      // error={error}
+      fullWidth
+    >
+      <OsqueryEditor defaultValue={value} onChange={setValue} />
+    </EuiFormRow>
+  );
 };
 
 export const CodeEditorField = React.memo(CodeEditorFieldComponent);
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/schema.gql.ts b/x-pack/plugins/osquery/public/query_client.ts
similarity index 74%
rename from x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/schema.gql.ts
rename to x-pack/plugins/osquery/public/query_client.ts
index 7238e975c4c253..7541e80aee9359 100644
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/schema.gql.ts
+++ b/x-pack/plugins/osquery/public/query_client.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import gql from 'graphql-tag';
+import { QueryClient } from 'react-query';
 
-export const toDateSchema = gql`
-  scalar ToDateArray
-`;
+export const queryClient = new QueryClient();
diff --git a/x-pack/plugins/osquery/public/results/helpers.ts b/x-pack/plugins/osquery/public/results/helpers.ts
index 802674ee0398ce..171530a77299f9 100644
--- a/x-pack/plugins/osquery/public/results/helpers.ts
+++ b/x-pack/plugins/osquery/public/results/helpers.ts
@@ -16,15 +16,14 @@ export type InspectResponse = Inspect & { response: string[] };
 
 export const generateTablePaginationOptions = (
   activePage: number,
-  limit: number,
-  isBucketSort?: boolean
+  limit: number
 ): PaginationInputPaginated => {
   const cursorStart = activePage * limit;
   return {
     activePage,
     cursorStart,
     fakePossibleCount: 4 <= activePage && activePage > 0 ? limit * (activePage + 2) : limit * 5,
-    querySize: isBucketSort ? limit : limit + cursorStart,
+    querySize: limit,
   };
 };
 
diff --git a/x-pack/plugins/osquery/public/results/results_table.tsx b/x-pack/plugins/osquery/public/results/results_table.tsx
index 7557828c4407cc..d82c45d8025203 100644
--- a/x-pack/plugins/osquery/public/results/results_table.tsx
+++ b/x-pack/plugins/osquery/public/results/results_table.tsx
@@ -6,22 +6,40 @@
  */
 
 import { isEmpty, isEqual, keys, map } from 'lodash/fp';
-import { EuiDataGrid, EuiDataGridProps, EuiDataGridColumn, EuiLink } from '@elastic/eui';
+import {
+  EuiDataGrid,
+  EuiDataGridSorting,
+  EuiDataGridProps,
+  EuiDataGridColumn,
+  EuiLink,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import React, { createContext, useEffect, useState, useCallback, useContext, useMemo } from 'react';
 
-import { EuiDataGridSorting } from '@elastic/eui';
+import { pagePathGetters } from '../../../fleet/public';
 import { useAllResults } from './use_all_results';
 import { Direction, ResultEdges } from '../../common/search_strategy';
-import { useRouterNavigate } from '../common/lib/kibana';
+import { useKibana } from '../common/lib/kibana';
 
 const DataContext = createContext<ResultEdges>([]);
 
 interface ResultsTableComponentProps {
   actionId: string;
   agentId?: string;
+  isLive?: boolean;
 }
 
-const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({ actionId, agentId }) => {
+const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({ actionId, isLive }) => {
+  const { getUrlForApp } = useKibana().services.application;
+
+  const getFleetAppUrl = useCallback(
+    (agentId) =>
+      getUrlForApp('fleet', {
+        path: `#` + pagePathGetters.fleet_agent_details({ agentId }),
+      }),
+    [getUrlForApp]
+  );
+
   const [pagination, setPagination] = useState({ pageIndex: 0, pageSize: 50 });
   const onChangeItemsPerPage = useCallback(
     (pageSize) =>
@@ -39,22 +57,15 @@ const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({ actionId,
 
   const [columns, setColumns] = useState<EuiDataGridColumn[]>([]);
 
-  // ** Sorting config
   const [sortingColumns, setSortingColumns] = useState<EuiDataGridSorting['columns']>([]);
-  const onSort = useCallback(
-    (newSortingColumns) => {
-      setSortingColumns(newSortingColumns);
-    },
-    [setSortingColumns]
-  );
 
-  const { data: allResultsData = [] } = useAllResults({
+  const { data: allResultsData } = useAllResults({
     actionId,
-    agentId,
     activePage: pagination.pageIndex,
     limit: pagination.pageSize,
     direction: Direction.asc,
     sortField: '@timestamp',
+    isLive,
   });
 
   const [visibleColumns, setVisibleColumns] = useState<string[]>([]);
@@ -68,24 +79,22 @@ const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({ actionId,
       // eslint-disable-next-line react-hooks/rules-of-hooks
       const data = useContext(DataContext);
 
-      // @ts-expect-error fields is optional
-      const value = data[rowIndex].fields[columnId];
+      // @ts-expect-error update types
+      const value = data[rowIndex % pagination.pageSize]?.fields[columnId];
 
       if (columnId === 'agent.name') {
-        // @ts-expect-error fields is optional
-        const agentIdValue = data[rowIndex].fields['agent.id'];
-        // eslint-disable-next-line react-hooks/rules-of-hooks
-        const linkProps = useRouterNavigate(`/live_query/${actionId}/results/${agentIdValue}`);
-        return <EuiLink {...linkProps}>{value}</EuiLink>;
+        // @ts-expect-error update types
+        const agentIdValue = data[rowIndex % pagination.pageSize]?.fields['agent.id'];
+
+        return <EuiLink href={getFleetAppUrl(agentIdValue)}>{value}</EuiLink>;
       }
 
       return !isEmpty(value) ? value : '-';
     },
-    [actionId]
+    [getFleetAppUrl, pagination.pageSize]
   );
 
-  const tableSorting = useMemo(() => ({ columns: sortingColumns, onSort }), [
-    onSort,
+  const tableSorting = useMemo(() => ({ columns: sortingColumns, onSort: setSortingColumns }), [
     sortingColumns,
   ]);
 
@@ -100,34 +109,32 @@ const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({ actionId,
   );
 
   useEffect(() => {
-    // @ts-expect-error update types
-    if (!allResultsData?.results) {
+    if (!allResultsData?.edges) {
       return;
     }
-    // @ts-expect-error update types
-    const newColumns = keys(allResultsData?.results[0]?.fields)
+
+    const newColumns = keys(allResultsData?.edges[0]?.fields)
       .sort()
       .reduce((acc, fieldName) => {
         if (fieldName === 'agent.name') {
-          return [
-            ...acc,
-            {
-              id: fieldName,
-              displayAsText: 'agent',
-              defaultSortDirection: Direction.asc,
-            },
-          ];
+          acc.push({
+            id: fieldName,
+            displayAsText: i18n.translate('xpack.osquery.liveQueryResults.table.agentColumnTitle', {
+              defaultMessage: 'agent',
+            }),
+            defaultSortDirection: Direction.asc,
+          });
+
+          return acc;
         }
 
         if (fieldName.startsWith('osquery.')) {
-          return [
-            ...acc,
-            {
-              id: fieldName,
-              displayAsText: fieldName.split('.')[1],
-              defaultSortDirection: Direction.asc,
-            },
-          ];
+          acc.push({
+            id: fieldName,
+            displayAsText: fieldName.split('.')[1],
+            defaultSortDirection: Direction.asc,
+          });
+          return acc;
         }
 
         return acc;
@@ -137,22 +144,20 @@ const ResultsTableComponent: React.FC<ResultsTableComponentProps> = ({ actionId,
       setColumns(newColumns);
       setVisibleColumns(map('id', newColumns));
     }
-    // @ts-expect-error update types
-  }, [columns, allResultsData?.results]);
+  }, [columns, allResultsData?.edges]);
 
   return (
     // @ts-expect-error update types
-    <DataContext.Provider value={allResultsData?.results}>
+    <DataContext.Provider value={allResultsData?.edges}>
       <EuiDataGrid
         aria-label="Osquery results"
         columns={columns}
         columnVisibility={columnVisibility}
-        // @ts-expect-error update types
         rowCount={allResultsData?.totalCount ?? 0}
         renderCellValue={renderCellValue}
         sorting={tableSorting}
         pagination={tablePagination}
-        height="300px"
+        height="500px"
       />
     </DataContext.Provider>
   );
diff --git a/x-pack/plugins/osquery/public/results/use_all_results.ts b/x-pack/plugins/osquery/public/results/use_all_results.ts
index 5727edf1bf4c3e..7140f80f510f42 100644
--- a/x-pack/plugins/osquery/public/results/use_all_results.ts
+++ b/x-pack/plugins/osquery/public/results/use_all_results.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import deepEqual from 'fast-deep-equal';
-import { useEffect, useState } from 'react';
 import { useQuery } from 'react-query';
 
 import { createFilter } from '../common/helpers';
@@ -35,71 +33,55 @@ export interface ResultsArgs {
 interface UseAllResults {
   actionId: string;
   activePage: number;
-  agentId?: string;
   direction: Direction;
   limit: number;
   sortField: string;
   filterQuery?: ESTermQuery | string;
   skip?: boolean;
+  isLive?: boolean;
 }
 
 export const useAllResults = ({
   actionId,
   activePage,
-  agentId,
   direction,
   limit,
   sortField,
   filterQuery,
   skip = false,
+  isLive = false,
 }: UseAllResults) => {
   const { data } = useKibana().services;
 
-  const [resultsRequest, setHostRequest] = useState<ResultsRequestOptions | null>(null);
-
-  const response = useQuery(
+  return useQuery(
     ['allActionResults', { actionId, activePage, direction, limit, sortField }],
     async () => {
-      if (!resultsRequest) return Promise.resolve();
-
       const responseData = await data.search
-        .search<ResultsRequestOptions, ResultsStrategyResponse>(resultsRequest, {
-          strategy: 'osquerySearchStrategy',
-        })
+        .search<ResultsRequestOptions, ResultsStrategyResponse>(
+          {
+            actionId,
+            factoryQueryType: OsqueryQueries.results,
+            filterQuery: createFilter(filterQuery),
+            pagination: generateTablePaginationOptions(activePage, limit),
+            sort: {
+              direction,
+              field: sortField,
+            },
+          },
+          {
+            strategy: 'osquerySearchStrategy',
+          }
+        )
         .toPromise();
 
       return {
         ...responseData,
-        results: responseData.edges,
         inspect: getInspectResponse(responseData, {} as InspectResponse),
       };
     },
     {
-      refetchInterval: 1000,
-      enabled: !skip && !!resultsRequest,
+      refetchInterval: isLive ? 1000 : false,
+      enabled: !skip,
     }
   );
-
-  useEffect(() => {
-    setHostRequest((prevRequest) => {
-      const myRequest = {
-        ...(prevRequest ?? {}),
-        actionId,
-        agentId,
-        factoryQueryType: OsqueryQueries.results,
-        filterQuery: createFilter(filterQuery),
-        pagination: generateTablePaginationOptions(activePage, limit),
-        sort: {
-          direction,
-          field: sortField,
-        },
-      };
-      if (!deepEqual(prevRequest, myRequest)) {
-        return myRequest;
-      }
-      return prevRequest;
-    });
-  }, [actionId, activePage, agentId, direction, filterQuery, limit, sortField]);
-
-  return response;
 };
diff --git a/x-pack/plugins/osquery/public/routes/index.tsx b/x-pack/plugins/osquery/public/routes/index.tsx
index 18ba0abec56961..7007feb19d663b 100644
--- a/x-pack/plugins/osquery/public/routes/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/index.tsx
@@ -8,24 +8,24 @@
 import React from 'react';
 import { Switch, Redirect, Route } from 'react-router-dom';
 
-import { LiveQueries } from './live_query';
+import { useBreadcrumbs } from '../common/hooks/use_breadcrumbs';
+import { LiveQueries } from './live_queries';
+import { ScheduledQueryGroups } from './scheduled_query_groups';
 
-const OsqueryAppRoutesComponent = () => (
-  <Switch>
-    {/* <Route path="/packs">
-            <Packs />
-          </Route>
-          <Route path={`/scheduled_queries`}>
-            <ScheduledQueries />
-          </Route>
-          <Route path={`/queries`}>
-            <Queries />
-          </Route> */}
-    <Route path="/live_query">
-      <LiveQueries />
-    </Route>
-    <Redirect to="/live_query" />
-  </Switch>
-);
+const OsqueryAppRoutesComponent = () => {
+  useBreadcrumbs('base');
+
+  return (
+    <Switch>
+      <Route path={`/scheduled_query_groups`}>
+        <ScheduledQueryGroups />
+      </Route>
+      <Route path="/live_queries">
+        <LiveQueries />
+      </Route>
+      <Redirect to="/live_queries" />
+    </Switch>
+  );
+};
 
 export const OsqueryAppRoutes = React.memo(OsqueryAppRoutesComponent);
diff --git a/x-pack/plugins/osquery/public/routes/live_queries/details/actions_menu.tsx b/x-pack/plugins/osquery/public/routes/live_queries/details/actions_menu.tsx
new file mode 100644
index 00000000000000..5e7c6082fef5ad
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/live_queries/details/actions_menu.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiButton, EuiContextMenuPanel, EuiContextMenuItem, EuiPopover } from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+
+import { useDiscoverLink } from '../../../common/hooks';
+interface LiveQueryDetailsActionsMenuProps {
+  actionId: string;
+}
+
+const LiveQueryDetailsActionsMenuComponent: React.FC<LiveQueryDetailsActionsMenuProps> = ({
+  actionId,
+}) => {
+  const discoverLinkProps = useDiscoverLink({ filters: [{ key: 'action_id', value: actionId }] });
+  const [isPopoverOpen, setPopover] = useState(false);
+
+  const onButtonClick = useCallback(() => {
+    setPopover((currentIsPopoverOpen) => !currentIsPopoverOpen);
+  }, []);
+
+  const closePopover = useCallback(() => {
+    setPopover(false);
+  }, []);
+
+  const items = useMemo(
+    () => [
+      <EuiContextMenuItem key="copy" icon="copy" {...discoverLinkProps}>
+        <FormattedMessage
+          id="xpack.osquery.liveQueryResults.viewResultsInDiscoverLabel"
+          defaultMessage="View results in Discover"
+        />
+      </EuiContextMenuItem>,
+    ],
+    [discoverLinkProps]
+  );
+
+  const button = useMemo(
+    () => (
+      <EuiButton iconType="arrowDown" iconSide="right" onClick={onButtonClick}>
+        <FormattedMessage
+          id="xpack.osquery.liveQueryResults.actionsMenuButtonLabel"
+          defaultMessage="Actions"
+        />
+      </EuiButton>
+    ),
+    [onButtonClick]
+  );
+
+  return (
+    <EuiPopover
+      id="liveQueryDetailsActionsMenu"
+      button={button}
+      isOpen={isPopoverOpen}
+      closePopover={closePopover}
+      panelPaddingSize="none"
+    >
+      <EuiContextMenuPanel size="s" items={items} />
+    </EuiPopover>
+  );
+};
+
+export const LiveQueryDetailsActionsMenu = React.memo(LiveQueryDetailsActionsMenuComponent);
diff --git a/x-pack/plugins/osquery/public/routes/live_query/details/index.tsx b/x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx
similarity index 75%
rename from x-pack/plugins/osquery/public/routes/live_query/details/index.tsx
rename to x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx
index 11665bede97c5a..9f759f847f4c84 100644
--- a/x-pack/plugins/osquery/public/routes/live_query/details/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx
@@ -7,7 +7,7 @@
 
 import {
   EuiButtonEmpty,
-  EuiText,
+  EuiTextColor,
   EuiFlexGroup,
   EuiFlexItem,
   EuiCodeBlock,
@@ -28,6 +28,8 @@ import { useActionResults } from '../../../action_results/use_action_results';
 import { useActionDetails } from '../../../actions/use_action_details';
 import { ResultTabs } from '../../../queries/edit/tabs';
 import { LiveQueryDetailsActionsMenu } from './actions_menu';
+import { useBreadcrumbs } from '../../../common/hooks/use_breadcrumbs';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
 
 const Divider = styled.div`
   width: 0;
@@ -37,7 +39,8 @@ const Divider = styled.div`
 
 const LiveQueryDetailsPageComponent = () => {
   const { actionId } = useParams<{ actionId: string }>();
-  const liveQueryListProps = useRouterNavigate('live_query');
+  useBreadcrumbs('live_query_details', { liveQueryId: actionId });
+  const liveQueryListProps = useRouterNavigate('live_queries');
 
   const { data } = useActionDetails({ actionId });
   const { data: actionResultsData } = useActionResults({
@@ -54,30 +57,21 @@ const LiveQueryDetailsPageComponent = () => {
         <EuiFlexItem>
           <EuiButtonEmpty iconType="arrowLeft" {...liveQueryListProps} flush="left" size="xs">
             <FormattedMessage
-              id="xpack.osquery.liveQueryDetails.viewLiveQueriesListTitle"
-              defaultMessage="View all live queries"
+              id="xpack.osquery.liveQueryDetails.viewLiveQueriesHistoryTitle"
+              defaultMessage="View live queries history"
             />
           </EuiButtonEmpty>
         </EuiFlexItem>
         <EuiFlexItem>
-          <EuiText>
+          <BetaBadgeRowWrapper>
             <h1>
               <FormattedMessage
                 id="xpack.osquery.liveQueryDetails.pageTitle"
-                defaultMessage="Live query results"
+                defaultMessage="Live query details"
               />
             </h1>
-          </EuiText>
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiText color="subdued">
-            <p>
-              <FormattedMessage
-                id="xpack.osquery.liveQueryDetails.pageSubtitle"
-                defaultMessage="Lorem ipsum dolor sit amet, consectetur adipiscing elit."
-              />
-            </p>
-          </EuiText>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
         </EuiFlexItem>
       </EuiFlexGroup>
     ),
@@ -103,10 +97,7 @@ const LiveQueryDetailsPageComponent = () => {
               />
             </EuiDescriptionListTitle>
             <EuiDescriptionListDescription className="eui-textNoWrap">
-              {
-                // @ts-expect-error update types
-                data?.actionDetails?.fields?.agents?.length ?? '0'
-              }
+              {data?.actionDetails?.fields?.agents?.length ?? '0'}
             </EuiDescriptionListDescription>
           </EuiDescriptionList>
         </EuiFlexItem>
@@ -123,17 +114,13 @@ const LiveQueryDetailsPageComponent = () => {
               />
             </EuiDescriptionListTitle>
             <EuiDescriptionListDescription className="eui-textNoWrap">
-              {
-                // @ts-expect-error update types
-                actionResultsData?.rawResponse?.aggregations?.responses?.buckets.find(
-                  // @ts-expect-error update types
-                  (bucket) => bucket.key === 'error'
-                )?.doc_count ?? '0'
-              }
+              <EuiTextColor color={actionResultsData?.aggregations.failed ? 'danger' : 'default'}>
+                {actionResultsData?.aggregations.failed}
+              </EuiTextColor>
             </EuiDescriptionListDescription>
           </EuiDescriptionList>
         </EuiFlexItem>
-        <EuiFlexItem grow={false} key="agents_count_divider">
+        <EuiFlexItem grow={false} key="agents_failed_count_divider">
           <Divider />
         </EuiFlexItem>
         <EuiFlexItem grow={false} key="actions_menu">
@@ -141,25 +128,16 @@ const LiveQueryDetailsPageComponent = () => {
         </EuiFlexItem>
       </EuiFlexGroup>
     ),
-    [
-      actionId,
-      // @ts-expect-error update types
-      actionResultsData?.rawResponse?.aggregations?.responses?.buckets,
-      // @ts-expect-error update types
-      data?.actionDetails?.fields?.agents?.length,
-    ]
+    [actionId, actionResultsData?.aggregations.failed, data?.actionDetails?.fields?.agents?.length]
   );
 
   return (
     <WithHeaderLayout leftColumn={LeftColumn} rightColumn={RightColumn} rightColumnGrow={false}>
       <EuiCodeBlock language="sql" fontSize="m" paddingSize="m">
-        {
-          // @ts-expect-error update types
-          data?.actionDetails._source?.data?.query
-        }
+        {data?.actionDetails._source?.data?.query}
       </EuiCodeBlock>
       <EuiSpacer />
-      <ResultTabs actionId={actionId} />
+      <ResultTabs actionId={actionId} agentIds={data?.actionDetails?.fields?.agents} />
     </WithHeaderLayout>
   );
 };
diff --git a/x-pack/plugins/osquery/public/routes/live_query/index.tsx b/x-pack/plugins/osquery/public/routes/live_queries/index.tsx
similarity index 83%
rename from x-pack/plugins/osquery/public/routes/live_query/index.tsx
rename to x-pack/plugins/osquery/public/routes/live_queries/index.tsx
index 738f96087545c9..af039e85e97859 100644
--- a/x-pack/plugins/osquery/public/routes/live_query/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/live_queries/index.tsx
@@ -11,9 +11,10 @@ import { Switch, Route, useRouteMatch } from 'react-router-dom';
 import { LiveQueriesPage } from './list';
 import { NewLiveQueryPage } from './new';
 import { LiveQueryDetailsPage } from './details';
-import { LiveQueryAgentDetailsPage } from './agent_details';
+import { useBreadcrumbs } from '../../common/hooks/use_breadcrumbs';
 
 const LiveQueriesComponent = () => {
+  useBreadcrumbs('live_queries');
   const match = useRouteMatch();
 
   return (
@@ -21,9 +22,6 @@ const LiveQueriesComponent = () => {
       <Route path={`${match.url}/new`}>
         <NewLiveQueryPage />
       </Route>
-      <Route path={`${match.url}/:actionId/results/:agentId`}>
-        <LiveQueryAgentDetailsPage />
-      </Route>
       <Route path={`${match.url}/:actionId`}>
         <LiveQueryDetailsPage />
       </Route>
diff --git a/x-pack/plugins/osquery/public/routes/live_queries/list/index.tsx b/x-pack/plugins/osquery/public/routes/live_queries/list/index.tsx
new file mode 100644
index 00000000000000..f5d2863b9e99b1
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/live_queries/list/index.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButton, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+
+import { useKibana, useRouterNavigate } from '../../../common/lib/kibana';
+import { ActionsTable } from '../../../actions/actions_table';
+import { WithHeaderLayout } from '../../../components/layouts';
+import { useBreadcrumbs } from '../../../common/hooks/use_breadcrumbs';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
+
+const LiveQueriesPageComponent = () => {
+  const hasSaveUICapabilities = useKibana().services.application.capabilities.osquery.save;
+  useBreadcrumbs('live_queries');
+  const newQueryLinkProps = useRouterNavigate('live_queries/new');
+
+  const LeftColumn = useMemo(
+    () => (
+      <EuiFlexGroup direction="column" gutterSize="m">
+        <EuiFlexItem>
+          <BetaBadgeRowWrapper>
+            <h1>
+              <FormattedMessage
+                id="xpack.osquery.liveQueriesHistory.pageTitle"
+                defaultMessage="Live queries history"
+              />
+            </h1>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
+  );
+
+  const RightColumn = useMemo(
+    () => (
+      <EuiButton fill {...newQueryLinkProps} iconType="plusInCircle">
+        <FormattedMessage
+          id="xpack.osquery.liveQueriesHistory.newLiveQueryButtonLabel"
+          defaultMessage="New live query"
+        />
+      </EuiButton>
+    ),
+    [newQueryLinkProps]
+  );
+
+  return (
+    <WithHeaderLayout
+      leftColumn={LeftColumn}
+      rightColumn={hasSaveUICapabilities ? RightColumn : undefined}
+      rightColumnGrow={false}
+    >
+      <ActionsTable />
+    </WithHeaderLayout>
+  );
+};
+
+export const LiveQueriesPage = React.memo(LiveQueriesPageComponent);
diff --git a/x-pack/plugins/osquery/public/routes/live_query/new/index.tsx b/x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx
similarity index 51%
rename from x-pack/plugins/osquery/public/routes/live_query/new/index.tsx
rename to x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx
index 0aeb46da2a8977..9967eb97cddf22 100644
--- a/x-pack/plugins/osquery/public/routes/live_query/new/index.tsx
+++ b/x-pack/plugins/osquery/public/routes/live_queries/new/index.tsx
@@ -5,16 +5,39 @@
  * 2.0.
  */
 
-import { EuiButtonEmpty, EuiText, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { useMemo } from 'react';
+import { useLocation } from 'react-router-dom';
+import qs from 'query-string';
 
 import { WithHeaderLayout } from '../../../components/layouts';
 import { useRouterNavigate } from '../../../common/lib/kibana';
-import { LiveQuery } from '../../../live_query';
+import { LiveQuery } from '../../../live_queries';
+import { useBreadcrumbs } from '../../../common/hooks/use_breadcrumbs';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
 
 const NewLiveQueryPageComponent = () => {
-  const liveQueryListProps = useRouterNavigate('live_query');
+  useBreadcrumbs('live_query_new');
+  const location = useLocation();
+  const liveQueryListProps = useRouterNavigate('live_queries');
+
+  const formDefaultValue = useMemo(() => {
+    const queryParams = qs.parse(location.search);
+
+    if (queryParams?.agentPolicyId) {
+      return {
+        agentSelection: {
+          allAgentsSelected: false,
+          agents: [],
+          platformsSelected: [],
+          policiesSelected: [queryParams?.agentPolicyId],
+        },
+      };
+    }
+
+    return undefined;
+  }, [location.search]);
 
   const LeftColumn = useMemo(
     () => (
@@ -22,30 +45,21 @@ const NewLiveQueryPageComponent = () => {
         <EuiFlexItem>
           <EuiButtonEmpty iconType="arrowLeft" {...liveQueryListProps} flush="left" size="xs">
             <FormattedMessage
-              id="xpack.osquery.newLiveQuery.viewLiveQueriesListTitle"
-              defaultMessage="View all live queries"
+              id="xpack.osquery.newLiveQuery.viewLiveQueriesHistoryTitle"
+              defaultMessage="View live queries history"
             />
           </EuiButtonEmpty>
         </EuiFlexItem>
         <EuiFlexItem>
-          <EuiText>
+          <BetaBadgeRowWrapper>
             <h1>
               <FormattedMessage
                 id="xpack.osquery.newLiveQuery.pageTitle"
-                defaultMessage="New Live query"
+                defaultMessage="New live query"
               />
             </h1>
-          </EuiText>
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiText color="subdued">
-            <p>
-              <FormattedMessage
-                id="xpack.osquery.newLiveQuery.pageSubtitle"
-                defaultMessage="Lorem ipsum dolor sit amet, consectetur adipiscing elit."
-              />
-            </p>
-          </EuiText>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
         </EuiFlexItem>
       </EuiFlexGroup>
     ),
@@ -54,7 +68,7 @@ const NewLiveQueryPageComponent = () => {
 
   return (
     <WithHeaderLayout leftColumn={LeftColumn}>
-      <LiveQuery />
+      <LiveQuery defaultValue={formDefaultValue} />
     </WithHeaderLayout>
   );
 };
diff --git a/x-pack/plugins/osquery/public/routes/live_query/agent_details/index.tsx b/x-pack/plugins/osquery/public/routes/live_query/agent_details/index.tsx
deleted file mode 100644
index 266847a803c0d6..00000000000000
--- a/x-pack/plugins/osquery/public/routes/live_query/agent_details/index.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiButtonEmpty,
-  EuiText,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiCodeBlock,
-  EuiSpacer,
-} from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import React, { useMemo } from 'react';
-import { useParams } from 'react-router-dom';
-
-import { useRouterNavigate } from '../../../common/lib/kibana';
-import { WithHeaderLayout } from '../../../components/layouts';
-import { useActionDetails } from '../../../actions/use_action_details';
-import { ResultsTable } from '../../../results/results_table';
-
-const LiveQueryAgentDetailsPageComponent = () => {
-  const { actionId, agentId } = useParams<{ actionId: string; agentId: string }>();
-  const { data } = useActionDetails({ actionId });
-  const liveQueryListProps = useRouterNavigate(`live_query/${actionId}`);
-
-  const LeftColumn = useMemo(
-    () => (
-      <EuiFlexGroup alignItems="flexStart" direction="column" gutterSize="m">
-        <EuiFlexItem>
-          <EuiButtonEmpty iconType="arrowLeft" {...liveQueryListProps} flush="left" size="xs">
-            <FormattedMessage
-              id="xpack.osquery.liveQueryAgentDetails.viewLiveQueryResultsTitle"
-              defaultMessage="View all live query results"
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiText>
-            <h1>
-              <FormattedMessage
-                id="xpack.osquery.liveQueryAgentDetails.pageTitle"
-                defaultMessage="Live query {agentId} agent results"
-                // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
-                values={{ agentId }}
-              />
-            </h1>
-          </EuiText>
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiText color="subdued">
-            <p>
-              <FormattedMessage
-                id="xpack.osquery.liveQueryAgentDetails.pageSubtitle"
-                defaultMessage="Lorem ipsum dolor sit amet, consectetur adipiscing elit."
-              />
-            </p>
-          </EuiText>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    ),
-    [agentId, liveQueryListProps]
-  );
-
-  return (
-    <WithHeaderLayout leftColumn={LeftColumn}>
-      <EuiCodeBlock language="sql" fontSize="m" paddingSize="m">
-        {
-          // @ts-expect-error update types
-          data?.actionDetails._source?.data?.query
-        }
-      </EuiCodeBlock>
-      <EuiSpacer />
-      <ResultsTable actionId={actionId} agentId={agentId} />
-    </WithHeaderLayout>
-  );
-};
-
-export const LiveQueryAgentDetailsPage = React.memo(LiveQueryAgentDetailsPageComponent);
diff --git a/x-pack/plugins/osquery/public/routes/live_query/list/index.tsx b/x-pack/plugins/osquery/public/routes/live_query/list/index.tsx
deleted file mode 100644
index ed72fe704294dd..00000000000000
--- a/x-pack/plugins/osquery/public/routes/live_query/list/index.tsx
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButton, EuiText, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import React, { useMemo } from 'react';
-
-import { useRouterNavigate } from '../../../common/lib/kibana';
-import { ActionsTable } from '../../../actions/actions_table';
-import { WithHeaderLayout } from '../../../components/layouts';
-
-const LiveQueriesPageComponent = () => {
-  const newQueryLinkProps = useRouterNavigate('live_query/new');
-
-  const LeftColumn = useMemo(
-    () => (
-      <EuiFlexGroup direction="column" gutterSize="m">
-        <EuiFlexItem>
-          <EuiText>
-            <h1>
-              <FormattedMessage
-                id="xpack.osquery.liveQueryList.pageTitle"
-                defaultMessage="Live queries"
-              />
-            </h1>
-          </EuiText>
-        </EuiFlexItem>
-        <EuiFlexItem>
-          <EuiText color="subdued">
-            <p>
-              <FormattedMessage
-                id="xpack.osquery.liveQueryList.pageSubtitle"
-                defaultMessage="Lorem ipsum dolor sit amet, consectetur adipiscing elit."
-              />
-            </p>
-          </EuiText>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    ),
-    []
-  );
-
-  const RightColumn = useMemo(
-    () => (
-      <EuiButton fill {...newQueryLinkProps}>
-        {'New live query'}
-      </EuiButton>
-    ),
-    [newQueryLinkProps]
-  );
-
-  return (
-    <WithHeaderLayout leftColumn={LeftColumn} rightColumn={RightColumn} rightColumnGrow={false}>
-      <ActionsTable />
-    </WithHeaderLayout>
-  );
-};
-
-export const LiveQueriesPage = React.memo(LiveQueriesPageComponent);
diff --git a/x-pack/plugins/osquery/public/routes/scheduled_query_groups/add/index.tsx b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/add/index.tsx
new file mode 100644
index 00000000000000..3d5f25a0e32319
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/add/index.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+
+import { WithHeaderLayout } from '../../../components/layouts';
+import { useRouterNavigate } from '../../../common/lib/kibana';
+import { ScheduledQueryGroupForm } from '../../../scheduled_query_groups/form';
+import { useOsqueryIntegration } from '../../../common/hooks';
+import { useBreadcrumbs } from '../../../common/hooks/use_breadcrumbs';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
+
+const AddScheduledQueryGroupPageComponent = () => {
+  useBreadcrumbs('scheduled_query_group_add');
+  const scheduledQueryListProps = useRouterNavigate('scheduled_query_groups');
+  const { data: osqueryIntegration } = useOsqueryIntegration();
+
+  const packageInfo = useMemo(() => {
+    if (!osqueryIntegration) return;
+
+    return {
+      name: osqueryIntegration.name,
+      title: osqueryIntegration.title,
+      version: osqueryIntegration.version,
+    };
+  }, [osqueryIntegration]);
+
+  const LeftColumn = useMemo(
+    () => (
+      <EuiFlexGroup alignItems="flexStart" direction="column" gutterSize="m">
+        <EuiFlexItem>
+          <EuiButtonEmpty iconType="arrowLeft" {...scheduledQueryListProps} flush="left" size="xs">
+            <FormattedMessage
+              id="xpack.osquery.addScheduledQueryGroup.viewScheduledQueryGroupsListTitle"
+              defaultMessage="View all scheduled query groups"
+            />
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <BetaBadgeRowWrapper>
+            <h1>
+              <FormattedMessage
+                id="xpack.osquery.addScheduledQueryGroup.pageTitle"
+                defaultMessage="Add scheduled query group"
+              />
+            </h1>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    [scheduledQueryListProps]
+  );
+
+  return (
+    <WithHeaderLayout leftColumn={LeftColumn}>
+      {packageInfo && <ScheduledQueryGroupForm packageInfo={packageInfo} />}
+    </WithHeaderLayout>
+  );
+};
+
+export const AddScheduledQueryGroupPage = React.memo(AddScheduledQueryGroupPageComponent);
diff --git a/x-pack/plugins/osquery/public/routes/live_query/details/actions_menu.tsx b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/details/actions_menu.tsx
similarity index 60%
rename from x-pack/plugins/osquery/public/routes/live_query/details/actions_menu.tsx
rename to x-pack/plugins/osquery/public/routes/scheduled_query_groups/details/actions_menu.tsx
index 677b917e047b4f..ccfb933afdad69 100644
--- a/x-pack/plugins/osquery/public/routes/live_query/details/actions_menu.tsx
+++ b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/details/actions_menu.tsx
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
+import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiButton, EuiContextMenuPanel, EuiContextMenuItem, EuiPopover } from '@elastic/eui';
 import React, { useCallback, useMemo, useState } from 'react';
 
-import { useKibana } from '../../../common/lib/kibana';
+import { useDiscoverLink } from '../../../common/hooks';
 
 interface LiveQueryDetailsActionsMenuProps {
   actionId: string;
@@ -17,13 +18,9 @@ interface LiveQueryDetailsActionsMenuProps {
 const LiveQueryDetailsActionsMenuComponent: React.FC<LiveQueryDetailsActionsMenuProps> = ({
   actionId,
 }) => {
-  const services = useKibana().services;
+  const discoverLinkProps = useDiscoverLink({ filters: [{ key: 'action_id', value: actionId }] });
   const [isPopoverOpen, setPopover] = useState(false);
 
-  const discoverLinkHref = services?.application?.getUrlForApp('discover', {
-    path: `#/?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-24h,to:now))&_a=(columns:!(),filters:!(('$state':(store:appState),meta:(alias:!n,disabled:!f,index:'logs-*',key:action_id,negate:!f,params:(query:'${actionId}'),type:phrase),query:(match_phrase:(action_id:'${actionId}')))),index:'logs-*',interval:auto,query:(language:kuery,query:''),sort:!(!('@timestamp',desc)))`,
-  });
-
   const onButtonClick = useCallback(() => {
     setPopover((currentIsPopoverOpen) => !currentIsPopoverOpen);
   }, []);
@@ -34,17 +31,26 @@ const LiveQueryDetailsActionsMenuComponent: React.FC<LiveQueryDetailsActionsMenu
 
   const items = useMemo(
     () => [
-      <EuiContextMenuItem key="copy" icon="copy" href={discoverLinkHref}>
-        Check results in Discover
+      <EuiContextMenuItem key="copy" icon="copy" {...discoverLinkProps}>
+        <FormattedMessage
+          id="xpack.osquery.liveQueryResults.viewResultsInDiscoverLabel"
+          defaultMessage="View results in Discover"
+        />
       </EuiContextMenuItem>,
     ],
-    [discoverLinkHref]
+    [discoverLinkProps]
   );
 
-  const button = (
-    <EuiButton iconType="arrowDown" iconSide="right" onClick={onButtonClick}>
-      Actions
-    </EuiButton>
+  const button = useMemo(
+    () => (
+      <EuiButton iconType="arrowDown" iconSide="right" onClick={onButtonClick}>
+        <FormattedMessage
+          id="xpack.osquery.liveQueryResults.actionsMenuButtonLabel"
+          defaultMessage="Actions"
+        />
+      </EuiButton>
+    ),
+    [onButtonClick]
   );
 
   return (
diff --git a/x-pack/plugins/osquery/public/routes/scheduled_query_groups/details/index.tsx b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/details/index.tsx
new file mode 100644
index 00000000000000..abd81697fb024c
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/details/index.tsx
@@ -0,0 +1,128 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiButtonEmpty,
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiDescriptionList,
+  EuiDescriptionListTitle,
+  EuiDescriptionListDescription,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+import { useParams } from 'react-router-dom';
+import styled from 'styled-components';
+
+import { useKibana, useRouterNavigate } from '../../../common/lib/kibana';
+import { WithHeaderLayout } from '../../../components/layouts';
+import { useScheduledQueryGroup } from '../../../scheduled_query_groups/use_scheduled_query_group';
+import { ScheduledQueryGroupQueriesTable } from '../../../scheduled_query_groups/scheduled_query_group_queries_table';
+import { useBreadcrumbs } from '../../../common/hooks/use_breadcrumbs';
+import { AgentsPolicyLink } from '../../../agent_policies/agents_policy_link';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
+
+const Divider = styled.div`
+  width: 0;
+  height: 100%;
+  border-left: ${({ theme }) => theme.eui.euiBorderThin};
+`;
+
+const ScheduledQueryGroupDetailsPageComponent = () => {
+  const hasSaveUICapabilities = useKibana().services.application.capabilities.osquery.save;
+  const { scheduledQueryGroupId } = useParams<{ scheduledQueryGroupId: string }>();
+  const scheduledQueryGroupsListProps = useRouterNavigate('scheduled_query_groups');
+  const editQueryLinkProps = useRouterNavigate(
+    `scheduled_query_groups/${scheduledQueryGroupId}/edit`
+  );
+
+  const { data } = useScheduledQueryGroup({ scheduledQueryGroupId });
+
+  useBreadcrumbs('scheduled_query_group_details', { scheduledQueryGroupName: data?.name ?? '' });
+
+  const LeftColumn = useMemo(
+    () => (
+      <EuiFlexGroup alignItems="flexStart" direction="column" gutterSize="m">
+        <EuiFlexItem>
+          <EuiButtonEmpty
+            iconType="arrowLeft"
+            {...scheduledQueryGroupsListProps}
+            flush="left"
+            size="xs"
+          >
+            <FormattedMessage
+              id="xpack.osquery.scheduledQueryDetails.viewAllScheduledQueriesListTitle"
+              defaultMessage="View all scheduled query groups"
+            />
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <BetaBadgeRowWrapper>
+            <h1>
+              <FormattedMessage
+                id="xpack.osquery.scheduledQueryDetails.pageTitle"
+                defaultMessage="{queryName} details"
+                // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+                values={{
+                  queryName: data?.name,
+                }}
+              />
+            </h1>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    [data?.name, scheduledQueryGroupsListProps]
+  );
+
+  const RightColumn = useMemo(
+    () => (
+      <EuiFlexGroup justifyContent="flexEnd" direction="row">
+        <EuiFlexItem grow={false} key="agents_failed_count">
+          {/* eslint-disable-next-line react-perf/jsx-no-new-object-as-prop */}
+          <EuiDescriptionList compressed textStyle="reverse" style={{ textAlign: 'right' }}>
+            <EuiDescriptionListTitle className="eui-textNoWrap">
+              <FormattedMessage
+                id="xpack.osquery.scheduleQueryGroup.kpis.policyLabelText"
+                defaultMessage="Policy"
+              />
+            </EuiDescriptionListTitle>
+            <EuiDescriptionListDescription className="eui-textNoWrap">
+              {data?.policy_id ? <AgentsPolicyLink policyId={data?.policy_id} /> : null}
+            </EuiDescriptionListDescription>
+          </EuiDescriptionList>
+        </EuiFlexItem>
+        {hasSaveUICapabilities ? (
+          <>
+            <EuiFlexItem grow={false} key="agents_failed_count_divider">
+              <Divider />
+            </EuiFlexItem>
+            <EuiFlexItem grow={false} key="edit_button">
+              <EuiButton fill {...editQueryLinkProps} iconType="pencil">
+                <FormattedMessage
+                  id="xpack.osquery.scheduledQueryDetailsPage.editQueryButtonLabel"
+                  defaultMessage="Edit"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          </>
+        ) : undefined}
+      </EuiFlexGroup>
+    ),
+    [data?.policy_id, editQueryLinkProps, hasSaveUICapabilities]
+  );
+
+  return (
+    <WithHeaderLayout leftColumn={LeftColumn} rightColumn={RightColumn} rightColumnGrow={false}>
+      {data && <ScheduledQueryGroupQueriesTable data={data} />}
+    </WithHeaderLayout>
+  );
+};
+
+export const ScheduledQueryGroupDetailsPage = React.memo(ScheduledQueryGroupDetailsPageComponent);
diff --git a/x-pack/plugins/osquery/public/routes/scheduled_query_groups/edit/index.tsx b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/edit/index.tsx
new file mode 100644
index 00000000000000..0d63dba2fd1e60
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/edit/index.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiLoadingContent } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+import { useParams } from 'react-router-dom';
+
+import { WithHeaderLayout } from '../../../components/layouts';
+import { useRouterNavigate } from '../../../common/lib/kibana';
+import { ScheduledQueryGroupForm } from '../../../scheduled_query_groups/form';
+import { useScheduledQueryGroup } from '../../../scheduled_query_groups/use_scheduled_query_group';
+import { useBreadcrumbs } from '../../../common/hooks/use_breadcrumbs';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
+
+const EditScheduledQueryGroupPageComponent = () => {
+  const { scheduledQueryGroupId } = useParams<{ scheduledQueryGroupId: string }>();
+  const queryDetailsLinkProps = useRouterNavigate(
+    `scheduled_query_groups/${scheduledQueryGroupId}`
+  );
+
+  const { data } = useScheduledQueryGroup({ scheduledQueryGroupId });
+
+  useBreadcrumbs('scheduled_query_group_edit', { scheduledQueryGroupName: data?.name ?? '' });
+
+  const LeftColumn = useMemo(
+    () => (
+      <EuiFlexGroup alignItems="flexStart" direction="column" gutterSize="m">
+        <EuiFlexItem>
+          <EuiButtonEmpty iconType="arrowLeft" {...queryDetailsLinkProps} flush="left" size="xs">
+            <FormattedMessage
+              id="xpack.osquery.editScheduledQuery.viewScheduledQueriesListTitle"
+              defaultMessage="View {queryName} details"
+              // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+              values={{ queryName: data?.name }}
+            />
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <BetaBadgeRowWrapper>
+            <h1>
+              <FormattedMessage
+                id="xpack.osquery.editScheduledQuery.pageTitle"
+                defaultMessage="Edit {queryName}"
+                // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+                values={{
+                  queryName: data?.name,
+                }}
+              />
+            </h1>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    [data?.name, queryDetailsLinkProps]
+  );
+
+  return (
+    <WithHeaderLayout leftColumn={LeftColumn}>
+      {!data ? (
+        <EuiLoadingContent lines={10} />
+      ) : (
+        <ScheduledQueryGroupForm editMode={true} defaultValue={data} />
+      )}
+    </WithHeaderLayout>
+  );
+};
+
+export const EditScheduledQueryGroupPage = React.memo(EditScheduledQueryGroupPageComponent);
diff --git a/x-pack/plugins/osquery/public/routes/scheduled_query_groups/index.tsx b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/index.tsx
new file mode 100644
index 00000000000000..76ca2bf14d303d
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/index.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { Switch, Route, useRouteMatch } from 'react-router-dom';
+
+import { ScheduledQueryGroupsPage } from './list';
+import { AddScheduledQueryGroupPage } from './add';
+import { EditScheduledQueryGroupPage } from './edit';
+import { ScheduledQueryGroupDetailsPage } from './details';
+import { useBreadcrumbs } from '../../common/hooks/use_breadcrumbs';
+
+const ScheduledQueryGroupsComponent = () => {
+  useBreadcrumbs('scheduled_query_groups');
+  const match = useRouteMatch();
+
+  return (
+    <Switch>
+      <Route path={`${match.url}/add`}>
+        <AddScheduledQueryGroupPage />
+      </Route>
+      <Route path={`${match.url}/:scheduledQueryGroupId/edit`}>
+        <EditScheduledQueryGroupPage />
+      </Route>
+      <Route path={`${match.url}/:scheduledQueryGroupId`}>
+        <ScheduledQueryGroupDetailsPage />
+      </Route>
+      <Route path={`${match.url}`}>
+        <ScheduledQueryGroupsPage />
+      </Route>
+    </Switch>
+  );
+};
+
+export const ScheduledQueryGroups = React.memo(ScheduledQueryGroupsComponent);
diff --git a/x-pack/plugins/osquery/public/routes/scheduled_query_groups/list/index.tsx b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/list/index.tsx
new file mode 100644
index 00000000000000..9c5ebfdb79f9f7
--- /dev/null
+++ b/x-pack/plugins/osquery/public/routes/scheduled_query_groups/list/index.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButton, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { useMemo } from 'react';
+
+import { useKibana, useRouterNavigate } from '../../../common/lib/kibana';
+import { WithHeaderLayout } from '../../../components/layouts';
+import { ScheduledQueryGroupsTable } from '../../../scheduled_query_groups/scheduled_query_groups_table';
+import { BetaBadge, BetaBadgeRowWrapper } from '../../../components/beta_badge';
+
+const ScheduledQueryGroupsPageComponent = () => {
+  const hasSaveUICapabilities = useKibana().services.application.capabilities.osquery.save;
+  const newQueryLinkProps = useRouterNavigate('scheduled_query_groups/add');
+
+  const LeftColumn = useMemo(
+    () => (
+      <EuiFlexGroup direction="column" gutterSize="m">
+        <EuiFlexItem>
+          <BetaBadgeRowWrapper>
+            <h1>
+              <FormattedMessage
+                id="xpack.osquery.scheduledQueryList.pageTitle"
+                defaultMessage="Scheduled query groups"
+              />
+            </h1>
+            <BetaBadge />
+          </BetaBadgeRowWrapper>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
+  );
+
+  const RightColumn = useMemo(
+    () => (
+      <EuiButton fill {...newQueryLinkProps} iconType="plusInCircle">
+        <FormattedMessage
+          id="xpack.osquery.scheduledQueryList.addScheduledQueryButtonLabel"
+          defaultMessage="Add scheduled query group"
+        />
+      </EuiButton>
+    ),
+    [newQueryLinkProps]
+  );
+
+  return (
+    <WithHeaderLayout
+      leftColumn={LeftColumn}
+      rightColumn={hasSaveUICapabilities ? RightColumn : undefined}
+      rightColumnGrow={false}
+    >
+      <ScheduledQueryGroupsTable />
+    </WithHeaderLayout>
+  );
+};
+
+export const ScheduledQueryGroupsPage = React.memo(ScheduledQueryGroupsPageComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/common/osquery_stream_field.tsx b/x-pack/plugins/osquery/public/scheduled_query/common/osquery_stream_field.tsx
deleted file mode 100644
index 6f589f6f64b137..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/common/osquery_stream_field.tsx
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { find } from 'lodash/fp';
-import {
-  EuiButtonIcon,
-  EuiFieldText,
-  EuiForm,
-  EuiFormRow,
-  EuiSelect,
-  EuiSpacer,
-  EuiSwitch,
-  EuiHorizontalRule,
-} from '@elastic/eui';
-import React, { useCallback, useMemo } from 'react';
-import { useQuery } from 'react-query';
-
-import { useKibana } from '../../common/lib/kibana';
-
-// @ts-expect-error update types
-const OsqueryStreamFieldComponent = ({ field, removeItem }) => {
-  const { http } = useKibana().services;
-  const { data: { saved_objects: savedQueries } = {} } = useQuery(['savedQueryList'], () =>
-    http.get('/internal/osquery/saved_query', {
-      query: { pageIndex: 0, pageSize: 100, sortField: 'updated_at', sortDirection: 'desc' },
-    })
-  );
-
-  const { setValue } = field;
-
-  const savedQueriesOptions = useMemo(
-    () =>
-      // @ts-expect-error update types
-      (savedQueries ?? []).map((savedQuery) => ({
-        text: savedQuery.attributes.name,
-        value: savedQuery.id,
-      })),
-    [savedQueries]
-  );
-
-  const handleSavedQueryChange = useCallback(
-    (event) => {
-      event.persist();
-      const savedQueryId = event.target.value;
-      const savedQuery = find(['id', savedQueryId], savedQueries);
-
-      if (savedQuery) {
-        // @ts-expect-error update types
-        setValue((prev) => ({
-          ...prev,
-          vars: {
-            ...prev.vars,
-            id: {
-              ...prev.vars.id,
-              value: savedQuery.id,
-            },
-            query: {
-              ...prev.vars.query,
-              value: savedQuery.attributes.query,
-            },
-          },
-        }));
-      }
-    },
-    [savedQueries, setValue]
-  );
-
-  const handleEnabledChange = useCallback(() => {
-    // @ts-expect-error update types
-    setValue((prev) => ({
-      ...prev,
-      enabled: !prev.enabled,
-    }));
-  }, [setValue]);
-
-  const handleQueryChange = useCallback(
-    (event) => {
-      event.persist();
-      // @ts-expect-error update types
-      setValue((prev) => ({
-        ...prev,
-        vars: {
-          ...prev.vars,
-          query: {
-            ...prev.vars.query,
-            value: event.target.value,
-          },
-        },
-      }));
-    },
-    [setValue]
-  );
-
-  const handleIntervalChange = useCallback(
-    (event) => {
-      event.persist();
-      // @ts-expect-error update types
-      setValue((prev) => ({
-        ...prev,
-        vars: {
-          ...prev.vars,
-          interval: {
-            ...prev.vars.interval,
-            value: event.target.value,
-          },
-        },
-      }));
-    },
-    [setValue]
-  );
-
-  const handleIdChange = useCallback(
-    (event) => {
-      event.persist();
-      // @ts-expect-error update types
-      setValue((prev) => ({
-        ...prev,
-        vars: {
-          ...prev.vars,
-          id: {
-            ...prev.vars.id,
-            value: event.target.value,
-          },
-        },
-      }));
-    },
-    [setValue]
-  );
-
-  return (
-    <EuiForm>
-      <EuiFormRow>
-        <EuiSwitch label="Enabled" checked={field.value.enabled} onChange={handleEnabledChange} />
-      </EuiFormRow>
-      <EuiSpacer />
-      <EuiFormRow>
-        <EuiButtonIcon aria-label="remove" onClick={removeItem} color="danger" iconType="trash" />
-      </EuiFormRow>
-      <EuiFormRow>
-        <EuiSelect
-          value={field.value.vars.id.value}
-          hasNoInitialSelection
-          options={savedQueriesOptions}
-          onChange={handleSavedQueryChange}
-        />
-      </EuiFormRow>
-      <EuiSpacer />
-      <EuiFormRow>
-        <EuiFieldText value={field.value.vars.query.value} onChange={handleQueryChange} />
-      </EuiFormRow>
-      <EuiSpacer />
-      <EuiFormRow>
-        <EuiFieldText value={field.value.vars.interval.value} onChange={handleIntervalChange} />
-      </EuiFormRow>
-      <EuiSpacer />
-      <EuiFormRow>
-        <EuiFieldText value={field.value.vars.id.value} onChange={handleIdChange} />
-      </EuiFormRow>
-      <EuiSpacer />
-      <EuiHorizontalRule />
-    </EuiForm>
-  );
-};
-
-export const OsqueryStreamField = React.memo(OsqueryStreamFieldComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/edit/form.tsx b/x-pack/plugins/osquery/public/scheduled_query/edit/form.tsx
deleted file mode 100644
index 3e0e2b33efdae1..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/edit/form.tsx
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import produce from 'immer';
-import { get, omit } from 'lodash/fp';
-import { EuiButton, EuiButtonEmpty, EuiSpacer, EuiHorizontalRule } from '@elastic/eui';
-import uuid from 'uuid';
-import React, { useMemo } from 'react';
-
-import {
-  UseField,
-  useForm,
-  UseArray,
-  getUseField,
-  Field,
-  ToggleField,
-  Form,
-} from '../../shared_imports';
-
-import { OsqueryStreamField } from '../common/osquery_stream_field';
-import { schema } from './schema';
-
-const CommonUseField = getUseField({ component: Field });
-
-const EDIT_SCHEDULED_QUERY_FORM_ID = 'editScheduledQueryForm';
-
-interface EditScheduledQueryFormProps {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  agentPolicies: Array<Record<string, any>>;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  data: Array<Record<string, any>>;
-  handleSubmit: () => Promise<void>;
-}
-
-const EditScheduledQueryFormComponent: React.FC<EditScheduledQueryFormProps> = ({
-  agentPolicies,
-  data,
-  handleSubmit,
-}) => {
-  const agentPoliciesOptions = useMemo(
-    () =>
-      agentPolicies.map((policy) => ({
-        value: policy.id,
-        text: policy.name,
-      })),
-    [agentPolicies]
-  );
-
-  const { form } = useForm({
-    schema,
-    id: EDIT_SCHEDULED_QUERY_FORM_ID,
-    onSubmit: handleSubmit,
-    defaultValue: data,
-    // @ts-expect-error update types
-    deserializer: (payload) => {
-      const deserialized = produce(payload, (draft) => {
-        // @ts-expect-error update types
-        draft.inputs[0].streams.forEach((stream) => {
-          delete stream.compiled_stream;
-        });
-      });
-
-      return deserialized;
-    },
-    // @ts-expect-error update types
-    serializer: (payload) =>
-      omit(['id', 'revision', 'created_at', 'created_by', 'updated_at', 'updated_by', 'version'], {
-        ...data,
-        ...payload,
-        // @ts-expect-error update types
-        inputs: [{ type: 'osquery', ...((payload.inputs && payload.inputs[0]) ?? {}) }],
-      }),
-  });
-
-  const { submit } = form;
-
-  const policyIdComponentProps = useMemo(
-    () => ({
-      euiFieldProps: {
-        disabled: true,
-        options: agentPoliciesOptions,
-      },
-    }),
-    [agentPoliciesOptions]
-  );
-
-  return (
-    <Form form={form}>
-      <CommonUseField path="policy_id" componentProps={policyIdComponentProps} />
-      <EuiSpacer />
-      <CommonUseField path="name" />
-      <EuiSpacer />
-      <CommonUseField path="description" />
-      <EuiSpacer />
-      <CommonUseField path="inputs[0].enabled" component={ToggleField} />
-      <EuiHorizontalRule />
-      <EuiSpacer />
-      <UseArray path="inputs[0].streams">
-        {({ items, addItem, removeItem }) => (
-          <>
-            {items.map((item) => (
-              <UseField
-                key={item.path}
-                path={item.path}
-                component={OsqueryStreamField}
-                // eslint-disable-next-line react/jsx-no-bind, react-perf/jsx-no-new-function-as-prop
-                removeItem={() => removeItem(item.id)}
-                defaultValue={
-                  // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
-                  get(item.path, form.getFormData()) ?? {
-                    data_stream: {
-                      type: 'logs',
-                      dataset: 'osquery_elastic_managed.osquery',
-                    },
-                    vars: {
-                      query: {
-                        type: 'text',
-                        value: 'select * from uptime',
-                      },
-                      interval: {
-                        type: 'text',
-                        value: '120',
-                      },
-                      id: {
-                        type: 'text',
-                        value: uuid.v4(),
-                      },
-                    },
-                    enabled: true,
-                  }
-                }
-              />
-            ))}
-            <EuiButtonEmpty onClick={addItem} iconType="plusInCircleFilled">
-              {'Add query'}
-            </EuiButtonEmpty>
-          </>
-        )}
-      </UseArray>
-      <EuiHorizontalRule />
-      <EuiSpacer />
-      <EuiButton fill onClick={submit}>
-        Save
-      </EuiButton>
-    </Form>
-  );
-};
-
-export const EditScheduledQueryForm = React.memo(EditScheduledQueryFormComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/edit/index.tsx b/x-pack/plugins/osquery/public/scheduled_query/edit/index.tsx
deleted file mode 100644
index 65dec2e467b353..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/edit/index.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { useParams } from 'react-router-dom';
-import { useMutation, useQuery } from 'react-query';
-
-import { useKibana } from '../../common/lib/kibana';
-import { EditScheduledQueryForm } from './form';
-
-const EditScheduledQueryPageComponent = () => {
-  const { http } = useKibana().services;
-  const { scheduledQueryId } = useParams<{ scheduledQueryId: string }>();
-
-  const { data } = useQuery(['scheduledQuery', { scheduledQueryId }], () =>
-    http.get(`/internal/osquery/scheduled_query/${scheduledQueryId}`)
-  );
-
-  const { data: agentPolicies } = useQuery(
-    ['agentPolicy'],
-    () => http.get(`/api/fleet/agent_policies`),
-    { initialData: { items: [] } }
-  );
-
-  const updateScheduledQueryMutation = useMutation((payload) =>
-    http.put(`/api/fleet/package_policies/${scheduledQueryId}`, { body: JSON.stringify(payload) })
-  );
-
-  if (data) {
-    return (
-      <EditScheduledQueryForm
-        data={data}
-        // @ts-expect-error update types
-        agentPolicies={agentPolicies?.items}
-        // @ts-expect-error update types
-        handleSubmit={updateScheduledQueryMutation.mutate}
-      />
-    );
-  }
-
-  return <div>Loading</div>;
-};
-
-export const EditScheduledQueryPage = React.memo(EditScheduledQueryPageComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/edit/schema.ts b/x-pack/plugins/osquery/public/scheduled_query/edit/schema.ts
deleted file mode 100644
index 75a6d955c62ec6..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/edit/schema.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FIELD_TYPES } from '../../shared_imports';
-
-export const schema = {
-  policy_id: {
-    type: FIELD_TYPES.SELECT,
-    label: 'Policy',
-  },
-  name: {
-    type: FIELD_TYPES.TEXT,
-    label: 'Name',
-  },
-  description: {
-    type: FIELD_TYPES.TEXT,
-    label: 'Description',
-  },
-  streams: {
-    type: FIELD_TYPES.MULTI_SELECT,
-  },
-};
diff --git a/x-pack/plugins/osquery/public/scheduled_query/index.tsx b/x-pack/plugins/osquery/public/scheduled_query/index.tsx
deleted file mode 100644
index 205c87b3a0d500..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/index.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { Switch, Route, useRouteMatch } from 'react-router-dom';
-
-import { ScheduledQueriesPage } from './queries';
-import { NewScheduledQueryPage } from './new';
-import { EditScheduledQueryPage } from './edit';
-// import { QueryAgentResults } from './agent_results';
-// import { SavedQueriesPage } from './saved_query';
-
-const ScheduledQueriesComponent = () => {
-  const match = useRouteMatch();
-
-  return (
-    <Switch>
-      <Route path={`${match.url}/new`}>
-        <NewScheduledQueryPage />
-      </Route>
-      {/* <Route path={`${match.url}/:savedQueryId/results/:agentId`}>
-        <QueryAgentResults />
-      </Route> */}
-      <Route path={`${match.url}/:scheduledQueryId`}>
-        <EditScheduledQueryPage />
-      </Route>
-      <Route path={`${match.url}/`}>
-        <ScheduledQueriesPage />
-      </Route>
-    </Switch>
-  );
-};
-
-export const ScheduledQueries = React.memo(ScheduledQueriesComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/new/form.tsx b/x-pack/plugins/osquery/public/scheduled_query/new/form.tsx
deleted file mode 100644
index 186e74d190c6d7..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/new/form.tsx
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButton, EuiButtonEmpty, EuiSpacer } from '@elastic/eui';
-import deepmerge from 'deepmerge';
-import React, { useCallback } from 'react';
-
-import { useForm, UseArray, UseField, getUseField, Field, Form } from '../../shared_imports';
-
-import { OsqueryStreamField } from '../common/osquery_stream_field';
-import { defaultValue, schema } from './schema';
-import { combineMerge } from './utils';
-
-const CommonUseField = getUseField({ component: Field });
-
-const NEW_SCHEDULED_QUERY_FORM_ID = 'newScheduledQueryForm';
-
-interface NewScheduledQueryFormProps {
-  handleSubmit: () => Promise<void>;
-}
-
-const NewScheduledQueryFormComponent: React.FC<NewScheduledQueryFormProps> = ({ handleSubmit }) => {
-  const { form } = useForm({
-    schema,
-    id: NEW_SCHEDULED_QUERY_FORM_ID,
-    options: {
-      stripEmptyFields: false,
-    },
-    onSubmit: handleSubmit,
-    // @ts-expect-error update types
-    defaultValue,
-    serializer: (payload) =>
-      deepmerge(defaultValue, payload, {
-        arrayMerge: combineMerge,
-      }),
-  });
-  const { submit } = form;
-
-  const StreamsContent = useCallback(
-    ({ items, addItem, removeItem }) => (
-      <>
-        {
-          // @ts-expect-error update types
-          items.map((item) => (
-            <UseField
-              key={item.path}
-              path={item.path}
-              component={OsqueryStreamField}
-              // eslint-disable-next-line react/jsx-no-bind, react-perf/jsx-no-new-function-as-prop
-              removeItem={() => removeItem(item.id)}
-              // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
-              defaultValue={{
-                data_stream: {
-                  type: 'logs',
-                  dataset: 'osquery_elastic_managed.osquery',
-                },
-                vars: {
-                  query: {
-                    type: 'text',
-                    value: '',
-                  },
-                  interval: {
-                    type: 'text',
-                    value: '',
-                  },
-                  id: {
-                    type: 'text',
-                    value: '',
-                  },
-                },
-                enabled: true,
-              }}
-            />
-          ))
-        }
-        <EuiButtonEmpty onClick={addItem} iconType="plusInCircleFilled">
-          {'Add query'}
-        </EuiButtonEmpty>
-      </>
-    ),
-    []
-  );
-
-  return (
-    <Form form={form}>
-      <CommonUseField path="name" />
-      <EuiSpacer />
-      <CommonUseField path="description" />
-      <EuiSpacer />
-      <UseArray path="inputs[0].streams" initialNumberOfItems={1} readDefaultValueOnForm={false}>
-        {StreamsContent}
-      </UseArray>
-      <EuiSpacer />
-      <EuiButton fill onClick={submit}>
-        {'Save'}
-      </EuiButton>
-    </Form>
-  );
-};
-
-export const NewScheduledQueryForm = React.memo(NewScheduledQueryFormComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/new/index.tsx b/x-pack/plugins/osquery/public/scheduled_query/new/index.tsx
deleted file mode 100644
index bb4ae6f113de28..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/new/index.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { useHistory } from 'react-router-dom';
-import { useMutation } from 'react-query';
-
-import { useKibana } from '../../common/lib/kibana';
-import { NewScheduledQueryForm } from './form';
-
-const NewScheduledQueryPageComponent = () => {
-  const { http } = useKibana().services;
-  const history = useHistory();
-
-  const createScheduledQueryMutation = useMutation(
-    (payload) => http.post(`/api/fleet/package_policies`, { body: JSON.stringify(payload) }),
-    {
-      onSuccess: (data) => {
-        history.push(`/scheduled_queries/${data.item.id}`);
-      },
-    }
-  );
-
-  // @ts-expect-error update types
-  return <NewScheduledQueryForm handleSubmit={createScheduledQueryMutation.mutate} />;
-};
-
-export const NewScheduledQueryPage = React.memo(NewScheduledQueryPageComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query/new/schema.ts b/x-pack/plugins/osquery/public/scheduled_query/new/schema.ts
deleted file mode 100644
index aef33e57f6f30b..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/new/schema.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FIELD_TYPES } from '../../shared_imports';
-
-export const defaultValue = {
-  name: '',
-  description: '',
-  namespace: 'default',
-  enabled: true,
-  policy_id: '1e2bb670-686c-11eb-84b4-81282a213fcf',
-  output_id: '',
-  package: {
-    name: 'osquery_elastic_managed',
-    title: 'OSquery Elastic Managed',
-    version: '0.1.2',
-  },
-  inputs: [
-    {
-      type: 'osquery',
-      enabled: true,
-      streams: [],
-    },
-  ],
-};
-
-export const schema = {
-  name: {
-    type: FIELD_TYPES.TEXT,
-    label: 'Name',
-  },
-  description: {
-    type: FIELD_TYPES.TEXT,
-    label: 'Description',
-  },
-  namespace: {
-    type: FIELD_TYPES.TEXT,
-  },
-  enabled: {
-    type: FIELD_TYPES.TOGGLE,
-  },
-  policy_id: {
-    type: FIELD_TYPES.TEXT,
-  },
-  inputs: {
-    enabled: {
-      type: FIELD_TYPES.TOGGLE,
-    },
-    streams: {
-      type: FIELD_TYPES.MULTI_SELECT,
-      vars: {
-        query: {
-          type: {
-            type: FIELD_TYPES.TEXT,
-          },
-          value: {
-            type: FIELD_TYPES.TEXT,
-          },
-        },
-      },
-    },
-  },
-};
diff --git a/x-pack/plugins/osquery/public/scheduled_query/new/utils.ts b/x-pack/plugins/osquery/public/scheduled_query/new/utils.ts
deleted file mode 100644
index 2de5c90f19c0e0..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/new/utils.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import deepmerge from 'deepmerge';
-
-// @ts-expect-error update types
-export const combineMerge = (target, source, options) => {
-  const destination = target.slice();
-
-  // @ts-expect-error update types
-  source.forEach((item, index) => {
-    if (typeof destination[index] === 'undefined') {
-      destination[index] = options.cloneUnlessOtherwiseSpecified(item, options);
-    } else if (options.isMergeableObject(item)) {
-      destination[index] = deepmerge(target[index], item, options);
-    } else if (target.indexOf(item) === -1) {
-      destination.push(item);
-    }
-  });
-  return destination;
-};
diff --git a/x-pack/plugins/osquery/public/scheduled_query/queries/index.tsx b/x-pack/plugins/osquery/public/scheduled_query/queries/index.tsx
deleted file mode 100644
index 24a78320e30d22..00000000000000
--- a/x-pack/plugins/osquery/public/scheduled_query/queries/index.tsx
+++ /dev/null
@@ -1,185 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiBasicTable,
-  EuiButton,
-  EuiButtonIcon,
-  EuiCodeBlock,
-  RIGHT_ALIGNMENT,
-} from '@elastic/eui';
-import React, { useCallback, useMemo, useState } from 'react';
-import { useQuery } from 'react-query';
-import { useHistory } from 'react-router-dom';
-
-import { Direction } from '../../../common/search_strategy';
-import { useKibana, useRouterNavigate } from '../../common/lib/kibana';
-
-const ScheduledQueriesPageComponent = () => {
-  const { push } = useHistory();
-  const [pageIndex, setPageIndex] = useState(0);
-  const [pageSize, setPageSize] = useState(5);
-  const [sortField, setSortField] = useState('updated_at');
-  const [sortDirection, setSortDirection] = useState(Direction.desc);
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const [itemIdToExpandedRowMap, setItemIdToExpandedRowMap] = useState<Record<string, any>>({});
-  const { http } = useKibana().services;
-  const newQueryLinkProps = useRouterNavigate('scheduled_queries/new');
-
-  const { data = {} } = useQuery(
-    ['scheduledQueryList', { pageIndex, pageSize, sortField, sortDirection }],
-    () =>
-      http.get('/internal/osquery/scheduled_query', {
-        query: {
-          pageIndex,
-          pageSize,
-          sortField,
-          sortDirection,
-        },
-      }),
-    {
-      keepPreviousData: true,
-      // Refetch the data every 5 seconds
-      refetchInterval: 5000,
-    }
-  );
-  const { total = 0, items: savedQueries } = data;
-
-  const toggleDetails = useCallback(
-    (item) => () => {
-      const itemIdToExpandedRowMapValues = { ...itemIdToExpandedRowMap };
-      if (itemIdToExpandedRowMapValues[item.id]) {
-        delete itemIdToExpandedRowMapValues[item.id];
-      } else {
-        // @ts-expect-error update types
-        itemIdToExpandedRowMapValues[item.id] = item.inputs[0].streams.map((stream) => (
-          <EuiCodeBlock key={stream} language="sql" fontSize="m" paddingSize="m">
-            {`${stream.vars.query.value} every ${stream.vars.interval.value}s`}
-          </EuiCodeBlock>
-        ));
-      }
-      setItemIdToExpandedRowMap(itemIdToExpandedRowMapValues);
-    },
-    [itemIdToExpandedRowMap]
-  );
-
-  const renderExtendedItemToggle = useCallback(
-    (item) => (
-      <EuiButtonIcon
-        onClick={toggleDetails(item)}
-        aria-label={itemIdToExpandedRowMap[item.id] ? 'Collapse' : 'Expand'}
-        iconType={itemIdToExpandedRowMap[item.id] ? 'arrowUp' : 'arrowDown'}
-      />
-    ),
-    [itemIdToExpandedRowMap, toggleDetails]
-  );
-
-  const handleEditClick = useCallback((item) => push(`/scheduled_queries/${item.id}`), [push]);
-
-  const columns = useMemo(
-    () => [
-      {
-        field: 'name',
-        name: 'Query name',
-        sortable: true,
-        truncateText: true,
-      },
-      {
-        field: 'enabled',
-        name: 'Active',
-        sortable: true,
-        truncateText: true,
-      },
-      {
-        field: 'updated_at',
-        name: 'Last updated at',
-        sortable: true,
-        truncateText: true,
-      },
-      {
-        name: 'Actions',
-        actions: [
-          {
-            name: 'Edit',
-            description: 'Edit or run this query',
-            type: 'icon',
-            icon: 'documentEdit',
-            onClick: handleEditClick,
-          },
-        ],
-      },
-      {
-        align: RIGHT_ALIGNMENT,
-        width: '40px',
-        isExpander: true,
-        render: renderExtendedItemToggle,
-      },
-    ],
-    [handleEditClick, renderExtendedItemToggle]
-  );
-
-  const onTableChange = useCallback(({ page = {}, sort = {} }) => {
-    setPageIndex(page.index);
-    setPageSize(page.size);
-    setSortField(sort.field);
-    setSortDirection(sort.direction);
-  }, []);
-
-  const pagination = useMemo(
-    () => ({
-      pageIndex,
-      pageSize,
-      totalItemCount: total,
-      pageSizeOptions: [3, 5, 8],
-    }),
-    [total, pageIndex, pageSize]
-  );
-
-  const sorting = useMemo(
-    () => ({
-      sort: {
-        field: sortField,
-        direction: sortDirection,
-      },
-    }),
-    [sortDirection, sortField]
-  );
-
-  const selection = useMemo(
-    () => ({
-      selectable: () => true,
-      initialSelected: [],
-    }),
-    []
-  );
-
-  return (
-    <div>
-      <EuiButton fill {...newQueryLinkProps}>
-        {'New query'}
-      </EuiButton>
-
-      {savedQueries && (
-        <EuiBasicTable
-          items={savedQueries}
-          itemId="id"
-          // @ts-expect-error update types
-          columns={columns}
-          pagination={pagination}
-          sorting={sorting}
-          isSelectable={true}
-          selection={selection}
-          onChange={onTableChange}
-          itemIdToExpandedRowMap={itemIdToExpandedRowMap}
-          rowHeader="id"
-        />
-      )}
-    </div>
-  );
-};
-
-export const ScheduledQueriesPage = React.memo(ScheduledQueriesPageComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/active_state_switch.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/active_state_switch.tsx
new file mode 100644
index 00000000000000..1e06c1efd2c615
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/active_state_switch.tsx
@@ -0,0 +1,144 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { produce } from 'immer';
+import { EuiSwitch, EuiLoadingSpinner } from '@elastic/eui';
+import React, { useCallback, useState } from 'react';
+import { useMutation, useQueryClient } from 'react-query';
+import styled from 'styled-components';
+import { i18n } from '@kbn/i18n';
+
+import {
+  PackagePolicy,
+  UpdatePackagePolicy,
+  packagePolicyRouteService,
+} from '../../../fleet/common';
+import { useKibana } from '../common/lib/kibana';
+import { useAgentStatus } from '../agents/use_agent_status';
+import { useAgentPolicy } from '../agent_policies/use_agent_policy';
+import { ConfirmDeployAgentPolicyModal } from './form/confirmation_modal';
+
+const StyledEuiLoadingSpinner = styled(EuiLoadingSpinner)`
+  margin-right: ${({ theme }) => theme.eui.paddingSizes.s};
+`;
+
+interface ActiveStateSwitchProps {
+  item: PackagePolicy;
+}
+
+const ActiveStateSwitchComponent: React.FC<ActiveStateSwitchProps> = ({ item }) => {
+  const queryClient = useQueryClient();
+  const {
+    http,
+    notifications: { toasts },
+    application: {
+      capabilities: {
+        osquery: { save: hasSaveUICapabilities },
+      },
+    },
+  } = useKibana().services;
+  const [confirmationModal, setConfirmationModal] = useState(false);
+
+  const hideConfirmationModal = useCallback(() => setConfirmationModal(false), []);
+
+  const { data: agentStatus } = useAgentStatus({ policyId: item.policy_id });
+  const { data: agentPolicy } = useAgentPolicy({ policyId: item.policy_id });
+
+  const { isLoading, mutate } = useMutation(
+    ({ id, ...payload }: UpdatePackagePolicy & { id: string }) =>
+      http.put(packagePolicyRouteService.getUpdatePath(id), {
+        body: JSON.stringify(payload),
+      }),
+    {
+      onSuccess: (response) => {
+        queryClient.invalidateQueries('scheduledQueries');
+        toasts.addSuccess(
+          response.item.enabled
+            ? i18n.translate(
+                'xpack.osquery.scheduledQueryGroup.table.activatedSuccessToastMessageText',
+                {
+                  defaultMessage: 'Successfully activated {scheduledQueryGroupName}',
+                  values: {
+                    scheduledQueryGroupName: response.item.name,
+                  },
+                }
+              )
+            : i18n.translate(
+                'xpack.osquery.scheduledQueryGroup.table.deactivatedSuccessToastMessageText',
+                {
+                  defaultMessage: 'Successfully deactivated {scheduledQueryGroupName}',
+                  values: {
+                    scheduledQueryGroupName: response.item.name,
+                  },
+                }
+              )
+        );
+      },
+    }
+  );
+
+  const handleToggleActive = useCallback(() => {
+    const updatedPolicy = produce<
+      UpdatePackagePolicy & { id: string },
+      Omit<PackagePolicy, 'revision' | 'updated_at' | 'updated_by' | 'created_at' | 'created_by'> &
+        Partial<{
+          revision: number;
+          updated_at: string;
+          updated_by: string;
+          created_at: string;
+          created_by: string;
+        }>
+    >(item, (draft) => {
+      delete draft.revision;
+      delete draft.updated_at;
+      delete draft.updated_by;
+      delete draft.created_at;
+      delete draft.created_by;
+
+      draft.enabled = !item.enabled;
+      draft.inputs[0].streams.forEach((stream) => {
+        delete stream.compiled_stream;
+      });
+
+      return draft;
+    });
+
+    mutate(updatedPolicy);
+    hideConfirmationModal();
+  }, [hideConfirmationModal, item, mutate]);
+
+  const handleToggleActiveClick = useCallback(() => {
+    if (agentStatus?.total) {
+      return setConfirmationModal(true);
+    }
+
+    handleToggleActive();
+  }, [agentStatus?.total, handleToggleActive]);
+
+  return (
+    <>
+      {isLoading && <StyledEuiLoadingSpinner />}
+      <EuiSwitch
+        checked={item.enabled}
+        disabled={!hasSaveUICapabilities || isLoading}
+        showLabel={false}
+        label=""
+        onChange={handleToggleActiveClick}
+      />
+      {confirmationModal && agentStatus?.total && (
+        <ConfirmDeployAgentPolicyModal
+          onConfirm={handleToggleActive}
+          onCancel={hideConfirmationModal}
+          agentCount={agentStatus?.total}
+          agentPolicy={agentPolicy}
+        />
+      )}
+    </>
+  );
+};
+
+export const ActiveStateSwitch = React.memo(ActiveStateSwitchComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/add_query_flyout.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/add_query_flyout.tsx
new file mode 100644
index 00000000000000..b2cfa05e0fc633
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/add_query_flyout.tsx
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiFlyout,
+  EuiTitle,
+  EuiSpacer,
+  EuiFlyoutBody,
+  EuiFlyoutHeader,
+  EuiFlyoutFooter,
+  EuiPortal,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiButton,
+} from '@elastic/eui';
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+
+import { CodeEditorField } from '../../queries/form/code_editor_field';
+import { Form, useForm, FormData, getUseField, Field, FIELD_TYPES } from '../../shared_imports';
+
+const FORM_ID = 'addQueryFlyoutForm';
+
+const CommonUseField = getUseField({ component: Field });
+
+interface AddQueryFlyoutProps {
+  onSave: (payload: FormData) => Promise<void>;
+  onClose: () => void;
+}
+
+const AddQueryFlyoutComponent: React.FC<AddQueryFlyoutProps> = ({ onSave, onClose }) => {
+  const { form } = useForm({
+    id: FORM_ID,
+    // @ts-expect-error update types
+    onSubmit: (payload, isValid) => {
+      if (isValid) {
+        onSave(payload);
+        onClose();
+      }
+    },
+    schema: {
+      id: {
+        type: FIELD_TYPES.TEXT,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.queryFlyoutForm.idFieldLabel', {
+          defaultMessage: 'ID',
+        }),
+      },
+      query: {
+        type: FIELD_TYPES.TEXT,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.queryFlyoutForm.queryFieldLabel', {
+          defaultMessage: 'Query',
+        }),
+      },
+      interval: {
+        type: FIELD_TYPES.NUMBER,
+        label: i18n.translate(
+          'xpack.osquery.scheduledQueryGroup.queryFlyoutForm.intervalFieldLabel',
+          {
+            defaultMessage: 'Interval (s)',
+          }
+        ),
+      },
+    },
+  });
+
+  const { submit } = form;
+
+  return (
+    <EuiPortal>
+      <EuiFlyout size="s" ownFocus onClose={onClose} aria-labelledby="flyoutTitle">
+        <EuiFlyoutHeader hasBorder>
+          <EuiTitle size="s">
+            <h2 id="flyoutTitle">
+              <FormattedMessage
+                id="xpack.osquery.scheduleQueryGroup.queryFlyoutForm.addFormTitle"
+                defaultMessage="Attach next query"
+              />
+            </h2>
+          </EuiTitle>
+        </EuiFlyoutHeader>
+        <EuiFlyoutBody>
+          <Form form={form}>
+            <CommonUseField path="id" />
+            <EuiSpacer />
+            <CommonUseField path="query" component={CodeEditorField} />
+            <EuiSpacer />
+            {
+              // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+              <CommonUseField path="interval" euiFieldProps={{ append: 's' }} />
+            }
+          </Form>
+        </EuiFlyoutBody>
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="spaceBetween">
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty iconType="cross" onClick={onClose} flush="left">
+                <FormattedMessage
+                  id="xpack.osquery.scheduledQueryGroup.queryFlyoutForm.cancelButtonLabel"
+                  defaultMessage="Cancel"
+                />
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton onClick={submit} fill>
+                <FormattedMessage
+                  id="xpack.osquery.scheduledQueryGroup.queryFlyoutForm.saveButtonLabel"
+                  defaultMessage="Save"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    </EuiPortal>
+  );
+};
+
+export const AddQueryFlyout = React.memo(AddQueryFlyoutComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/confirmation_modal.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/confirmation_modal.tsx
new file mode 100644
index 00000000000000..e6860384308297
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/confirmation_modal.tsx
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiCallOut, EuiConfirmModal, EuiSpacer } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+
+import { AgentPolicy } from '../../../../fleet/common';
+
+interface ConfirmDeployAgentPolicyModalProps {
+  onConfirm: () => void;
+  onCancel: () => void;
+  agentCount: number;
+  agentPolicy: AgentPolicy;
+}
+
+const ConfirmDeployAgentPolicyModalComponent: React.FC<ConfirmDeployAgentPolicyModalProps> = ({
+  onConfirm,
+  onCancel,
+  agentCount,
+  agentPolicy,
+}) => (
+  <EuiConfirmModal
+    title={
+      <FormattedMessage
+        id="xpack.osquery.agentPolicy.confirmModalTitle"
+        defaultMessage="Save and deploy changes"
+      />
+    }
+    onCancel={onCancel}
+    onConfirm={onConfirm}
+    cancelButtonText={
+      <FormattedMessage
+        id="xpack.osquery.agentPolicy.confirmModalCancelButtonLabel"
+        defaultMessage="Cancel"
+      />
+    }
+    confirmButtonText={
+      <FormattedMessage
+        id="xpack.osquery.agentPolicy.confirmModalConfirmButtonLabel"
+        defaultMessage="Save and deploy changes"
+      />
+    }
+    buttonColor="primary"
+  >
+    <EuiCallOut
+      iconType="iInCircle"
+      title={i18n.translate('xpack.osquery.agentPolicy.confirmModalCalloutTitle', {
+        defaultMessage:
+          'This action will update {agentCount, plural, one {# agent} other {# agents}}',
+        values: {
+          agentCount,
+        },
+      })}
+    >
+      <div className="eui-textBreakWord">
+        <FormattedMessage
+          id="xpack.osquery.agentPolicy.confirmModalCalloutDescription"
+          defaultMessage="Fleet has detected that the selected agent policy, {policyName}, is already in use by
+            some of your agents. As a result of this action, Fleet will deploy updates to all agents
+            that use this policy."
+          // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+          values={{
+            policyName: <b>{agentPolicy.name}</b>,
+          }}
+        />
+      </div>
+    </EuiCallOut>
+    <EuiSpacer size="l" />
+    <FormattedMessage
+      id="xpack.osquery.agentPolicy.confirmModalDescription"
+      defaultMessage="This action can not be undone. Are you sure you wish to continue?"
+    />
+  </EuiConfirmModal>
+);
+
+export const ConfirmDeployAgentPolicyModal = React.memo(ConfirmDeployAgentPolicyModalComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/edit_query_flyout.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/edit_query_flyout.tsx
new file mode 100644
index 00000000000000..41846636eccd4d
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/edit_query_flyout.tsx
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiFlyout,
+  EuiTitle,
+  EuiSpacer,
+  EuiFlyoutBody,
+  EuiFlyoutHeader,
+  EuiFlyoutFooter,
+  EuiPortal,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiButton,
+} from '@elastic/eui';
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+
+import { PackagePolicyInputStream } from '../../../../fleet/common';
+import { CodeEditorField } from '../../queries/form/code_editor_field';
+import { Form, useForm, getUseField, Field, FIELD_TYPES } from '../../shared_imports';
+
+const FORM_ID = 'editQueryFlyoutForm';
+
+const CommonUseField = getUseField({ component: Field });
+
+interface EditQueryFlyoutProps {
+  defaultValue: PackagePolicyInputStream;
+  onSave: (payload: FormData) => void;
+  onClose: () => void;
+}
+
+export const EditQueryFlyout: React.FC<EditQueryFlyoutProps> = ({
+  defaultValue,
+  onSave,
+  onClose,
+}) => {
+  const { form } = useForm({
+    id: FORM_ID,
+    // @ts-expect-error update types
+    onSubmit: (payload, isValid) => {
+      if (isValid) {
+        // @ts-expect-error update types
+        onSave(payload);
+        onClose();
+      }
+      return;
+    },
+    defaultValue,
+    deserializer: (payload) => ({
+      id: payload.vars.id.value,
+      query: payload.vars.query.value,
+      interval: payload.vars.interval.value,
+    }),
+    schema: {
+      id: {
+        type: FIELD_TYPES.TEXT,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.queryFlyoutForm.idFieldLabel', {
+          defaultMessage: 'ID',
+        }),
+      },
+      query: {
+        type: FIELD_TYPES.TEXT,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.queryFlyoutForm.queryFieldLabel', {
+          defaultMessage: 'Query',
+        }),
+      },
+      interval: {
+        type: FIELD_TYPES.NUMBER,
+        label: i18n.translate(
+          'xpack.osquery.scheduledQueryGroup.queryFlyoutForm.intervalFieldLabel',
+          {
+            defaultMessage: 'Interval (s)',
+          }
+        ),
+      },
+    },
+  });
+
+  const { submit } = form;
+
+  return (
+    <EuiPortal>
+      <EuiFlyout size="s" ownFocus onClose={onClose} aria-labelledby="flyoutTitle">
+        <EuiFlyoutHeader hasBorder>
+          <EuiTitle size="s">
+            <h2 id="flyoutTitle">
+              <FormattedMessage
+                id="xpack.osquery.scheduleQueryGroup.queryFlyoutForm.editFormTitle"
+                defaultMessage="Edit query"
+              />
+            </h2>
+          </EuiTitle>
+        </EuiFlyoutHeader>
+        <EuiFlyoutBody>
+          <Form form={form}>
+            <CommonUseField path="id" />
+            <EuiSpacer />
+            <CommonUseField path="query" component={CodeEditorField} />
+            <EuiSpacer />
+            {
+              // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+              <CommonUseField path="interval" euiFieldProps={{ append: 's' }} />
+            }
+          </Form>
+        </EuiFlyoutBody>
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="spaceBetween">
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty iconType="cross" onClick={onClose} flush="left">
+                <FormattedMessage
+                  id="xpack.osquery.scheduledQueryGroup.queryFlyoutForm.cancelButtonLabel"
+                  defaultMessage="Cancel"
+                />
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton onClick={submit} fill>
+                <FormattedMessage
+                  id="xpack.osquery.scheduledQueryGroup.queryFlyoutForm.saveButtonLabel"
+                  defaultMessage="Save"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    </EuiPortal>
+  );
+};
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/index.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/index.tsx
new file mode 100644
index 00000000000000..68652e13bed074
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/index.tsx
@@ -0,0 +1,339 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { mapKeys } from 'lodash';
+import { merge } from 'lodash/fp';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiButton,
+  EuiDescribedFormGroup,
+  EuiSpacer,
+  EuiAccordion,
+  EuiBottomBar,
+  EuiHorizontalRule,
+} from '@elastic/eui';
+import React, { useCallback, useMemo, useState } from 'react';
+import { useMutation } from 'react-query';
+import { produce } from 'immer';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import {
+  AgentPolicy,
+  PackagePolicy,
+  PackagePolicyPackage,
+  packagePolicyRouteService,
+} from '../../../../fleet/common';
+import { Form, useForm, useFormData, getUseField, Field, FIELD_TYPES } from '../../shared_imports';
+import { useKibana, useRouterNavigate } from '../../common/lib/kibana';
+import { PolicyIdComboBoxField } from './policy_id_combobox_field';
+import { QueriesField } from './queries_field';
+import { ConfirmDeployAgentPolicyModal } from './confirmation_modal';
+import { useAgentPolicies } from '../../agent_policies';
+
+const GhostFormField = () => <></>;
+
+const FORM_ID = 'scheduledQueryForm';
+
+const CommonUseField = getUseField({ component: Field });
+
+interface ScheduledQueryGroupFormProps {
+  defaultValue?: PackagePolicy;
+  packageInfo?: PackagePolicyPackage;
+  editMode?: boolean;
+}
+
+const ScheduledQueryGroupFormComponent: React.FC<ScheduledQueryGroupFormProps> = ({
+  defaultValue,
+  packageInfo,
+  editMode = false,
+}) => {
+  const {
+    application: { navigateToApp },
+    http,
+    notifications: { toasts },
+  } = useKibana().services;
+  const [showConfirmationModal, setShowConfirmationModal] = useState(false);
+  const handleHideConfirmationModal = useCallback(() => setShowConfirmationModal(false), []);
+
+  const { data: agentPolicies } = useAgentPolicies();
+  const agentPoliciesById = mapKeys(agentPolicies, 'id');
+  const agentPolicyOptions = useMemo(
+    () =>
+      agentPolicies?.map((agentPolicy) => ({
+        key: agentPolicy.id,
+        label: agentPolicy.id,
+      })) ?? [],
+    [agentPolicies]
+  );
+
+  const cancelButtonProps = useRouterNavigate(
+    `scheduled_query_groups/${editMode ? defaultValue?.id : ''}`
+  );
+
+  const { isLoading, mutateAsync } = useMutation(
+    (payload: Record<string, unknown>) =>
+      editMode && defaultValue?.id
+        ? http.put(packagePolicyRouteService.getUpdatePath(defaultValue.id), {
+            body: JSON.stringify(payload),
+          })
+        : http.post(packagePolicyRouteService.getCreatePath(), {
+            body: JSON.stringify(payload),
+          }),
+    {
+      onSuccess: (data) => {
+        if (!editMode) {
+          navigateToApp('osquery', { path: `scheduled_query_groups/${data.item.id}` });
+          toasts.addSuccess(
+            i18n.translate('xpack.osquery.scheduledQueryGroup.form.createSuccessToastMessageText', {
+              defaultMessage: 'Successfully scheduled {scheduledQueryGroupName}',
+              values: {
+                scheduledQueryGroupName: data.item.name,
+              },
+            })
+          );
+          return;
+        }
+
+        navigateToApp('osquery', { path: `scheduled_query_groups/${data.item.id}` });
+        toasts.addSuccess(
+          i18n.translate('xpack.osquery.scheduledQueryGroup.form.updateSuccessToastMessageText', {
+            defaultMessage: 'Successfully updated {scheduledQueryGroupName}',
+            values: {
+              scheduledQueryGroupName: data.item.name,
+            },
+          })
+        );
+      },
+      onError: (error) => {
+        // @ts-expect-error update types
+        toasts.addError(error, { title: error.body.error, toastMessage: error.body.message });
+      },
+    }
+  );
+
+  const { form } = useForm({
+    id: FORM_ID,
+    schema: {
+      name: {
+        type: FIELD_TYPES.TEXT,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.form.nameFieldLabel', {
+          defaultMessage: 'Name',
+        }),
+      },
+      description: {
+        type: FIELD_TYPES.TEXT,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.form.descriptionFieldLabel', {
+          defaultMessage: 'Description',
+        }),
+      },
+      namespace: {
+        type: FIELD_TYPES.COMBO_BOX,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.form.namespaceFieldLabel', {
+          defaultMessage: 'Namespace',
+        }),
+      },
+      policy_id: {
+        type: FIELD_TYPES.COMBO_BOX,
+        label: i18n.translate('xpack.osquery.scheduledQueryGroup.form.agentPolicyFieldLabel', {
+          defaultMessage: 'Agent policy',
+        }),
+      },
+    },
+    onSubmit: (payload) => {
+      const formData = produce(payload, (draft) => {
+        // @ts-expect-error update types
+        draft.inputs[0].streams.forEach((stream) => {
+          delete stream.compiled_stream;
+        });
+        return draft;
+      });
+      return mutateAsync(formData);
+    },
+    options: {
+      stripEmptyFields: false,
+    },
+    // @ts-expect-error update types
+    deserializer: (payload) => ({
+      ...payload,
+      policy_id: payload.policy_id.length ? [payload.policy_id] : [],
+      namespace: [payload.namespace],
+    }),
+    serializer: (payload) => ({
+      ...payload,
+      // @ts-expect-error update types
+      policy_id: payload.policy_id[0],
+      // @ts-expect-error update types
+      namespace: payload.namespace[0],
+    }),
+    defaultValue: merge(
+      {
+        name: '',
+        description: '',
+        enabled: true,
+        policy_id: [],
+        namespace: 'default',
+        output_id: '',
+        package: packageInfo,
+        inputs: [
+          {
+            type: 'osquery',
+            enabled: true,
+            streams: [],
+          },
+        ],
+      },
+      defaultValue ?? {}
+    ),
+  });
+
+  const { submit } = form;
+
+  const policyIdEuiFieldProps = useMemo(
+    () => ({ isDisabled: !!defaultValue, options: agentPolicyOptions }),
+    [defaultValue, agentPolicyOptions]
+  );
+
+  const [{ policy_id: policyId }] = useFormData({ form, watch: ['policy_id'] });
+
+  const currentPolicy = useMemo(() => {
+    if (!policyId) {
+      return {
+        agentCount: 0,
+        agentPolicy: {} as AgentPolicy,
+      };
+    }
+
+    const currentAgentPolicy = agentPoliciesById[policyId[0]];
+    return {
+      agentCount: currentAgentPolicy?.agents ?? 0,
+      agentPolicy: currentAgentPolicy,
+    };
+  }, [agentPoliciesById, policyId]);
+
+  const handleSaveClick = useCallback(() => {
+    if (currentPolicy.agentCount) {
+      setShowConfirmationModal(true);
+      return;
+    }
+
+    submit();
+  }, [currentPolicy.agentCount, submit]);
+
+  const handleConfirmConfirmationClick = useCallback(() => {
+    submit();
+    setShowConfirmationModal(false);
+  }, [submit]);
+
+  return (
+    <>
+      <Form form={form}>
+        <EuiDescribedFormGroup
+          title={
+            <h3>
+              <FormattedMessage
+                id="xpack.osquery.scheduledQueryGroup.form.settingsSectionTitleText"
+                defaultMessage="Scheduled query group settings"
+              />
+            </h3>
+          }
+          fullWidth
+          description={
+            <FormattedMessage
+              id="xpack.osquery.scheduledQueryGroup.form.settingsSectionDescriptionText"
+              defaultMessage="Scheduled query groups include one or more queries that are run
+                at a set interval and are associated with an agent policy.
+                When you define a scheduled query group, it is added as a new
+                Osquery Manager policy."
+            />
+          }
+        >
+          <CommonUseField path="name" />
+
+          <CommonUseField path="description" />
+
+          <CommonUseField
+            path="policy_id"
+            euiFieldProps={policyIdEuiFieldProps}
+            component={PolicyIdComboBoxField}
+            agentPoliciesById={agentPoliciesById}
+          />
+
+          <EuiSpacer />
+          <EuiAccordion
+            id="accordion1"
+            buttonContent={i18n.translate(
+              'xpack.osquery.scheduledQueryGroup.form.advancedSectionToggleButtonLabel',
+              { defaultMessage: 'Advanced' }
+            )}
+          >
+            <CommonUseField path="namespace" />
+          </EuiAccordion>
+        </EuiDescribedFormGroup>
+
+        <EuiHorizontalRule />
+
+        <CommonUseField
+          path="inputs"
+          component={QueriesField}
+          scheduledQueryGroupId={defaultValue?.id ?? null}
+        />
+
+        <CommonUseField path="enabled" component={GhostFormField} />
+        <CommonUseField path="output_id" component={GhostFormField} />
+        <CommonUseField path="package" component={GhostFormField} />
+      </Form>
+      <EuiSpacer size="xxl" />
+      <EuiSpacer size="xxl" />
+      <EuiSpacer size="xxl" />
+      <EuiSpacer size="xxl" />
+      <EuiSpacer size="xxl" />
+      <EuiBottomBar>
+        <EuiFlexGroup justifyContent="flexEnd">
+          <EuiFlexItem grow={false}>
+            <EuiFlexGroup gutterSize="m">
+              <EuiFlexItem grow={false}>
+                <EuiButtonEmpty color="ghost" {...cancelButtonProps}>
+                  <FormattedMessage
+                    id="xpack.osquery.scheduledQueryGroup.form.cancelButtonLabel"
+                    defaultMessage="Cancel"
+                  />
+                </EuiButtonEmpty>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiButton
+                  isLoading={isLoading}
+                  color="primary"
+                  fill
+                  size="m"
+                  iconType="save"
+                  onClick={handleSaveClick}
+                >
+                  <FormattedMessage
+                    id="xpack.osquery.scheduledQueryGroup.form.saveQueryButtonLabel"
+                    defaultMessage="Save query"
+                  />
+                </EuiButton>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiBottomBar>
+      {showConfirmationModal && (
+        <ConfirmDeployAgentPolicyModal
+          onCancel={handleHideConfirmationModal}
+          onConfirm={handleConfirmConfirmationClick}
+          {...currentPolicy}
+        />
+      )}
+    </>
+  );
+};
+
+export const ScheduledQueryGroupForm = React.memo(ScheduledQueryGroupFormComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/pack_uploader.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/pack_uploader.tsx
new file mode 100644
index 00000000000000..f8c6f8ca263e27
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/pack_uploader.tsx
@@ -0,0 +1,142 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { mapKeys, kebabCase } from 'lodash';
+import { EuiLink, EuiFormRow, EuiFilePicker, EuiSpacer } from '@elastic/eui';
+import React, { useCallback, useState, useRef } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+const SUPPORTED_PACK_EXTENSIONS = ['application/json', 'text/plain'];
+
+const ExamplePackLink = React.memo(() => (
+  <EuiLink href="https://github.com/osquery/osquery/tree/master/packs" target="_blank">
+    <FormattedMessage
+      id="xpack.osquery.packUploader.examplePacksLinkLabel"
+      defaultMessage="Example packs"
+    />
+  </EuiLink>
+));
+
+ExamplePackLink.displayName = 'ExamplePackLink';
+
+interface OsqueryPackUploaderProps {
+  onChange: (payload: Record<string, unknown>) => void;
+}
+
+const OsqueryPackUploaderComponent: React.FC<OsqueryPackUploaderProps> = ({ onChange }) => {
+  const packName = useRef('');
+  const filePickerRef = useRef<EuiFilePicker>(null);
+  const [isInvalid, setIsInvalid] = useState<string | null>(null);
+  // @ts-expect-error update types
+  let fileReader;
+
+  const handleFileRead = () => {
+    // @ts-expect-error update types
+    const content = fileReader.result;
+
+    let parsedContent;
+
+    try {
+      parsedContent = JSON.parse(content.replaceAll('\\\n', ''), (key, value) => {
+        if (key === 'query') {
+          // remove any multiple spaces from the query
+          return value.replaceAll(/\s(?=\s)/gm, '');
+        }
+        return value;
+      });
+
+      setIsInvalid(null);
+    } catch (error) {
+      setIsInvalid(error);
+      // @ts-expect-error update types
+      filePickerRef.current?.removeFiles(new Event('fake'));
+    }
+
+    if (!parsedContent?.queries) {
+      return;
+    }
+
+    const queriesJSON = mapKeys(
+      parsedContent?.queries,
+      (value, key) => `pack_${packName.current}_${key}`
+    );
+
+    onChange(queriesJSON);
+    // @ts-expect-error update types
+    filePickerRef.current?.removeFiles(new Event('fake'));
+  };
+
+  // @ts-expect-error update types
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  const handleFileChosen = (file) => {
+    fileReader = new FileReader();
+    fileReader.onloadend = handleFileRead;
+    fileReader.readAsText(file);
+  };
+
+  const handleInputChange = useCallback(
+    (inputFiles) => {
+      if (!inputFiles.length) {
+        packName.current = '';
+        return;
+      }
+
+      if (
+        inputFiles.length &&
+        ((!!inputFiles[0].type.length && !SUPPORTED_PACK_EXTENSIONS.includes(inputFiles[0].type)) ||
+          !inputFiles[0].name.endsWith('.conf'))
+      ) {
+        packName.current = '';
+        setIsInvalid(
+          i18n.translate('xpack.osquery.packUploader.unsupportedFileTypeText', {
+            defaultMessage:
+              'File type {fileType} is not supported, please upload {supportedFileTypes} config file',
+            values: {
+              fileType: inputFiles[0].type,
+              supportedFileTypes: SUPPORTED_PACK_EXTENSIONS.join(' or '),
+            },
+          })
+        );
+        // @ts-expect-error update types
+        filePickerRef.current?.removeFiles(new Event('fake'));
+        return;
+      }
+
+      packName.current = kebabCase(inputFiles[0].name.split('.')[0]);
+      handleFileChosen(inputFiles[0]);
+    },
+    [handleFileChosen]
+  );
+
+  return (
+    <>
+      <EuiSpacer size="xl" />
+      <EuiFormRow
+        fullWidth
+        labelAppend={<ExamplePackLink />}
+        isInvalid={!!isInvalid}
+        error={<>{`${isInvalid}`}</>}
+      >
+        <EuiFilePicker
+          ref={filePickerRef}
+          id="osquery_pack_picker"
+          initialPromptText={i18n.translate('xpack.osquery.packUploader.initialPromptTextLabel', {
+            defaultMessage: 'Select or drag and drop osquery pack config file',
+          })}
+          onChange={handleInputChange}
+          display="large"
+          fullWidth
+          isInvalid={!!isInvalid}
+          accept={SUPPORTED_PACK_EXTENSIONS.join(',')}
+        />
+      </EuiFormRow>
+    </>
+  );
+};
+
+export const OsqueryPackUploader = React.memo(OsqueryPackUploaderComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/policy_id_combobox_field.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/policy_id_combobox_field.tsx
new file mode 100644
index 00000000000000..75bb95b198f545
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/policy_id_combobox_field.tsx
@@ -0,0 +1,121 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiFlexGroup, EuiFlexItem, EuiTextColor, EuiComboBoxOptionOption } from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
+import styled from 'styled-components';
+
+import { GetAgentPoliciesResponseItem } from '../../../../fleet/common';
+import { ComboBoxField, FieldHook } from '../../shared_imports';
+
+// Custom styling for drop down list items due to:
+//  1) the max-width and overflow properties is added to prevent long agent policy
+//     names/descriptions from overflowing the flex items
+//  2) max-width is built from the grow property on the flex items because the value
+//     changes based on if Fleet is enabled/setup or not
+const AgentPolicyNameColumn = styled(EuiFlexItem)`
+  max-width: ${(props) => `${((props.grow as number) / 9) * 100}%`};
+  overflow: hidden;
+`;
+const AgentPolicyDescriptionColumn = styled(EuiFlexItem)`
+  max-width: ${(props) => `${((props.grow as number) / 9) * 100}%`};
+  overflow: hidden;
+`;
+
+type ComboBoxFieldProps = Parameters<typeof ComboBoxField>[0];
+
+type PolicyIdComboBoxFieldProps = Pick<ComboBoxFieldProps, 'euiFieldProps'> & {
+  field: FieldHook<string[]>;
+  agentPoliciesById: Record<string, GetAgentPoliciesResponseItem>;
+};
+
+const PolicyIdComboBoxFieldComponent: React.FC<PolicyIdComboBoxFieldProps> = ({
+  euiFieldProps,
+  field,
+  agentPoliciesById,
+}) => {
+  const { value } = field;
+
+  const renderOption = useCallback(
+    (option: EuiComboBoxOptionOption<string>) => (
+      <EuiFlexGroup>
+        <AgentPolicyNameColumn grow={2}>
+          <span className="eui-textTruncate">
+            {(option.key && agentPoliciesById[option.key]?.name) ?? option.label}
+          </span>
+        </AgentPolicyNameColumn>
+        <AgentPolicyDescriptionColumn grow={5}>
+          <EuiTextColor className="eui-textTruncate" color="subdued">
+            {(option.key && agentPoliciesById[option.key].description) ?? ''}
+          </EuiTextColor>
+        </AgentPolicyDescriptionColumn>
+        <EuiFlexItem grow={2} className="eui-textRight">
+          <EuiTextColor color="subdued">
+            <FormattedMessage
+              id="xpack.osquery.createScheduledQuery.agentPolicyAgentsCountText"
+              defaultMessage="{count, plural, one {# agent} other {# agents}} enrolled"
+              // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+              values={{
+                count: (option.key && agentPoliciesById[option.key]?.agents) ?? 0,
+              }}
+            />
+          </EuiTextColor>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    [agentPoliciesById]
+  );
+
+  const selectedOptions = useMemo(() => {
+    if (!value?.length || !value[0].length) return [];
+
+    return value.map((policyId) => ({
+      label: agentPoliciesById[policyId]?.name ?? policyId,
+    }));
+  }, [agentPoliciesById, value]);
+
+  const helpText = useMemo(() => {
+    if (!value?.length || !value[0].length || !agentPoliciesById || !agentPoliciesById[value[0]])
+      return;
+
+    return (
+      <FormattedMessage
+        id="xpack.osquery.createScheduledQuery.agentPolicyAgentsCountText"
+        defaultMessage="{count, plural, one {# agent} other {# agents}} enrolled"
+        // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+        values={{
+          count: agentPoliciesById[value[0]].agents ?? 0,
+        }}
+      />
+    );
+  }, [agentPoliciesById, value]);
+
+  const mergedEuiFieldProps = useMemo(
+    () => ({
+      onCreateOption: null,
+      singleSelection: { asPlainText: true },
+      noSuggestions: false,
+      isClearable: false,
+      selectedOptions,
+      renderOption,
+      ...euiFieldProps,
+    }),
+    [euiFieldProps, renderOption, selectedOptions]
+  );
+
+  return (
+    <ComboBoxField
+      field={field as FieldHook}
+      fullWidth={true}
+      helpText={helpText}
+      euiFieldProps={mergedEuiFieldProps}
+    />
+  );
+};
+
+export const PolicyIdComboBoxField = React.memo(PolicyIdComboBoxFieldComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/form/queries_field.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/form/queries_field.tsx
new file mode 100644
index 00000000000000..7d5a2c5ac99ce6
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/form/queries_field.tsx
@@ -0,0 +1,190 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { findIndex, forEach, pullAt } from 'lodash';
+import { EuiFlexGroup, EuiFlexItem, EuiButton, EuiSpacer } from '@elastic/eui';
+import { produce } from 'immer';
+import React, { useCallback, useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { PackagePolicyInput, PackagePolicyInputStream } from '../../../../fleet/common';
+import { OSQUERY_INTEGRATION_NAME } from '../../../common';
+import { FieldHook } from '../../shared_imports';
+import { ScheduledQueryGroupQueriesTable } from '../scheduled_query_group_queries_table';
+import { AddQueryFlyout } from './add_query_flyout';
+import { EditQueryFlyout } from './edit_query_flyout';
+import { OsqueryPackUploader } from './pack_uploader';
+
+interface QueriesFieldProps {
+  field: FieldHook<PackagePolicyInput[]>;
+  scheduledQueryGroupId: string;
+}
+
+interface GetNewStreamProps {
+  id: string;
+  interval: string;
+  query: string;
+  scheduledQueryGroupId?: string;
+}
+
+const getNewStream = ({ id, interval, query, scheduledQueryGroupId }: GetNewStreamProps) => ({
+  data_stream: { type: 'logs', dataset: `${OSQUERY_INTEGRATION_NAME}.result` },
+  enabled: true,
+  id: scheduledQueryGroupId
+    ? `osquery-${OSQUERY_INTEGRATION_NAME}.result-${scheduledQueryGroupId}`
+    : null,
+  vars: {
+    id: { type: 'text', value: id },
+    interval: {
+      type: 'integer',
+      value: interval,
+    },
+    query: { type: 'text', value: query },
+  },
+});
+
+const QueriesFieldComponent: React.FC<QueriesFieldProps> = ({ field, scheduledQueryGroupId }) => {
+  const [showAddQueryFlyout, setShowAddQueryFlyout] = useState(false);
+  const [showEditQueryFlyout, setShowEditQueryFlyout] = useState<number>(-1);
+
+  const handleShowAddFlyout = useCallback(() => setShowAddQueryFlyout(true), []);
+  const handleHideAddFlyout = useCallback(() => setShowAddQueryFlyout(false), []);
+  const handleHideEditFlyout = useCallback(() => setShowEditQueryFlyout(-1), []);
+
+  const { setValue } = field;
+
+  const handleDeleteClick = useCallback(
+    (stream: PackagePolicyInputStream) => {
+      const streamIndex = findIndex(field.value[0].streams, [
+        'vars.id.value',
+        stream.vars?.id.value,
+      ]);
+
+      if (streamIndex > -1) {
+        setValue(
+          produce((draft) => {
+            pullAt(draft[0].streams, [streamIndex]);
+
+            return draft;
+          })
+        );
+      }
+    },
+    [field.value, setValue]
+  );
+
+  const handleEditClick = useCallback(
+    (stream: PackagePolicyInputStream) => {
+      const streamIndex = findIndex(field.value[0].streams, [
+        'vars.id.value',
+        stream.vars?.id.value,
+      ]);
+
+      setShowEditQueryFlyout(streamIndex);
+    },
+    [field.value]
+  );
+
+  const handleEditQuery = useCallback(
+    (updatedQuery) => {
+      if (showEditQueryFlyout >= 0) {
+        setValue(
+          produce((draft) => {
+            draft[0].streams[showEditQueryFlyout].vars.id.value = updatedQuery.id;
+            draft[0].streams[showEditQueryFlyout].vars.interval.value = updatedQuery.interval;
+            draft[0].streams[showEditQueryFlyout].vars.query.value = updatedQuery.query;
+
+            return draft;
+          })
+        );
+      }
+
+      handleHideEditFlyout();
+    },
+    [handleHideEditFlyout, setValue, showEditQueryFlyout]
+  );
+
+  const handleAddQuery = useCallback(
+    (newQuery) => {
+      setValue(
+        produce((draft) => {
+          draft[0].streams.push(
+            getNewStream({
+              ...newQuery,
+              scheduledQueryGroupId,
+            })
+          );
+          return draft;
+        })
+      );
+      handleHideAddFlyout();
+    },
+    [handleHideAddFlyout, scheduledQueryGroupId, setValue]
+  );
+
+  const handlePackUpload = useCallback(
+    (newQueries) => {
+      setValue(
+        produce((draft) => {
+          forEach(newQueries, (newQuery, newQueryId) => {
+            draft[0].streams.push(
+              getNewStream({
+                id: newQueryId,
+                interval: newQuery.interval,
+                query: newQuery.query,
+                scheduledQueryGroupId,
+              })
+            );
+          });
+
+          return draft;
+        })
+      );
+    },
+    [scheduledQueryGroupId, setValue]
+  );
+
+  return (
+    <>
+      <EuiFlexGroup justifyContent="flexEnd">
+        <EuiFlexItem grow={false}>
+          <EuiButton fill onClick={handleShowAddFlyout} iconType="plusInCircle">
+            <FormattedMessage
+              id="xpack.osquery.scheduledQueryGroup.queriesForm.addQueryButtonLabel"
+              defaultMessage="Add query"
+            />
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer />
+      {field.value && field.value[0].streams?.length ? (
+        <ScheduledQueryGroupQueriesTable
+          editMode={true}
+          // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+          data={{ inputs: field.value }}
+          onEditClick={handleEditClick}
+          onDeleteClick={handleDeleteClick}
+        />
+      ) : null}
+      <EuiSpacer />
+      {<OsqueryPackUploader onChange={handlePackUpload} />}
+      {showAddQueryFlyout && (
+        // @ts-expect-error update types
+        <AddQueryFlyout onSave={handleAddQuery} onClose={handleHideAddFlyout} />
+      )}
+      {showEditQueryFlyout != null && showEditQueryFlyout >= 0 && (
+        <EditQueryFlyout
+          defaultValue={field.value[0].streams[showEditQueryFlyout]}
+          onSave={handleEditQuery}
+          onClose={handleHideEditFlyout}
+        />
+      )}
+    </>
+  );
+};
+
+export const QueriesField = React.memo(QueriesFieldComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/index.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/index.tsx
new file mode 100644
index 00000000000000..f97127a9465584
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/index.tsx
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './scheduled_query_groups_table';
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx
new file mode 100644
index 00000000000000..d501f56b789d75
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_group_queries_table.tsx
@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useEffect, useState, useMemo } from 'react';
+import { EuiInMemoryTable, EuiCodeBlock, EuiButtonIcon } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { PackagePolicy, PackagePolicyInputStream } from '../../../fleet/common';
+import { FilterStateStore } from '../../../../../src/plugins/data/common';
+import { useKibana } from '../common/lib/kibana';
+
+interface ViewResultsInDiscoverActionProps {
+  item: PackagePolicyInputStream;
+}
+
+const ViewResultsInDiscoverAction: React.FC<ViewResultsInDiscoverActionProps> = ({ item }) => {
+  const urlGenerator = useKibana().services.discover?.urlGenerator;
+  const [discoverUrl, setDiscoverUrl] = useState<string>('');
+
+  useEffect(() => {
+    const getDiscoverUrl = async () => {
+      if (!urlGenerator?.createUrl) return;
+
+      const newUrl = await urlGenerator.createUrl({
+        indexPatternId: 'logs-*',
+        filters: [
+          {
+            meta: {
+              index: 'logs-*',
+              alias: null,
+              negate: false,
+              disabled: false,
+              type: 'phrase',
+              key: 'action_id',
+              params: { query: item.vars?.id.value },
+            },
+            query: { match_phrase: { action_id: item.vars?.id.value } },
+            $state: { store: FilterStateStore.APP_STATE },
+          },
+        ],
+      });
+      setDiscoverUrl(newUrl);
+    };
+    getDiscoverUrl();
+  }, [item.vars?.id.value, urlGenerator]);
+
+  return (
+    <EuiButtonIcon
+      iconType="visTable"
+      href={discoverUrl}
+      aria-label={i18n.translate(
+        'xpack.osquery.scheduledQueryGroup.queriesTable.viewDiscoverResultsActionAriaLabel',
+        {
+          defaultMessage: 'Check results of {queryName} in Discover',
+          values: {
+            queryName: item.vars?.id.value,
+          },
+        }
+      )}
+    />
+  );
+};
+
+interface ScheduledQueryGroupQueriesTableProps {
+  data: Pick<PackagePolicy, 'inputs'>;
+  editMode?: boolean;
+  onDeleteClick?: (item: PackagePolicyInputStream) => void;
+  onEditClick?: (item: PackagePolicyInputStream) => void;
+}
+
+const ScheduledQueryGroupQueriesTableComponent: React.FC<ScheduledQueryGroupQueriesTableProps> = ({
+  data,
+  editMode = false,
+  onDeleteClick,
+  onEditClick,
+}) => {
+  const renderDeleteAction = useCallback(
+    (item: PackagePolicyInputStream) => (
+      <EuiButtonIcon
+        color="danger"
+        // @ts-expect-error update types
+        // eslint-disable-next-line react/jsx-no-bind, react-perf/jsx-no-new-function-as-prop
+        onClick={() => onDeleteClick(item)}
+        iconType="trash"
+        aria-label={i18n.translate(
+          'xpack.osquery.scheduledQueryGroup.queriesTable.deleteActionAriaLabel',
+          {
+            defaultMessage: 'Delete {queryName}',
+            values: {
+              queryName: item.vars?.id.value,
+            },
+          }
+        )}
+      />
+    ),
+    [onDeleteClick]
+  );
+
+  const renderEditAction = useCallback(
+    (item: PackagePolicyInputStream) => (
+      <EuiButtonIcon
+        color="primary"
+        // @ts-expect-error update types
+        // eslint-disable-next-line react/jsx-no-bind, react-perf/jsx-no-new-function-as-prop
+        onClick={() => onEditClick(item)}
+        iconType="pencil"
+        aria-label={i18n.translate(
+          'xpack.osquery.scheduledQueryGroup.queriesTable.editActionAriaLabel',
+          {
+            defaultMessage: 'Edit {queryName}',
+            values: {
+              queryName: item.vars?.id.value,
+            },
+          }
+        )}
+      />
+    ),
+    [onEditClick]
+  );
+
+  const renderQueryColumn = useCallback(
+    (query: string) => (
+      <EuiCodeBlock language="sql" fontSize="s" paddingSize="none" transparentBackground>
+        {query}
+      </EuiCodeBlock>
+    ),
+    []
+  );
+
+  const renderDiscoverResultsAction = useCallback(
+    (item) => <ViewResultsInDiscoverAction item={item} />,
+    []
+  );
+
+  const columns = useMemo(
+    () => [
+      {
+        field: 'vars.id.value',
+        name: i18n.translate('xpack.osquery.scheduledQueryGroup.queriesTable.idColumnTitle', {
+          defaultMessage: 'ID',
+        }),
+        width: '20%',
+      },
+      {
+        field: 'vars.interval.value',
+        name: i18n.translate('xpack.osquery.scheduledQueryGroup.queriesTable.intervalColumnTitle', {
+          defaultMessage: 'Interval',
+        }),
+        width: '100px',
+      },
+      {
+        field: 'vars.query.value',
+        name: i18n.translate('xpack.osquery.scheduledQueryGroup.queriesTable.queryColumnTitle', {
+          defaultMessage: 'Query',
+        }),
+        render: renderQueryColumn,
+      },
+      {
+        name: editMode
+          ? i18n.translate('xpack.osquery.scheduledQueryGroup.queriesTable.actionsColumnTitle', {
+              defaultMessage: 'Actions',
+            })
+          : i18n.translate(
+              'xpack.osquery.scheduledQueryGroup.queriesTable.viewResultsColumnTitle',
+              {
+                defaultMessage: 'View results',
+              }
+            ),
+        width: '120px',
+        actions: editMode
+          ? [
+              {
+                render: renderEditAction,
+              },
+              {
+                render: renderDeleteAction,
+              },
+            ]
+          : [
+              {
+                render: renderDiscoverResultsAction,
+              },
+            ],
+      },
+    ],
+    [editMode, renderDeleteAction, renderDiscoverResultsAction, renderEditAction, renderQueryColumn]
+  );
+
+  const sorting = useMemo(
+    () => ({
+      sort: {
+        field: 'vars.id.value',
+        direction: 'asc' as const,
+      },
+    }),
+    []
+  );
+
+  return (
+    <EuiInMemoryTable<PackagePolicyInputStream>
+      items={data.inputs[0].streams}
+      itemId="vars.id.value"
+      isExpandable={true}
+      columns={columns}
+      sorting={sorting}
+    />
+  );
+};
+
+export const ScheduledQueryGroupQueriesTable = React.memo(ScheduledQueryGroupQueriesTableComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_groups_table.tsx b/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_groups_table.tsx
new file mode 100644
index 00000000000000..7b5f91157132e5
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/scheduled_query_groups_table.tsx
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiInMemoryTable, EuiBasicTableColumn, EuiLink } from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
+
+import { i18n } from '@kbn/i18n';
+import { PackagePolicy } from '../../../fleet/common';
+import { useRouterNavigate } from '../common/lib/kibana';
+import { useScheduledQueryGroups } from './use_scheduled_query_groups';
+import { ActiveStateSwitch } from './active_state_switch';
+import { AgentsPolicyLink } from '../agent_policies/agents_policy_link';
+
+const ScheduledQueryNameComponent = ({ id, name }: { id: string; name: string }) => (
+  <EuiLink {...useRouterNavigate(`scheduled_query_groups/${id}`)}>{name}</EuiLink>
+);
+
+const ScheduledQueryName = React.memo(ScheduledQueryNameComponent);
+
+const renderName = (_: unknown, item: PackagePolicy) => (
+  <ScheduledQueryName id={item.id} name={item.name} />
+);
+
+const ScheduledQueryGroupsTableComponent = () => {
+  const { data } = useScheduledQueryGroups();
+
+  const renderAgentPolicy = useCallback((policyId) => <AgentsPolicyLink policyId={policyId} />, []);
+
+  const renderQueries = useCallback(
+    (streams: PackagePolicy['inputs'][0]['streams']) => <>{streams.length}</>,
+    []
+  );
+
+  const renderActive = useCallback((_, item) => <ActiveStateSwitch item={item} />, []);
+
+  const columns: Array<EuiBasicTableColumn<PackagePolicy>> = useMemo(
+    () => [
+      {
+        field: 'name',
+        name: i18n.translate('xpack.osquery.scheduledQueryGroups.table.nameColumnTitle', {
+          defaultMessage: 'Name',
+        }),
+        sortable: true,
+        render: renderName,
+      },
+      {
+        field: 'policy_id',
+        name: i18n.translate('xpack.osquery.scheduledQueryGroups.table.policyColumnTitle', {
+          defaultMessage: 'Policy',
+        }),
+        truncateText: true,
+        render: renderAgentPolicy,
+      },
+      {
+        field: 'inputs[0].streams',
+        name: i18n.translate(
+          'xpack.osquery.scheduledQueryGroups.table.numberOfQueriesColumnTitle',
+          {
+            defaultMessage: 'Number of queries',
+          }
+        ),
+        render: renderQueries,
+        width: '150px',
+      },
+      {
+        field: 'enabled',
+        name: i18n.translate('xpack.osquery.scheduledQueryGroups.table.activeColumnTitle', {
+          defaultMessage: 'Active',
+        }),
+        sortable: true,
+        align: 'right',
+        width: '80px',
+        render: renderActive,
+      },
+    ],
+    [renderActive, renderAgentPolicy, renderQueries]
+  );
+
+  const sorting = useMemo(
+    () => ({
+      sort: {
+        field: 'name',
+        direction: 'asc' as const,
+      },
+    }),
+    []
+  );
+
+  return (
+    <EuiInMemoryTable<PackagePolicy>
+      // eslint-disable-next-line react-perf/jsx-no-new-array-as-prop
+      items={data?.items ?? []}
+      columns={columns}
+      pagination={true}
+      sorting={sorting}
+    />
+  );
+};
+
+export const ScheduledQueryGroupsTable = React.memo(ScheduledQueryGroupsTableComponent);
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/use_scheduled_query_group.ts b/x-pack/plugins/osquery/public/scheduled_query_groups/use_scheduled_query_group.ts
new file mode 100644
index 00000000000000..e0f892d0302c0c
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/use_scheduled_query_group.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useQuery } from 'react-query';
+
+import { useKibana } from '../common/lib/kibana';
+import {
+  GetOnePackagePolicyResponse,
+  PackagePolicy,
+  packagePolicyRouteService,
+} from '../../../fleet/common';
+
+interface UseScheduledQueryGroup {
+  scheduledQueryGroupId: string;
+  skip?: boolean;
+}
+
+export const useScheduledQueryGroup = ({
+  scheduledQueryGroupId,
+  skip = false,
+}: UseScheduledQueryGroup) => {
+  const { http } = useKibana().services;
+
+  return useQuery<GetOnePackagePolicyResponse, unknown, PackagePolicy>(
+    ['scheduledQueryGroup', { scheduledQueryGroupId }],
+    () => http.get(packagePolicyRouteService.getInfoPath(scheduledQueryGroupId)),
+    {
+      keepPreviousData: true,
+      enabled: !skip,
+      select: (response) => response.item,
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/scheduled_query_groups/use_scheduled_query_groups.ts b/x-pack/plugins/osquery/public/scheduled_query_groups/use_scheduled_query_groups.ts
new file mode 100644
index 00000000000000..3302d8e621eb79
--- /dev/null
+++ b/x-pack/plugins/osquery/public/scheduled_query_groups/use_scheduled_query_groups.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { produce } from 'immer';
+import { useQuery } from 'react-query';
+
+import { useKibana } from '../common/lib/kibana';
+import {
+  ListResult,
+  PackagePolicy,
+  packagePolicyRouteService,
+  PACKAGE_POLICY_SAVED_OBJECT_TYPE,
+} from '../../../fleet/common';
+import { OSQUERY_INTEGRATION_NAME } from '../../common';
+
+export const useScheduledQueryGroups = () => {
+  const { http } = useKibana().services;
+
+  return useQuery<ListResult<PackagePolicy>>(
+    ['scheduledQueries'],
+    () =>
+      http.get(packagePolicyRouteService.getListPath(), {
+        query: {
+          page: 1,
+          perPage: 10000,
+          kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name: ${OSQUERY_INTEGRATION_NAME}`,
+        },
+      }),
+    {
+      keepPreviousData: true,
+      select: produce((draft: ListResult<PackagePolicy>) => {
+        draft.items = draft.items.filter(
+          (item) =>
+            !(
+              item.inputs[0].streams.length === 1 &&
+              !item.inputs[0].streams[0].compiled_stream.query
+            )
+        );
+      }),
+    }
+  );
+};
diff --git a/x-pack/plugins/osquery/public/shared_imports.ts b/x-pack/plugins/osquery/public/shared_imports.ts
index 42e82b25d1b8fd..bae73da78f7043 100644
--- a/x-pack/plugins/osquery/public/shared_imports.ts
+++ b/x-pack/plugins/osquery/public/shared_imports.ts
@@ -28,6 +28,7 @@ export {
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 export {
   Field,
+  ComboBoxField,
   ToggleField,
   SelectField,
 } from '../../../../src/plugins/es_ui_shared/static/forms/components';
diff --git a/x-pack/plugins/osquery/public/types.ts b/x-pack/plugins/osquery/public/types.ts
index 02b5fc9c7a5d6a..f1dbec045dacc0 100644
--- a/x-pack/plugins/osquery/public/types.ts
+++ b/x-pack/plugins/osquery/public/types.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { DiscoverStart } from '../../../../src/plugins/discover/public';
 import { DataPublicPluginStart } from '../../../../src/plugins/data/public';
 import { FleetStart } from '../../fleet/public';
 import { CoreStart } from '../../../../src/core/public';
@@ -24,8 +25,9 @@ export interface AppPluginStartDependencies {
 }
 
 export interface StartPlugins {
+  discover: DiscoverStart;
   data: DataPublicPluginStart;
-  fleet?: FleetStart;
+  fleet: FleetStart;
   triggersActionsUi: TriggersAndActionsUIPublicPluginStart;
 }
 
diff --git a/x-pack/plugins/osquery/server/config.ts b/x-pack/plugins/osquery/server/config.ts
index 31be2566118039..56d67400a47d9a 100644
--- a/x-pack/plugins/osquery/server/config.ts
+++ b/x-pack/plugins/osquery/server/config.ts
@@ -8,7 +8,10 @@
 import { TypeOf, schema } from '@kbn/config-schema';
 
 export const ConfigSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: false }),
+  enabled: schema.boolean({ defaultValue: true }),
+  actionEnabled: schema.boolean({ defaultValue: false }),
+  savedQueries: schema.boolean({ defaultValue: false }),
+  packs: schema.boolean({ defaultValue: false }),
 });
 
 export type ConfigType = TypeOf<typeof ConfigSchema>;
diff --git a/x-pack/plugins/osquery/server/index.ts b/x-pack/plugins/osquery/server/index.ts
index f19d47cbeffb35..30bc5ed5bd8357 100644
--- a/x-pack/plugins/osquery/server/index.ts
+++ b/x-pack/plugins/osquery/server/index.ts
@@ -13,6 +13,9 @@ export const config = {
   schema: ConfigSchema,
   exposeToBrowser: {
     enabled: true,
+    actionEnabled: true,
+    savedQueries: true,
+    packs: true,
   },
 };
 export function plugin(initializerContext: PluginInitializerContext) {
diff --git a/x-pack/plugins/osquery/server/lib/osquery_app_context_services.ts b/x-pack/plugins/osquery/server/lib/osquery_app_context_services.ts
index ffe2a772ecb7f6..5b1f8e780494da 100644
--- a/x-pack/plugins/osquery/server/lib/osquery_app_context_services.ts
+++ b/x-pack/plugins/osquery/server/lib/osquery_app_context_services.ts
@@ -68,7 +68,7 @@ export class OsqueryAppContextService {
  */
 export interface OsqueryAppContext {
   logFactory: LoggerFactory;
-  config(): Promise<ConfigType>;
+  config(): ConfigType;
 
   /**
    * Object readiness is tied to plugin start method
diff --git a/x-pack/plugins/osquery/server/plugin.ts b/x-pack/plugins/osquery/server/plugin.ts
index ce6e8d51d9b525..31f611c5f1d31d 100644
--- a/x-pack/plugins/osquery/server/plugin.ts
+++ b/x-pack/plugins/osquery/server/plugin.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-// import { curry } from 'lodash';
-// import { ActionTypeExecutorResult } from '../../actions/server/types';
 import {
   PluginInitializerContext,
   CoreSetup,
@@ -19,7 +17,7 @@ import { createConfig } from './create_config';
 import { OsqueryPluginSetup, OsqueryPluginStart, SetupPlugins, StartPlugins } from './types';
 import { defineRoutes } from './routes';
 import { osquerySearchStrategyProvider } from './search_strategy/osquery';
-// import { initSavedObjects } from './saved_objects';
+import { initSavedObjects } from './saved_objects';
 import { OsqueryAppContext, OsqueryAppContextService } from './lib/osquery_app_context_services';
 import { ConfigType } from './config';
 
@@ -46,19 +44,12 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
     const osqueryContext: OsqueryAppContext = {
       logFactory: this.context.logger,
       service: this.osqueryAppContextService,
-      config: (): Promise<ConfigType> => Promise.resolve(config),
+      config: (): ConfigType => config,
     };
 
-    // initSavedObjects(core.savedObjects);
+    initSavedObjects(core.savedObjects, osqueryContext);
     defineRoutes(router, osqueryContext);
 
-    // plugins.actions.registerType({
-    //   id: '.osquery',
-    //   name: 'Osquery',
-    //   minimumLicenseRequired: 'gold',
-    //   executor: curry(executor)({}),
-    // });
-
     core.getStartServices().then(([, depsStart]) => {
       const osquerySearchStrategy = osquerySearchStrategyProvider(depsStart.data);
 
@@ -89,7 +80,3 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
     this.osqueryAppContextService.stop();
   }
 }
-
-// async function executor(payload, execOptions): Promise<ActionTypeExecutorResult<unknown>> {
-//   return { status: 'ok', data: {}, actionId: execOptions.actionId };
-// }
diff --git a/x-pack/plugins/osquery/server/routes/action/create_action_route.ts b/x-pack/plugins/osquery/server/routes/action/create_action_route.ts
index 7068243cc0fb72..8e741c6a9e3ca0 100644
--- a/x-pack/plugins/osquery/server/routes/action/create_action_route.ts
+++ b/x-pack/plugins/osquery/server/routes/action/create_action_route.ts
@@ -5,13 +5,11 @@
  * 2.0.
  */
 
-import { find } from 'lodash/fp';
 import uuid from 'uuid';
-import { schema } from '@kbn/config-schema';
 import moment from 'moment';
+import { schema } from '@kbn/config-schema';
 
 import { IRouter } from '../../../../../../src/core/server';
-import { packSavedObjectType, savedQuerySavedObjectType } from '../../../common/types';
 import { OsqueryAppContext } from '../../lib/osquery_app_context_services';
 
 import { parseAgentSelection, AgentSelection } from '../../lib/parse_agent_groups';
@@ -24,86 +22,19 @@ export const createActionRoute = (router: IRouter, osqueryContext: OsqueryAppCon
         params: schema.object({}, { unknowns: 'allow' }),
         body: schema.object({}, { unknowns: 'allow' }),
       },
+      options: {
+        tags: ['access:osquery', 'access:osquery_write'],
+      },
     },
     async (context, request, response) => {
-      const esClient = context.core.elasticsearch.client.asInternalUser;
+      const esClient = context.core.elasticsearch.client.asCurrentUser;
       const { agentSelection } = request.body as { agentSelection: AgentSelection };
       const selectedAgents = await parseAgentSelection(esClient, osqueryContext, agentSelection);
-      // @ts-expect-error update validation
-      if (request.body.pack_id) {
-        const savedObjectsClient = context.core.savedObjects.client;
-        const { attributes, references, ...rest } = await savedObjectsClient.get<{
-          title: string;
-          description: string;
-          queries: Array<{ name: string; interval: string }>;
-        }>(
-          packSavedObjectType,
-          // @ts-expect-error update types
-          request.body.pack_id
-        );
-
-        const pack = {
-          ...rest,
-          ...attributes,
-          queries:
-            attributes.queries?.map((packQuery) => {
-              const queryReference = find(['name', packQuery.name], references);
-
-              if (queryReference) {
-                return {
-                  ...packQuery,
-                  id: queryReference?.id,
-                };
-              }
-
-              return packQuery;
-            }) ?? [],
-        };
-
-        const { saved_objects: queriesSavedObjects } = await savedObjectsClient.bulkGet(
-          pack.queries.map((packQuery) => ({
-            // @ts-expect-error update validation
-            id: packQuery.id,
-            type: savedQuerySavedObjectType,
-          }))
-        );
-
-        const actionId = uuid.v4();
-
-        const actions = queriesSavedObjects.map((query) => ({
-          action_id: actionId,
-          '@timestamp': moment().toISOString(),
-          expiration: moment().add(2, 'days').toISOString(),
-          type: 'INPUT_ACTION',
-          input_type: 'osquery',
-          agents: selectedAgents,
-          data: {
-            id: query.id,
-            // @ts-expect-error update validation
-            query: query.attributes.query,
-          },
-        }));
-
-        const query = await esClient.bulk<{}>({
-          index: '.fleet-actions',
-          // @ts-expect-error update validation
-          body: actions.reduce((acc, action) => {
-            return [...acc, { create: { _index: '.fleet-actions' } }, action];
-          }, []),
-        });
-
-        return response.ok({
-          body: {
-            actions,
-            query,
-          },
-        });
-      }
 
       const action = {
         action_id: uuid.v4(),
         '@timestamp': moment().toISOString(),
-        expiration: moment().add(2, 'days').toISOString(),
+        expiration: moment().add(1, 'days').toISOString(),
         type: 'INPUT_ACTION',
         input_type: 'osquery',
         agents: selectedAgents,
@@ -114,15 +45,15 @@ export const createActionRoute = (router: IRouter, osqueryContext: OsqueryAppCon
           query: request.body.query.query,
         },
       };
-      const query = await esClient.index<{}, {}>({
+      const actionResponse = await esClient.index<{}, {}>({
         index: '.fleet-actions',
         body: action,
       });
 
       return response.ok({
         body: {
-          response: query,
-          action,
+          response: actionResponse,
+          actions: [action],
         },
       });
     }
diff --git a/x-pack/plugins/osquery/server/routes/index.ts b/x-pack/plugins/osquery/server/routes/index.ts
index 59d4085a77be12..7eee5b94fd84d8 100644
--- a/x-pack/plugins/osquery/server/routes/index.ts
+++ b/x-pack/plugins/osquery/server/routes/index.ts
@@ -6,15 +6,21 @@
  */
 
 import { IRouter } from '../../../../../src/core/server';
-import { initSavedQueryRoutes } from './saved_query';
-import { initScheduledQueryRoutes } from './scheduled_query';
 import { initActionRoutes } from './action';
 import { OsqueryAppContext } from '../lib/osquery_app_context_services';
+import { initSavedQueryRoutes } from './saved_query';
 import { initPackRoutes } from './pack';
 
 export const defineRoutes = (router: IRouter, context: OsqueryAppContext) => {
+  const config = context.config();
+
   initActionRoutes(router, context);
-  initPackRoutes(router);
-  initSavedQueryRoutes(router);
-  initScheduledQueryRoutes(router, context);
+
+  if (config.packs) {
+    initPackRoutes(router);
+  }
+
+  if (config.savedQueries) {
+    initSavedQueryRoutes(router);
+  }
 };
diff --git a/x-pack/plugins/osquery/server/routes/scheduled_query/find_scheduled_query_route.ts b/x-pack/plugins/osquery/server/routes/scheduled_query/find_scheduled_query_route.ts
index b9058a2868763c..43d5f3fc893f05 100644
--- a/x-pack/plugins/osquery/server/routes/scheduled_query/find_scheduled_query_route.ts
+++ b/x-pack/plugins/osquery/server/routes/scheduled_query/find_scheduled_query_route.ts
@@ -6,8 +6,10 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { OSQUERY_INTEGRATION_NAME } from '../../../common';
 
 import { IRouter } from '../../../../../../src/core/server';
+import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../../fleet/common';
 import { OsqueryAppContext } from '../../lib/osquery_app_context_services';
 
 export const findScheduledQueryRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
@@ -19,7 +21,7 @@ export const findScheduledQueryRoute = (router: IRouter, osqueryContext: Osquery
       },
     },
     async (context, request, response) => {
-      const kuery = 'ingest-package-policies.attributes.package.name: osquery_elastic_managed';
+      const kuery = `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.attributes.package.name: ${OSQUERY_INTEGRATION_NAME}`;
       const packagePolicyService = osqueryContext.service.getPackagePolicyService();
       const policies = await packagePolicyService?.list(context.core.savedObjects.client, {
         kuery,
diff --git a/x-pack/plugins/osquery/server/saved_objects.ts b/x-pack/plugins/osquery/server/saved_objects.ts
index 15a0f8e2be0dae..c6be1098cedb2e 100644
--- a/x-pack/plugins/osquery/server/saved_objects.ts
+++ b/x-pack/plugins/osquery/server/saved_objects.ts
@@ -7,12 +7,24 @@
 
 import { CoreSetup } from '../../../../src/core/server';
 
+import { OsqueryAppContext } from './lib/osquery_app_context_services';
 import { savedQueryType, packType } from './lib/saved_query/saved_object_mappings';
 
 const types = [savedQueryType, packType];
 
 export const savedObjectTypes = types.map((type) => type.name);
 
-export const initSavedObjects = (savedObjects: CoreSetup['savedObjects']) => {
-  types.forEach((type) => savedObjects.registerType(type));
+export const initSavedObjects = (
+  savedObjects: CoreSetup['savedObjects'],
+  osqueryContext: OsqueryAppContext
+) => {
+  const config = osqueryContext.config();
+
+  if (config.savedQueries) {
+    savedObjects.registerType(savedQueryType);
+  }
+
+  if (config.packs) {
+    savedObjects.registerType(packType);
+  }
 };
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
index 75e6201545a8e7..e8a8fbd63a84db 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
@@ -12,8 +12,8 @@ import { createQueryFilterClauses } from '../../../../../../common/utils/build_q
 export const buildActionResultsQuery = ({
   actionId,
   filterQuery,
+  // pagination: { activePage, querySize },
   sort,
-  pagination: { activePage, querySize },
 }: ActionResultsRequestOptions): ISearchRequestParams => {
   const filter = [
     ...createQueryFilterClauses(filterQuery),
@@ -30,18 +30,39 @@ export const buildActionResultsQuery = ({
     ignoreUnavailable: true,
     body: {
       aggs: {
-        responses: {
-          terms: {
-            script: {
-              lang: 'painless',
-              source: "if (doc['error'].size()==0) { return 'success' } else { return 'error' }",
+        aggs: {
+          global: {},
+          aggs: {
+            responses_by_action_id: {
+              filter: {
+                bool: {
+                  must: [
+                    {
+                      match: {
+                        action_id: actionId,
+                      },
+                    },
+                  ],
+                },
+              },
+              aggs: {
+                responses: {
+                  terms: {
+                    script: {
+                      lang: 'painless',
+                      source:
+                        "if (doc['error.keyword'].size()==0) { return 'success' } else { return 'error' }",
+                    },
+                  },
+                },
+              },
             },
           },
         },
       },
       query: { bool: { filter } },
-      from: activePage * querySize,
-      size: querySize,
+      // from: activePage * querySize,
+      size: 10000, // querySize,
       track_total_hits: true,
       fields: ['*'],
       sort: [
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
index 04ba05532cd0db..ac36f4b31e5fc5 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { OSQUERY_INTEGRATION_NAME } from '../../../../../common';
 import { ISearchRequestParams } from '../../../../../../../../src/plugins/data/common';
 import { ResultsRequestOptions } from '../../../../../common/search_strategy';
 import { createQueryFilterClauses } from '../../../../../common/utils/build_query';
@@ -13,7 +14,7 @@ export const buildResultsQuery = ({
   actionId,
   agentId,
   filterQuery,
-  // sort,
+  sort,
   pagination: { activePage, querySize },
 }: ResultsRequestOptions): ISearchRequestParams => {
   const filter = [
@@ -36,21 +37,29 @@ export const buildResultsQuery = ({
 
   const dslQuery = {
     allowNoIndices: true,
-    index: 'logs-elastic_agent.osquery*',
+    index: `logs-${OSQUERY_INTEGRATION_NAME}.result*`,
     ignoreUnavailable: true,
     body: {
+      aggs: {
+        count_by_agent_id: {
+          terms: {
+            field: 'agent.id',
+            size: 10000,
+          },
+        },
+      },
       query: { bool: { filter } },
       from: activePage * querySize,
       size: querySize,
       track_total_hits: true,
       fields: agentId ? ['osquery.*'] : ['agent.*', 'osquery.*'],
-      // sort: [
-      //   {
-      //     [sort.field]: {
-      //       order: [sort.direction],
-      //     },
-      //   },
-      // ],
+      sort: [
+        {
+          [sort.field]: {
+            order: sort.direction,
+          },
+        },
+      ],
     },
   };
 
diff --git a/x-pack/plugins/osquery/server/types.ts b/x-pack/plugins/osquery/server/types.ts
index dd9d45b2c3cc66..1882e52074660e 100644
--- a/x-pack/plugins/osquery/server/types.ts
+++ b/x-pack/plugins/osquery/server/types.ts
@@ -11,6 +11,7 @@ import {
   PluginStart as DataPluginStart,
 } from '../../../../src/plugins/data/server';
 import { FleetStartContract } from '../../fleet/server';
+import { PluginSetupContract } from '../../features/server';
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface OsqueryPluginSetup {}
@@ -20,6 +21,7 @@ export interface OsqueryPluginStart {}
 export interface SetupPlugins {
   actions: ActionsPlugin['setup'];
   data: DataPluginSetup;
+  features: PluginSetupContract;
 }
 
 export interface StartPlugins {
diff --git a/x-pack/plugins/remote_clusters/common/lib/cluster_serialization.ts b/x-pack/plugins/remote_clusters/common/lib/cluster_serialization.ts
index 8d3b1b895651a1..bf0fc11e882ccb 100644
--- a/x-pack/plugins/remote_clusters/common/lib/cluster_serialization.ts
+++ b/x-pack/plugins/remote_clusters/common/lib/cluster_serialization.ts
@@ -45,7 +45,7 @@ export interface Cluster {
   hasDeprecatedProxySetting?: boolean;
 }
 
-interface ClusterPayloadEs {
+export interface ClusterPayloadEs {
   skip_unavailable?: boolean | null;
   mode?: 'sniff' | 'proxy' | null;
   proxy_address?: string | null;
diff --git a/x-pack/plugins/remote_clusters/common/lib/index.ts b/x-pack/plugins/remote_clusters/common/lib/index.ts
index 7afba67d3622d5..b17283511b8b7c 100644
--- a/x-pack/plugins/remote_clusters/common/lib/index.ts
+++ b/x-pack/plugins/remote_clusters/common/lib/index.ts
@@ -10,4 +10,5 @@ export {
   serializeCluster,
   Cluster,
   ClusterInfoEs,
+  ClusterPayloadEs,
 } from './cluster_serialization';
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx
index 9f6eee757c7555..766f12fedc81c6 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx
+++ b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.tsx
@@ -47,8 +47,8 @@ import {
   convertCloudUrlToProxyConnection,
   convertProxyConnectionToCloudUrl,
   validateCluster,
+  isCloudUrlEnabled,
 } from './validators';
-import { isCloudUrlEnabled } from './validators/validate_cloud_url';
 
 const defaultClusterValues: Cluster = {
   name: '',
@@ -369,7 +369,7 @@ export class RemoteClusterForm extends Component<Props, State> {
         </EuiFlexItem>
 
         <EuiFlexItem grow={false}>
-          <EuiButtonEmpty onClick={this.toggleRequest}>
+          <EuiButtonEmpty onClick={this.toggleRequest} data-test-subj="remoteClustersRequestButton">
             {isRequestVisible ? (
               <FormattedMessage
                 id="xpack.remoteClusters.remoteClusterForm.hideRequestButtonLabel"
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/request_flyout.tsx b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/request_flyout.tsx
index 2bcedc2bce4580..55bd2bec71633c 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/request_flyout.tsx
+++ b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/request_flyout.tsx
@@ -38,7 +38,7 @@ export class RequestFlyout extends PureComponent<Props> {
     return (
       <EuiFlyout maxWidth={480} onClose={close}>
         <EuiFlyoutHeader>
-          <EuiTitle>
+          <EuiTitle data-test-subj="remoteClusterRequestFlyoutTitle">
             <h2>
               {name ? (
                 <FormattedMessage
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/components/connection_status/connection_status.js b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/components/connection_status/connection_status.js
index 572f5fa81f9d38..5202683e3417f1 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/components/connection_status/connection_status.js
+++ b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/components/connection_status/connection_status.js
@@ -41,13 +41,11 @@ export function ConnectionStatus({ isConnected, mode }) {
   return (
     <EuiFlexGroup gutterSize="s" alignItems="center">
       <EuiFlexItem grow={false}>
-        <EuiFlexGroup gutterSize="s" alignItems="center">
-          <EuiFlexItem grow={false}>{icon}</EuiFlexItem>
+        <span className="eui-displayBlock">{icon}</span>
+      </EuiFlexItem>
 
-          <EuiFlexItem className="remoteClustersConnectionStatus__message">
-            <EuiText size="s">{message}</EuiText>
-          </EuiFlexItem>
-        </EuiFlexGroup>
+      <EuiFlexItem grow={false} className="remoteClustersConnectionStatus__message">
+        <EuiText size="s">{message}</EuiText>
       </EuiFlexItem>
 
       {!isConnected && mode === SNIFF_MODE && (
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/detail_panel/detail_panel.js b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/detail_panel/detail_panel.js
index c25be664896c3b..6969f98e5f092a 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/detail_panel/detail_panel.js
+++ b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/detail_panel/detail_panel.js
@@ -183,9 +183,9 @@ export class DetailPanel extends Component {
     mode,
   }) {
     return (
-      <EuiDescriptionList data-test-subj="remoteClusterDetailPanelStatusValues">
-        <EuiFlexGroup>
-          <EuiFlexItem>
+      <EuiFlexGroup data-test-subj="remoteClusterDetailPanelStatusValues">
+        <EuiFlexItem>
+          <EuiDescriptionList>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -194,13 +194,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailIsConnected">
               <ConnectionStatus isConnected={isConnected} mode={mode} />
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
 
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -209,17 +206,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailConnectedNodesCount">
               {connectedNodesCount}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
 
-        <EuiSpacer size="s" />
-
-        <EuiFlexGroup>
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -228,7 +218,6 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailSeeds">
               {seeds.map((seed) => (
                 <EuiText size="s" key={seed}>
@@ -236,9 +225,11 @@ export class DetailPanel extends Component {
                 </EuiText>
               ))}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
+          </EuiDescriptionList>
+        </EuiFlexItem>
 
-          <EuiFlexItem>
+        <EuiFlexItem>
+          <EuiDescriptionList>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -247,17 +238,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailSkipUnavailable">
               {this.renderSkipUnavailableValue(skipUnavailable)}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
 
-        <EuiSpacer size="s" />
-
-        <EuiFlexGroup>
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -266,13 +250,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailMaxConnections">
               {maxConnectionsPerCluster}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
 
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -281,13 +262,12 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailInitialConnectTimeout">
               {initialConnectTimeout}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiDescriptionList>
+          </EuiDescriptionList>
+        </EuiFlexItem>
+      </EuiFlexGroup>
     );
   }
 
@@ -302,9 +282,9 @@ export class DetailPanel extends Component {
     serverName,
   }) {
     return (
-      <EuiDescriptionList data-test-subj="remoteClusterDetailPanelStatusValues">
-        <EuiFlexGroup>
-          <EuiFlexItem>
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiDescriptionList>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -313,13 +293,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailIsConnected">
               <ConnectionStatus isConnected={isConnected} mode={mode} />
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
 
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -328,17 +305,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailConnectedSocketsCount">
               {connectedSocketsCount ? connectedSocketsCount : '-'}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
 
-        <EuiSpacer size="s" />
-
-        <EuiFlexGroup>
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -347,13 +317,25 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailProxyAddress">
               {proxyAddress}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
 
-          <EuiFlexItem>
+            <EuiDescriptionListTitle>
+              <EuiTitle size="xs">
+                <FormattedMessage
+                  id="xpack.remoteClusters.detailPanel.serverNameLabel"
+                  defaultMessage="Server name"
+                />
+              </EuiTitle>
+            </EuiDescriptionListTitle>
+            <EuiDescriptionListDescription data-test-subj="remoteClusterDetailServerName">
+              {serverName ? serverName : '-'}
+            </EuiDescriptionListDescription>
+          </EuiDescriptionList>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiDescriptionList>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -362,17 +344,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailSkipUnavailable">
               {this.renderSkipUnavailableValue(skipUnavailable)}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-
-        <EuiSpacer size="s" />
 
-        <EuiFlexGroup>
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -381,13 +356,10 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailMaxSocketConnections">
               {proxySocketConnections ? proxySocketConnections : '-'}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
 
-          <EuiFlexItem>
             <EuiDescriptionListTitle>
               <EuiTitle size="xs">
                 <FormattedMessage
@@ -396,42 +368,22 @@ export class DetailPanel extends Component {
                 />
               </EuiTitle>
             </EuiDescriptionListTitle>
-
             <EuiDescriptionListDescription data-test-subj="remoteClusterDetailInitialConnectTimeout">
               {initialConnectTimeout}
             </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-
-        <EuiSpacer size="s" />
-
-        <EuiFlexGroup>
-          <EuiFlexItem>
-            <EuiDescriptionListTitle>
-              <EuiTitle size="xs">
-                <FormattedMessage
-                  id="xpack.remoteClusters.detailPanel.serverNameLabel"
-                  defaultMessage="Server name"
-                />
-              </EuiTitle>
-            </EuiDescriptionListTitle>
-
-            <EuiDescriptionListDescription data-test-subj="remoteClusterDetailServerName">
-              {serverName ? serverName : '-'}
-            </EuiDescriptionListDescription>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiDescriptionList>
+          </EuiDescriptionList>
+        </EuiFlexItem>
+      </EuiFlexGroup>
     );
   }
 
   renderCluster(cluster) {
     return (
       <section
-        aria-labelledby="xpack.remoteClusters.detailPanel.statusTitle"
+        aria-labelledby="clusterStatus"
         data-test-subj="remoteClusterDetailPanelStatusSection"
       >
-        <EuiTitle size="s">
+        <EuiTitle size="s" id="clusterStatus">
           <h3>
             <FormattedMessage
               id="xpack.remoteClusters.detailPanel.statusTitle"
diff --git a/x-pack/plugins/rule_registry/README.md b/x-pack/plugins/rule_registry/README.md
index 17fe2b20f74fa8..2c8f534a63d6b5 100644
--- a/x-pack/plugins/rule_registry/README.md
+++ b/x-pack/plugins/rule_registry/README.md
@@ -1,3 +1,5 @@
+# Rule Registry
+
 The rule registry plugin aims to make it easy for rule type producers to have their rules produce the data that they need to build rich experiences on top of a unified experience, without the risk of mapping conflicts.
 
 A rule registry creates a template, an ILM policy, and an alias. The template mappings can be configured. It also injects a client scoped to these indices.
@@ -6,7 +8,17 @@ It also supports inheritance, which means that producers can create a registry s
 
 The rule registry plugin creates a root rule registry, with the mappings defined needed to create a unified experience. Rule type producers can use the plugin to access the root rule registry, and create their own registry that branches off of the root rule registry. The rule registry client sees data from its own registry, and all registries that branches off of it. It does not see data from its parents.
 
-Creating a rule registry
+## Enabling writing
+
+Set
+
+```yaml
+xpack.ruleRegistry.unsafe.write.enabled: true
+```
+
+in your Kibana configuration to allow the Rule Registry to write events to the alert indices.
+
+## Creating a rule registry
 
 To create a rule registry, producers should add the `ruleRegistry` plugin to their dependencies. They can then use the `ruleRegistry.create` method to create a child registry, with the additional mappings that should be used by specifying `fieldMap`:
 
@@ -16,7 +28,7 @@ const observabilityRegistry = plugins.ruleRegistry.create({
   fieldMap: {
     ...pickWithPatterns(ecsFieldMap, 'host.name', 'service.name'),
   },
-})
+});
 ```
 
 `fieldMap` is a key-value map of field names and mapping options:
@@ -37,13 +49,13 @@ To pick many fields, you can use `pickWithPatterns`, which supports wildcards wi
 
 If a registry is created, it will initialise as soon as the core services needed become available. It will create a (versioned) template, alias, and ILM policy, but only if these do not exist yet.
 
-### Rule registry client
+## Rule registry client
 
 The rule registry client can either be injected in the executor, or created in the scope of a request. It exposes a `search` method and a `bulkIndex` method. When `search` is called, it first gets all the rules the current user has access to, and adds these ids to the search request that it executes. This means that the user can only see data from rules they have access to.
 
 Both `search` and `bulkIndex` are fully typed, in the sense that they reflect the mappings defined for the registry.
 
-### Schema
+## Schema
 
 The following fields are available in the root rule registry:
 
@@ -60,8 +72,8 @@ The following fields are available in the root rule registry:
 - `kibana.rac.alert.uuid`: the unique identifier for the alert during its lifespan. If an alert recovers (or closes), this identifier is re-generated when it is opened again.
 - `kibana.rac.alert.status`: the status of the alert. Can be `open` or `closed`.
 - `kibana.rac.alert.start`: the ISO timestamp of the time at which the alert started.
-- `kibana.rac.alert.end`: the ISO timestamp of the time at which the alert recovered. 
-- `kibana.rac.alert.duration.us`: the duration of the alert, in microseconds. This is always the difference between either the current time, or the time when the alert recovered. 
+- `kibana.rac.alert.end`: the ISO timestamp of the time at which the alert recovered.
+- `kibana.rac.alert.duration.us`: the duration of the alert, in microseconds. This is always the difference between either the current time, or the time when the alert recovered.
 - `kibana.rac.alert.severity.level`: the severity of the alert, as a keyword (e.g. critical).
 - `kibana.rac.alert.severity.value`: the severity of the alert, as a numerical value, which allows sorting.
 
diff --git a/x-pack/plugins/rule_registry/kibana.json b/x-pack/plugins/rule_registry/kibana.json
index 1636f88a21a618..ec2b366f739e6d 100644
--- a/x-pack/plugins/rule_registry/kibana.json
+++ b/x-pack/plugins/rule_registry/kibana.json
@@ -11,8 +11,5 @@
     "triggersActionsUi"
   ],
   "server": true,
-  "ui": true,
-  "extraPublicDirs": [
-    "common"
-  ]
+  "ui": true
 }
diff --git a/x-pack/plugins/rule_registry/public/index.ts b/x-pack/plugins/rule_registry/public/index.ts
index 55662dbcc8bfc7..59697261ff20bc 100644
--- a/x-pack/plugins/rule_registry/public/index.ts
+++ b/x-pack/plugins/rule_registry/public/index.ts
@@ -5,10 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext } from 'kibana/public';
+import type { PluginInitializerContext } from 'kibana/public';
 import { Plugin } from './plugin';
 
-export { RuleRegistryPublicPluginSetupContract } from './plugin';
+export type { RuleRegistryPublicPluginSetupContract } from './plugin';
 export { RuleRegistry } from './rule_registry';
 export type { IRuleRegistry, RuleType } from './rule_registry/types';
 
diff --git a/x-pack/plugins/rule_registry/public/plugin.ts b/x-pack/plugins/rule_registry/public/plugin.ts
index 66c9a4fa224a5e..7f0bceefb6797c 100644
--- a/x-pack/plugins/rule_registry/public/plugin.ts
+++ b/x-pack/plugins/rule_registry/public/plugin.ts
@@ -19,7 +19,7 @@ import type {
   TriggersAndActionsUIPublicPluginSetup,
   TriggersAndActionsUIPublicPluginStart,
 } from '../../triggers_actions_ui/public';
-import { baseRuleFieldMap } from '../common';
+import type { BaseRuleFieldMap } from '../common';
 import { RuleRegistry } from './rule_registry';
 
 interface RuleRegistrySetupPlugins {
@@ -40,7 +40,7 @@ export class Plugin
 
   public setup(core: CoreSetup<RuleRegistryStartPlugins>, plugins: RuleRegistrySetupPlugins) {
     const rootRegistry = new RuleRegistry({
-      fieldMap: baseRuleFieldMap,
+      fieldMap: {} as BaseRuleFieldMap,
       alertTypeRegistry: plugins.triggersActionsUi.alertTypeRegistry,
     });
     return {
diff --git a/x-pack/plugins/rule_registry/public/rule_registry/types.ts b/x-pack/plugins/rule_registry/public/rule_registry/types.ts
index bb16227cbab5f6..7c186385ebd357 100644
--- a/x-pack/plugins/rule_registry/public/rule_registry/types.ts
+++ b/x-pack/plugins/rule_registry/public/rule_registry/types.ts
@@ -4,8 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { AlertTypeRegistryContract } from '../../../triggers_actions_ui/public';
-import { BaseRuleFieldMap, FieldMap } from '../../common';
+import type { AlertTypeRegistryContract } from '../../../triggers_actions_ui/public';
+import type { BaseRuleFieldMap, FieldMap } from '../../common';
 
 export interface RuleRegistryConstructorOptions<TFieldMap extends BaseRuleFieldMap> {
   fieldMap: TFieldMap;
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index 3d492bb690b05f..9fd1408fcdb21f 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -17,7 +17,9 @@ export { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_reg
 export const config = {
   schema: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
-    writeEnabled: schema.boolean({ defaultValue: false }),
+    unsafe: schema.object({
+      write: schema.object({ enabled: schema.boolean({ defaultValue: false }) }),
+    }),
   }),
 };
 
diff --git a/x-pack/plugins/rule_registry/server/plugin.ts b/x-pack/plugins/rule_registry/server/plugin.ts
index dabedc2849d078..09df47c40a3946 100644
--- a/x-pack/plugins/rule_registry/server/plugin.ts
+++ b/x-pack/plugins/rule_registry/server/plugin.ts
@@ -37,7 +37,7 @@ export class RuleRegistryPlugin implements Plugin<RuleRegistryPluginSetupContrac
       kibanaVersion: this.initContext.env.packageInfo.version,
       logger: logger.get('root'),
       alertingPluginSetupContract: plugins.alerting,
-      writeEnabled: config.writeEnabled,
+      writeEnabled: config.unsafe.write.enabled,
     });
 
     return rootRegistry;
diff --git a/x-pack/plugins/saved_objects_tagging/public/components/base/tag_badge.tsx b/x-pack/plugins/saved_objects_tagging/public/components/base/tag_badge.tsx
index 6bc9e659d93469..e8af661d6921d4 100644
--- a/x-pack/plugins/saved_objects_tagging/public/components/base/tag_badge.tsx
+++ b/x-pack/plugins/saved_objects_tagging/public/components/base/tag_badge.tsx
@@ -17,5 +17,9 @@ export interface TagBadgeProps {
  * The badge representation of a Tag, which is the default display to be used for them.
  */
 export const TagBadge: FC<TagBadgeProps> = ({ tag }) => {
-  return <EuiBadge color={tag.color}>{tag.name}</EuiBadge>;
+  return (
+    <EuiBadge color={tag.color} title={tag.description}>
+      {tag.name}
+    </EuiBadge>
+  );
 };
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 4c62179f9ed547..2b584b196a7380 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -136,11 +136,16 @@ export const DETECTION_ENGINE_RULES_STATUS_URL = `${DETECTION_ENGINE_RULES_URL}/
 export const DETECTION_ENGINE_PREPACKAGED_RULES_STATUS_URL = `${DETECTION_ENGINE_RULES_URL}/prepackaged/_status`;
 
 export const TIMELINE_URL = '/api/timeline';
+export const TIMELINES_URL = '/api/timelines';
+export const TIMELINE_FAVORITE_URL = '/api/timeline/_favorite';
 export const TIMELINE_DRAFT_URL = `${TIMELINE_URL}/_draft`;
 export const TIMELINE_EXPORT_URL = `${TIMELINE_URL}/_export`;
 export const TIMELINE_IMPORT_URL = `${TIMELINE_URL}/_import`;
 export const TIMELINE_PREPACKAGED_URL = `${TIMELINE_URL}/_prepackaged`;
 
+export const NOTE_URL = '/api/note';
+export const PINNED_EVENT_URL = '/api/pinned_event';
+
 /**
  * Default signals index key for kibana.dev.yml
  */
diff --git a/x-pack/plugins/security_solution/common/cti/constants.ts b/x-pack/plugins/security_solution/common/cti/constants.ts
index cdd4a564f3d73c..3423f17e3f6833 100644
--- a/x-pack/plugins/security_solution/common/cti/constants.ts
+++ b/x-pack/plugins/security_solution/common/cti/constants.ts
@@ -19,10 +19,14 @@ export const INDICATOR_MATCHED_TYPE = `${INDICATOR_DESTINATION_PATH}.${MATCHED_T
 export const EVENT_DATASET = 'event.dataset';
 export const EVENT_REFERENCE = 'event.reference';
 export const PROVIDER = 'provider';
+export const FIRSTSEEN = 'first_seen';
 
 export const INDICATOR_DATASET = `${INDICATOR_DESTINATION_PATH}.${EVENT_DATASET}`;
-export const INDICATOR_REFERENCE = `${INDICATOR_DESTINATION_PATH}.${EVENT_REFERENCE}`;
+export const INDICATOR_EVENT_URL = `${INDICATOR_DESTINATION_PATH}.event.url`;
+export const INDICATOR_FIRSTSEEN = `${INDICATOR_DESTINATION_PATH}.${FIRSTSEEN}`;
+export const INDICATOR_LASTSEEN = `${INDICATOR_DESTINATION_PATH}.last_seen`;
 export const INDICATOR_PROVIDER = `${INDICATOR_DESTINATION_PATH}.${PROVIDER}`;
+export const INDICATOR_REFERENCE = `${INDICATOR_DESTINATION_PATH}.${EVENT_REFERENCE}`;
 
 export const CTI_ROW_RENDERER_FIELDS = [
   INDICATOR_MATCHED_ATOMIC,
@@ -32,3 +36,11 @@ export const CTI_ROW_RENDERER_FIELDS = [
   INDICATOR_REFERENCE,
   INDICATOR_PROVIDER,
 ];
+
+export const SORTED_THREAT_SUMMARY_FIELDS = [
+  INDICATOR_MATCHED_FIELD,
+  INDICATOR_MATCHED_TYPE,
+  INDICATOR_PROVIDER,
+  INDICATOR_FIRSTSEEN,
+  INDICATOR_LASTSEEN,
+];
diff --git a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts
index 3c04e2b0da9c38..63a38ad7d71c1d 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.test.ts
@@ -1161,8 +1161,8 @@ describe('get_filter', () => {
       expect(request).toEqual({
         method: 'POST',
         path: `/testindex1,testindex2/_eql/search?allow_no_indices=true`,
-        event_category_field: 'event.other_category',
         body: {
+          event_category_field: 'event.other_category',
           size: 100,
           query: 'process where true',
           filter: {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
index 70fe2b6187aa60..e562d186bc4240 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
@@ -65,7 +65,6 @@ interface EqlSearchRequest {
   method: string;
   path: string;
   body: object;
-  event_category_field?: string;
 }
 
 export const buildEqlSearchRequest = (
@@ -109,7 +108,7 @@ export const buildEqlSearchRequest = (
       },
     });
   }
-  const baseRequest = {
+  return {
     method: 'POST',
     path: `/${indexString}/_eql/search?allow_no_indices=true`,
     body: {
@@ -120,14 +119,7 @@ export const buildEqlSearchRequest = (
           filter: requestFilter,
         },
       },
+      event_category_field: eventCategoryOverride,
     },
   };
-  if (eventCategoryOverride) {
-    return {
-      ...baseRequest,
-      event_category_field: eventCategoryOverride,
-    };
-  } else {
-    return baseRequest;
-  }
 };
diff --git a/x-pack/plugins/security_solution/common/graphql/shared/schema.gql.ts b/x-pack/plugins/security_solution/common/graphql/shared/schema.gql.ts
deleted file mode 100644
index 86416cf354498d..00000000000000
--- a/x-pack/plugins/security_solution/common/graphql/shared/schema.gql.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const sharedSchema = gql`
-  input TimerangeInput {
-    "The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan."
-    interval: String!
-    "The end of the timerange"
-    to: String!
-    "The beginning of the timerange"
-    from: String!
-  }
-
-  input docValueFieldsInput {
-    field: String!
-    format: String!
-  }
-
-  type CursorType {
-    value: String
-    tiebreaker: String
-  }
-
-  input PaginationInput {
-    "The limit parameter allows you to configure the maximum amount of items to be returned"
-    limit: Float!
-    "The cursor parameter defines the next result you want to fetch"
-    cursor: String
-    "The tiebreaker parameter allow to be more precise to fetch the next item"
-    tiebreaker: String
-  }
-
-  input PaginationInputPaginated {
-    "The activePage parameter defines the page of results you want to fetch"
-    activePage: Float!
-    "The cursorStart parameter defines the start of the results to be displayed"
-    cursorStart: Float!
-    "The fakePossibleCount parameter determines the total count in order to show 5 additional pages"
-    fakePossibleCount: Float!
-    "The querySize parameter is the number of items to be returned"
-    querySize: Float!
-  }
-
-  enum Direction {
-    asc
-    desc
-  }
-
-  enum FlowTarget {
-    client
-    destination
-    server
-    source
-  }
-
-  enum FlowTargetSourceDest {
-    destination
-    source
-  }
-
-  enum FlowDirection {
-    uniDirectional
-    biDirectional
-  }
-
-  input SortField {
-    sortFieldId: String!
-    direction: Direction!
-  }
-
-  type PageInfo {
-    endCursor: CursorType
-    hasNextPage: Boolean
-  }
-
-  type Inspect {
-    dsl: [String!]!
-    response: [String!]!
-  }
-
-  type PageInfoPaginated {
-    activePage: Float!
-    fakeTotalCount: Float!
-    showMorePagesIndicator: Boolean!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
index 2160ed6170e29e..ae2cff20717f3c 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
@@ -192,3 +192,9 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramRequestOptions
   : never;
+
+export interface DocValueFieldsInput {
+  field: string;
+
+  format: string;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
index 504e71cd8cefb0..9c2c23eb334a3d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
@@ -17,7 +17,14 @@ import {
   TimelineEventsLastEventTimeStrategyResponse,
   TimelineKpiStrategyResponse,
 } from './events';
-import { DocValueFields, PaginationInputPaginated, TimerangeInput, SortField } from '../common';
+import {
+  DocValueFields,
+  PaginationInputPaginated,
+  TimerangeInput,
+  SortField,
+  Maybe,
+} from '../common';
+import { DataProviderType, TimelineType, TimelineStatus } from '../../types/timeline';
 
 export * from './events';
 
@@ -64,3 +71,141 @@ export type TimelineStrategyRequestType<
   : T extends TimelineEventsQueries.lastEventTime
   ? TimelineEventsLastEventTimeRequestOptions
   : never;
+
+export interface ColumnHeaderInput {
+  aggregatable?: Maybe<boolean>;
+  category?: Maybe<string>;
+  columnHeaderType?: Maybe<string>;
+  description?: Maybe<string>;
+  example?: Maybe<string>;
+  indexes?: Maybe<string[]>;
+  id?: Maybe<string>;
+  name?: Maybe<string>;
+  placeholder?: Maybe<string>;
+  searchable?: Maybe<boolean>;
+  type?: Maybe<string>;
+}
+
+export interface QueryMatchInput {
+  field?: Maybe<string>;
+
+  displayField?: Maybe<string>;
+
+  value?: Maybe<string>;
+
+  displayValue?: Maybe<string>;
+
+  operator?: Maybe<string>;
+}
+
+export interface DataProviderInput {
+  id?: Maybe<string>;
+  name?: Maybe<string>;
+  enabled?: Maybe<boolean>;
+  excluded?: Maybe<boolean>;
+  kqlQuery?: Maybe<string>;
+  queryMatch?: Maybe<QueryMatchInput>;
+  and?: Maybe<DataProviderInput[]>;
+  type?: Maybe<DataProviderType>;
+}
+
+export interface EqlOptionsInput {
+  eventCategoryField?: Maybe<string>;
+  tiebreakerField?: Maybe<string>;
+  timestampField?: Maybe<string>;
+  query?: Maybe<string>;
+  size?: Maybe<number>;
+}
+
+export interface FilterMetaTimelineInput {
+  alias?: Maybe<string>;
+  controlledBy?: Maybe<string>;
+  disabled?: Maybe<boolean>;
+  field?: Maybe<string>;
+  formattedValue?: Maybe<string>;
+  index?: Maybe<string>;
+  key?: Maybe<string>;
+  negate?: Maybe<boolean>;
+  params?: Maybe<string>;
+  type?: Maybe<string>;
+  value?: Maybe<string>;
+}
+
+export interface FilterTimelineInput {
+  exists?: Maybe<string>;
+  meta?: Maybe<FilterMetaTimelineInput>;
+  match_all?: Maybe<string>;
+  missing?: Maybe<string>;
+  query?: Maybe<string>;
+  range?: Maybe<string>;
+  script?: Maybe<string>;
+}
+
+export interface SerializedFilterQueryInput {
+  filterQuery?: Maybe<SerializedKueryQueryInput>;
+}
+
+export interface SerializedKueryQueryInput {
+  kuery?: Maybe<KueryFilterQueryInput>;
+  serializedQuery?: Maybe<string>;
+}
+
+export interface KueryFilterQueryInput {
+  kind?: Maybe<string>;
+  expression?: Maybe<string>;
+}
+
+export interface DateRangePickerInput {
+  start?: Maybe<number>;
+  end?: Maybe<number>;
+}
+
+export interface SortTimelineInput {
+  columnId?: Maybe<string>;
+  sortDirection?: Maybe<string>;
+}
+
+export enum RowRendererId {
+  alerts = 'alerts',
+  auditd = 'auditd',
+  auditd_file = 'auditd_file',
+  library = 'library',
+  netflow = 'netflow',
+  plain = 'plain',
+  registry = 'registry',
+  suricata = 'suricata',
+  system = 'system',
+  system_dns = 'system_dns',
+  system_endgame_process = 'system_endgame_process',
+  system_file = 'system_file',
+  system_fim = 'system_fim',
+  system_security_event = 'system_security_event',
+  system_socket = 'system_socket',
+  zeek = 'zeek',
+}
+
+export interface TimelineInput {
+  columns?: Maybe<ColumnHeaderInput[]>;
+  dataProviders?: Maybe<DataProviderInput[]>;
+  description?: Maybe<string>;
+  eqlOptions?: Maybe<EqlOptionsInput>;
+  eventType?: Maybe<string>;
+  excludedRowRendererIds?: Maybe<RowRendererId[]>;
+  filters?: Maybe<FilterTimelineInput[]>;
+  kqlMode?: Maybe<string>;
+  kqlQuery?: Maybe<SerializedFilterQueryInput>;
+  indexNames?: Maybe<string[]>;
+  title?: Maybe<string>;
+  templateTimelineId?: Maybe<string>;
+  templateTimelineVersion?: Maybe<number>;
+  timelineType?: Maybe<TimelineType>;
+  dateRange?: Maybe<DateRangePickerInput>;
+  savedQueryId?: Maybe<string>;
+  sort?: Maybe<SortTimelineInput[]>;
+  status?: Maybe<TimelineStatus>;
+}
+
+export enum FlowDirection {
+  uniDirectional = 'uniDirectional',
+  biDirectional = 'biDirectional',
+}
diff --git a/x-pack/plugins/security_solution/common/types/timeline/index.ts b/x-pack/plugins/security_solution/common/types/timeline/index.ts
index 9def70048410a9..5b6c9c532ba7c0 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/index.ts
@@ -8,8 +8,12 @@
 import * as runtimeTypes from 'io-ts';
 
 import { stringEnum, unionWithNullType } from '../../utility_types';
-import { NoteSavedObject, NoteSavedObjectToReturnRuntimeType } from './note';
-import { PinnedEventToReturnSavedObjectRuntimeType, PinnedEventSavedObject } from './pinned_event';
+import { NoteResult, NoteSavedObject, NoteSavedObjectToReturnRuntimeType } from './note';
+import {
+  PinnedEventToReturnSavedObjectRuntimeType,
+  PinnedEventSavedObject,
+  PinnedEvent,
+} from './pinned_event';
 import {
   success,
   success_count as successCount,
@@ -17,6 +21,7 @@ import {
 import { FlowTarget } from '../../search_strategy/security_solution/network';
 import { PositiveInteger } from '../../detection_engine/schemas/types';
 import { errorSchema } from '../../detection_engine/schemas/response/error_schema';
+import { Direction, Maybe } from '../../search_strategy';
 
 /*
  *  ColumnHeader Types
@@ -167,6 +172,8 @@ const SavedSortRuntimeType = runtimeTypes.union([
   SavedSortObject,
 ]);
 
+export type Sort = runtimeTypes.TypeOf<typeof SavedSortRuntimeType>;
+
 /*
  *  Timeline Statuses
  */
@@ -346,6 +353,14 @@ export type TimelineSavedObject = runtimeTypes.TypeOf<
   typeof TimelineSavedToReturnObjectRuntimeType
 >;
 
+export const SingleTimelineResponseType = runtimeTypes.type({
+  data: runtimeTypes.type({
+    getOneTimeline: TimelineSavedToReturnObjectRuntimeType,
+  }),
+});
+
+export type SingleTimelineResponse = runtimeTypes.TypeOf<typeof SingleTimelineResponseType>;
+
 /**
  * All Timeline Saved object type with metadata
  */
@@ -476,3 +491,229 @@ export type TimelineExpandedDetailType =
 export type TimelineExpandedDetail = {
   [tab in TimelineTabs]?: TimelineExpandedDetailType;
 };
+
+export const pageInfoTimeline = runtimeTypes.type({
+  pageIndex: runtimeTypes.number,
+  pageSize: runtimeTypes.number,
+});
+
+export enum SortFieldTimeline {
+  title = 'title',
+  description = 'description',
+  updated = 'updated',
+  created = 'created',
+}
+
+export const sortFieldTimeline = runtimeTypes.union([
+  runtimeTypes.literal(SortFieldTimeline.title),
+  runtimeTypes.literal(SortFieldTimeline.description),
+  runtimeTypes.literal(SortFieldTimeline.updated),
+  runtimeTypes.literal(SortFieldTimeline.created),
+]);
+
+export const direction = runtimeTypes.union([
+  runtimeTypes.literal(Direction.asc),
+  runtimeTypes.literal(Direction.desc),
+]);
+
+export const sortTimeline = runtimeTypes.type({
+  sortField: sortFieldTimeline,
+  sortOrder: direction,
+});
+
+const favoriteTimelineResult = runtimeTypes.partial({
+  fullName: unionWithNullType(runtimeTypes.string),
+  userName: unionWithNullType(runtimeTypes.string),
+  favoriteDate: unionWithNullType(runtimeTypes.number),
+});
+
+export type FavoriteTimelineResult = runtimeTypes.TypeOf<typeof favoriteTimelineResult>;
+
+export const responseFavoriteTimeline = runtimeTypes.partial({
+  savedObjectId: runtimeTypes.string,
+  version: runtimeTypes.string,
+  code: unionWithNullType(runtimeTypes.number),
+  message: unionWithNullType(runtimeTypes.string),
+  templateTimelineId: unionWithNullType(runtimeTypes.string),
+  templateTimelineVersion: unionWithNullType(runtimeTypes.number),
+  timelineType: unionWithNullType(TimelineTypeLiteralRt),
+  favorite: unionWithNullType(runtimeTypes.array(favoriteTimelineResult)),
+});
+
+export type ResponseFavoriteTimeline = runtimeTypes.TypeOf<typeof responseFavoriteTimeline>;
+
+export const getTimelinesArgs = runtimeTypes.partial({
+  onlyUserFavorite: unionWithNullType(runtimeTypes.boolean),
+  pageInfo: unionWithNullType(pageInfoTimeline),
+  search: unionWithNullType(runtimeTypes.string),
+  sort: unionWithNullType(sortTimeline),
+  status: unionWithNullType(TimelineStatusLiteralRt),
+  timelineType: unionWithNullType(TimelineTypeLiteralRt),
+});
+
+export type GetTimelinesArgs = runtimeTypes.TypeOf<typeof getTimelinesArgs>;
+
+const responseTimelines = runtimeTypes.type({
+  timeline: runtimeTypes.array(TimelineSavedToReturnObjectRuntimeType),
+  totalCount: runtimeTypes.number,
+});
+
+export type ResponseTimelines = runtimeTypes.TypeOf<typeof responseTimelines>;
+
+export const allTimelinesResponse = runtimeTypes.intersection([
+  responseTimelines,
+  runtimeTypes.type({
+    defaultTimelineCount: runtimeTypes.number,
+    templateTimelineCount: runtimeTypes.number,
+    elasticTemplateTimelineCount: runtimeTypes.number,
+    customTemplateTimelineCount: runtimeTypes.number,
+    favoriteCount: runtimeTypes.number,
+  }),
+]);
+
+export type AllTimelinesResponse = runtimeTypes.TypeOf<typeof allTimelinesResponse>;
+
+export interface PageInfoTimeline {
+  pageIndex: number;
+
+  pageSize: number;
+}
+
+export interface ColumnHeaderResult {
+  aggregatable?: Maybe<boolean>;
+  category?: Maybe<string>;
+  columnHeaderType?: Maybe<string>;
+  description?: Maybe<string>;
+  example?: Maybe<string>;
+  indexes?: Maybe<string[]>;
+  id?: Maybe<string>;
+  name?: Maybe<string>;
+  placeholder?: Maybe<string>;
+  searchable?: Maybe<boolean>;
+  type?: Maybe<string>;
+}
+
+export interface DataProviderResult {
+  id?: Maybe<string>;
+  name?: Maybe<string>;
+  enabled?: Maybe<boolean>;
+  excluded?: Maybe<boolean>;
+  kqlQuery?: Maybe<string>;
+  queryMatch?: Maybe<QueryMatchResult>;
+  type?: Maybe<DataProviderType>;
+  and?: Maybe<DataProviderResult[]>;
+}
+
+export interface QueryMatchResult {
+  field?: Maybe<string>;
+  displayField?: Maybe<string>;
+  value?: Maybe<string>;
+  displayValue?: Maybe<string>;
+  operator?: Maybe<string>;
+}
+
+export interface DateRangePickerResult {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  start?: Maybe<any>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  end?: Maybe<any>;
+}
+
+export interface EqlOptionsResult {
+  eventCategoryField?: Maybe<string>;
+  tiebreakerField?: Maybe<string>;
+  timestampField?: Maybe<string>;
+  query?: Maybe<string>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  size?: Maybe<any>;
+}
+
+export interface FilterTimelineResult {
+  exists?: Maybe<string>;
+  meta?: Maybe<FilterMetaTimelineResult>;
+  match_all?: Maybe<string>;
+  missing?: Maybe<string>;
+  query?: Maybe<string>;
+  range?: Maybe<string>;
+  script?: Maybe<string>;
+}
+
+export interface FilterMetaTimelineResult {
+  alias?: Maybe<string>;
+  controlledBy?: Maybe<string>;
+  disabled?: Maybe<boolean>;
+  field?: Maybe<string>;
+  formattedValue?: Maybe<string>;
+  index?: Maybe<string>;
+  key?: Maybe<string>;
+  negate?: Maybe<boolean>;
+  params?: Maybe<string>;
+  type?: Maybe<string>;
+  value?: Maybe<string>;
+}
+
+export interface SerializedFilterQueryResult {
+  filterQuery?: Maybe<SerializedKueryQueryResult>;
+}
+
+export interface SerializedKueryQueryResult {
+  kuery?: Maybe<KueryFilterQueryResult>;
+  serializedQuery?: Maybe<string>;
+}
+
+export interface KueryFilterQueryResult {
+  kind?: Maybe<string>;
+  expression?: Maybe<string>;
+}
+
+export interface TimelineResult {
+  columns?: Maybe<ColumnHeaderResult[]>;
+  created?: Maybe<number>;
+  createdBy?: Maybe<string>;
+  dataProviders?: Maybe<DataProviderResult[]>;
+  dateRange?: Maybe<DateRangePickerResult>;
+  description?: Maybe<string>;
+  eqlOptions?: Maybe<EqlOptionsResult>;
+  eventIdToNoteIds?: Maybe<NoteResult[]>;
+  eventType?: Maybe<string>;
+  excludedRowRendererIds?: Maybe<RowRendererId[]>;
+  favorite?: Maybe<FavoriteTimelineResult[]>;
+  filters?: Maybe<FilterTimelineResult[]>;
+  kqlMode?: Maybe<string>;
+  kqlQuery?: Maybe<SerializedFilterQueryResult>;
+  indexNames?: Maybe<string[]>;
+  notes?: Maybe<NoteResult[]>;
+  noteIds?: Maybe<string[]>;
+  pinnedEventIds?: Maybe<string[]>;
+  pinnedEventsSaveObject?: Maybe<PinnedEvent[]>;
+  savedQueryId?: Maybe<string>;
+  savedObjectId: string;
+  sort?: Maybe<Sort>;
+  status?: Maybe<TimelineStatus>;
+  title?: Maybe<string>;
+  templateTimelineId?: Maybe<string>;
+  templateTimelineVersion?: Maybe<number>;
+  timelineType?: Maybe<TimelineType>;
+  updated?: Maybe<number>;
+  updatedBy?: Maybe<string>;
+  version: string;
+}
+
+export interface ResponseTimeline {
+  code?: Maybe<number>;
+  message?: Maybe<string>;
+  timeline: TimelineResult;
+}
+export interface SortTimeline {
+  sortField: SortFieldTimeline;
+  sortOrder: Direction;
+}
+
+export interface GetAllTimelineVariables {
+  pageInfo: PageInfoTimeline;
+  search?: Maybe<string>;
+  sort?: Maybe<SortTimeline>;
+  onlyUserFavorite?: Maybe<boolean>;
+  timelineType?: Maybe<TimelineType>;
+  status?: Maybe<TimelineStatus>;
+}
diff --git a/x-pack/plugins/security_solution/common/types/timeline/note/index.ts b/x-pack/plugins/security_solution/common/types/timeline/note/index.ts
index 1a97a59444a568..074e4132efdffb 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/note/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/note/index.ts
@@ -8,6 +8,7 @@
 /* eslint-disable @typescript-eslint/no-empty-interface */
 
 import * as runtimeTypes from 'io-ts';
+import { Direction, Maybe } from '../../../search_strategy/common';
 
 import { unionWithNullType } from '../../../utility_types';
 
@@ -63,3 +64,64 @@ export const NoteSavedObjectToReturnRuntimeType = runtimeTypes.intersection([
 
 export interface NoteSavedObject
   extends runtimeTypes.TypeOf<typeof NoteSavedObjectToReturnRuntimeType> {}
+
+export enum SortFieldNote {
+  updatedBy = 'updatedBy',
+  updated = 'updated',
+}
+
+export const pageInfoNoteRt = runtimeTypes.type({
+  pageIndex: runtimeTypes.number,
+  pageSize: runtimeTypes.number,
+});
+
+export type PageInfoNote = runtimeTypes.TypeOf<typeof pageInfoNoteRt>;
+
+export const sortNoteRt = runtimeTypes.type({
+  sortField: runtimeTypes.union([
+    runtimeTypes.literal(SortFieldNote.updatedBy),
+    runtimeTypes.literal(SortFieldNote.updated),
+  ]),
+  sortOrder: runtimeTypes.union([
+    runtimeTypes.literal(Direction.asc),
+    runtimeTypes.literal(Direction.desc),
+  ]),
+});
+
+export type SortNote = runtimeTypes.TypeOf<typeof sortNoteRt>;
+
+export interface NoteResult {
+  eventId?: Maybe<string>;
+
+  note?: Maybe<string>;
+
+  timelineId?: Maybe<string>;
+
+  noteId: string;
+
+  created?: Maybe<number>;
+
+  createdBy?: Maybe<string>;
+
+  timelineVersion?: Maybe<string>;
+
+  updated?: Maybe<number>;
+
+  updatedBy?: Maybe<string>;
+
+  version?: Maybe<string>;
+}
+
+export interface ResponseNotes {
+  notes: NoteResult[];
+
+  totalCount?: Maybe<number>;
+}
+
+export interface ResponseNote {
+  code?: Maybe<number>;
+
+  message?: Maybe<string>;
+
+  note: NoteResult;
+}
diff --git a/x-pack/plugins/security_solution/common/types/timeline/pinned_event/index.ts b/x-pack/plugins/security_solution/common/types/timeline/pinned_event/index.ts
index ba6ac673aa7d4b..dbb19df7a6b05a 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/pinned_event/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/pinned_event/index.ts
@@ -8,6 +8,7 @@
 /* eslint-disable @typescript-eslint/no-empty-interface */
 
 import * as runtimeTypes from 'io-ts';
+import { Maybe } from '../../../search_strategy/common';
 
 import { unionWithNullType } from '../../../utility_types';
 
@@ -58,3 +59,27 @@ export const PinnedEventToReturnSavedObjectRuntimeType = runtimeTypes.intersecti
 
 export interface PinnedEventSavedObject
   extends runtimeTypes.TypeOf<typeof PinnedEventToReturnSavedObjectRuntimeType> {}
+
+export interface PinnedEvent {
+  code?: Maybe<number>;
+
+  message?: Maybe<string>;
+
+  pinnedEventId: string;
+
+  eventId?: Maybe<string>;
+
+  timelineId?: Maybe<string>;
+
+  timelineVersion?: Maybe<string>;
+
+  created?: Maybe<number>;
+
+  createdBy?: Maybe<string>;
+
+  updated?: Maybe<number>;
+
+  updatedBy?: Maybe<string>;
+
+  version?: Maybe<string>;
+}
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
index 129d592edd264b..2a36a3d707aa86 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
@@ -65,11 +65,14 @@ import { openJsonView, scrollJsonViewToBottom } from '../../tasks/alerts_details
 import {
   changeRowsPerPageTo300,
   duplicateFirstRule,
+  duplicateSelectedRules,
   duplicateRuleFromMenu,
   filterByCustomRules,
   goToCreateNewRule,
   goToRuleDetails,
   waitForRulesTableToBeLoaded,
+  selectNumberOfRules,
+  checkDuplicatedRule,
 } from '../../tasks/alerts_detection_rules';
 import { createCustomIndicatorRule } from '../../tasks/api_calls/rules';
 import { cleanKibana, reload } from '../../tasks/common';
@@ -99,7 +102,7 @@ import {
   waitForAlertsToPopulate,
   waitForTheRuleToBeExecuted,
 } from '../../tasks/create_new_rule';
-import { waitForKibana } from '../../tasks/edit_rule';
+import { goBackToRuleDetails, waitForKibana } from '../../tasks/edit_rule';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { addsFieldsToTimeline, goBackToAllRulesTable } from '../../tasks/rule_details';
@@ -564,16 +567,26 @@ describe('indicator match', () => {
       it('Allows the rule to be duplicated from the table', () => {
         waitForKibana();
         duplicateFirstRule();
-        cy.contains(RULE_NAME, `${newThreatIndicatorRule.name} [Duplicate]`);
+        goBackToRuleDetails();
+        goBackToAllRulesTable();
+        checkDuplicatedRule();
+      });
+
+      it("Allows the rule to be duplicated from the table's bulk actions", () => {
+        waitForKibana();
+        selectNumberOfRules(1);
+        duplicateSelectedRules();
+        checkDuplicatedRule();
       });
 
       it('Allows the rule to be duplicated from the edit screen', () => {
         waitForKibana();
         goToRuleDetails();
         duplicateRuleFromMenu();
+        goBackToRuleDetails();
         goBackToAllRulesTable();
         reload();
-        cy.contains(RULE_NAME, `${newThreatIndicatorRule.name} [Duplicate]`);
+        checkDuplicatedRule();
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts
index 5d5d125082b8b0..320d5979cb0703 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/open_timeline.spec.ts
@@ -33,7 +33,8 @@ import { waitForTimelinesPanelToBeLoaded } from '../../tasks/timelines';
 
 import { TIMELINES_URL } from '../../urls/navigation';
 
-describe('Open timeline', () => {
+// FLAKY: https://github.com/elastic/kibana/issues/97544
+describe.skip('Open timeline', () => {
   let timelineId: string | null = null;
   before(() => {
     cleanKibana();
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index 099cd39ba2d7b9..957046cae003a6 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -320,6 +320,8 @@ export const newThreatIndicatorRule: ThreatIndicatorRule = {
   maxSignals: 100,
 };
 
+export const duplicatedRuleName = `${newThreatIndicatorRule.name} [Duplicate]`;
+
 export const severitiesOverride = ['Low', 'Medium', 'High', 'Critical'];
 
 export const editedRule = {
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
index c74284eee15e41..70dde344c88b6c 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
@@ -27,6 +27,8 @@ export const REFRESH_BTN = '[data-test-subj="refreshRulesAction"] button';
 
 export const DELETE_RULE_BULK_BTN = '[data-test-subj="deleteRuleBulk"]';
 
+export const DUPLICATE_RULE_BULK_BTN = '[data-test-subj="duplicateRuleBulk"]';
+
 export const ELASTIC_RULES_BTN = '[data-test-subj="showElasticRulesFilterButton"]';
 
 export const EXPORT_ACTION_BTN = '[data-test-subj="exportRuleAction"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
index 8b9d9b144910d4..db8d93dfbbef9c 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
@@ -111,8 +111,6 @@ export const LOOK_BACK_TIME_TYPE =
 export const MACHINE_LEARNING_DROPDOWN_INPUT =
   '[data-test-subj="mlJobSelect"] [data-test-subj="comboBoxInput"]';
 
-export const MACHINE_LEARNING_DROPDOWN_ITEM = '.euiFilterSelectItem';
-
 export const MACHINE_LEARNING_TYPE = '[data-test-subj="machineLearningRuleType"]';
 
 export const MITRE_TACTIC = '.euiContextMenuItem__text';
diff --git a/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts b/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
index a6cdf0c75535ff..8d8520e109b15e 100644
--- a/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
@@ -6,5 +6,6 @@
  */
 
 export const EDIT_SUBMIT_BUTTON = '[data-test-subj="ruleEditSubmitButton"]';
+export const BACK_TO_RULE_DETAILS = '[data-test-subj="ruleEditBackToRuleDetails"]';
 export const KIBANA_LOADING_INDICATOR = '[data-test-subj="globalLoadingIndicator"]';
 export const KIBANA_LOADING_COMPLETE_INDICATOR = '[data-test-subj="globalLoadingIndicator-hidden"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
index d66b839267ea0f..cc14c54a4d84e3 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { duplicatedRuleName } from '../objects/rule';
 import {
   BULK_ACTIONS_BTN,
   COLLAPSED_ACTION_BTN,
@@ -33,6 +34,8 @@ import {
   pageSelector,
   DUPLICATE_RULE_ACTION_BTN,
   DUPLICATE_RULE_MENU_PANEL_BTN,
+  DUPLICATE_RULE_BULK_BTN,
+  RULES_ROW,
 } from '../screens/alerts_detection_rules';
 import { ALL_ACTIONS, DELETE_RULE } from '../screens/rule_details';
 
@@ -54,6 +57,11 @@ export const duplicateFirstRule = () => {
   cy.get(DUPLICATE_RULE_ACTION_BTN).click();
 };
 
+export const duplicateSelectedRules = () => {
+  cy.get(BULK_ACTIONS_BTN).click({ force: true });
+  cy.get(DUPLICATE_RULE_BULK_BTN).click();
+};
+
 /**
  * Duplicates the rule from the menu and does additional
  * pipes and checking that the elements are present on the
@@ -69,9 +77,18 @@ export const duplicateRuleFromMenu = () => {
     })
     .should(($el) => expect($el).to.be.visible);
   // Because of a fade effect and fast clicking this can produce more than one click
-  cy.get(DUPLICATE_RULE_MENU_PANEL_BTN)
-    .pipe(($el) => $el.trigger('click'))
-    .should('not.be.visible');
+  cy.get(DUPLICATE_RULE_MENU_PANEL_BTN).pipe(($el) => $el.trigger('click'));
+};
+
+/**
+ * Check that the duplicated rule is on the table
+ * and it is deactivated (default)
+ */
+export const checkDuplicatedRule = () => {
+  cy.contains(RULE_NAME, duplicatedRuleName)
+    .parents(RULES_ROW)
+    .find(RULE_SWITCH)
+    .should('have.attr', 'aria-checked', 'false');
 };
 
 export const deleteFirstRule = () => {
diff --git a/x-pack/plugins/security_solution/cypress/tasks/api_calls/notes.ts b/x-pack/plugins/security_solution/cypress/tasks/api_calls/notes.ts
index 0fc1a863956054..83651a0cbfd0bc 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/api_calls/notes.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/api_calls/notes.ts
@@ -7,17 +7,12 @@
 
 export const addNoteToTimeline = (note: string, timelineId: string) =>
   cy.request({
-    method: 'POST',
-    url: '/api/solutions/security/graphql',
+    method: 'PATCH',
+    url: '/api/note',
     body: {
-      operationName: 'PersistTimelineNoteMutation',
-      variables: {
-        noteId: null,
-        version: null,
-        note: { note, timelineId },
-      },
-      query:
-        'mutation PersistTimelineNoteMutation($noteId: ID, $version: String, $note: NoteInput!) {\n  persistNote(noteId: $noteId, version: $version, note: $note) {\n    code\n    message\n    note {\n      eventId\n      note\n      timelineId\n      timelineVersion\n      noteId\n      created\n      createdBy\n      updated\n      updatedBy\n      version\n      __typename\n    }\n    __typename\n  }\n}\n',
+      noteId: null,
+      version: null,
+      note: { note, timelineId },
     },
     headers: { 'kbn-xsrf': 'cypress-creds' },
   });
diff --git a/x-pack/plugins/security_solution/cypress/tasks/api_calls/timelines.ts b/x-pack/plugins/security_solution/cypress/tasks/api_calls/timelines.ts
index 4cfd1e7f899864..453c2db8afd657 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/api_calls/timelines.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/api_calls/timelines.ts
@@ -98,13 +98,9 @@ export const createTimelineTemplate = (timeline: CompleteTimeline) =>
 export const deleteTimeline = (timelineId: string) => {
   cy.request({
     method: 'POST',
-    url: 'api/solutions/security/graphql',
+    url: 'api/timeline',
     body: {
-      operationName: 'DeleteTimelineMutation',
-      variables: {
-        id: [timelineId],
-      },
-      query: 'mutation DeleteTimelineMutation($id: [ID!]!) {\n  deleteTimeline(id: $id)\n}\n',
+      id: [timelineId],
     },
     headers: { 'kbn-xsrf': 'delete-signals' },
   });
@@ -112,15 +108,7 @@ export const deleteTimeline = (timelineId: string) => {
 
 export const getTimelineById = (timelineId: string) =>
   cy.request({
-    method: 'POST',
-    url: 'api/solutions/security/graphql',
-    body: {
-      operationName: 'GetOneTimeline',
-      variables: {
-        id: timelineId,
-      },
-      query:
-        'query GetOneTimeline($id: ID!, $timelineType: TimelineType) {\n  getOneTimeline(id: $id, timelineType: $timelineType) {\n    savedObjectId\n    columns {\n      aggregatable\n      category\n      columnHeaderType\n      description\n      example\n      indexes\n      id\n      name\n      searchable\n      type\n      __typename\n    }\n    dataProviders {\n      id\n      name\n      enabled\n      excluded\n      kqlQuery\n      type\n      queryMatch {\n        field\n        displayField\n        value\n        displayValue\n        operator\n        __typename\n      }\n      and {\n        id\n        name\n        enabled\n        excluded\n        kqlQuery\n        type\n        queryMatch {\n          field\n          displayField\n          value\n          displayValue\n          operator\n          __typename\n        }\n        __typename\n      }\n      __typename\n    }\n    dateRange {\n      start\n      end\n      __typename\n    }\n    description\n    eventType\n    eventIdToNoteIds {\n      eventId\n      note\n      timelineId\n      noteId\n      created\n      createdBy\n      timelineVersion\n      updated\n      updatedBy\n      version\n      __typename\n    }\n    excludedRowRendererIds\n    favorite {\n      fullName\n      userName\n      favoriteDate\n      __typename\n    }\n    filters {\n      meta {\n        alias\n        controlledBy\n        disabled\n        field\n        formattedValue\n        index\n        key\n        negate\n        params\n        type\n        value\n        __typename\n      }\n      query\n      exists\n      match_all\n      missing\n      range\n      script\n      __typename\n    }\n    kqlMode\n    kqlQuery {\n      filterQuery {\n        kuery {\n          kind\n          expression\n          __typename\n        }\n        serializedQuery\n        __typename\n      }\n      __typename\n    }\n    indexNames\n    notes {\n      eventId\n      note\n      timelineId\n      timelineVersion\n      noteId\n      created\n      createdBy\n      updated\n      updatedBy\n      version\n      __typename\n    }\n    noteIds\n    pinnedEventIds\n    pinnedEventsSaveObject {\n      pinnedEventId\n      eventId\n      timelineId\n      created\n      createdBy\n      updated\n      updatedBy\n      version\n      __typename\n    }\n    status\n    title\n    timelineType\n    templateTimelineId\n    templateTimelineVersion\n    savedQueryId\n    sort\n    created\n    createdBy\n    updated\n    updatedBy\n    version\n    __typename\n  }\n}\n',
-    },
+    method: 'GET',
+    url: `api/timeline?id=${timelineId}`,
     headers: { 'kbn-xsrf': 'timeline-by-id' },
   });
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
index 9f957a0cb9a952..cd342e94569065 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
@@ -85,7 +85,6 @@ import {
   THRESHOLD_FIELD_SELECTION,
   THRESHOLD_INPUT_AREA,
   THRESHOLD_TYPE,
-  MACHINE_LEARNING_DROPDOWN_ITEM,
 } from '../screens/create_new_rule';
 import { TOAST_ERROR } from '../screens/shared';
 import { SERVER_SIDE_EVENT_COUNT } from '../screens/timeline';
@@ -436,7 +435,7 @@ export const fillDefineIndicatorMatchRuleAndContinue = (rule: ThreatIndicatorRul
 export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRule) => {
   rule.machineLearningJobs.forEach((machineLearningJob) => {
     cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).click({ force: true });
-    cy.contains(MACHINE_LEARNING_DROPDOWN_ITEM, machineLearningJob).click();
+    cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type(`${machineLearningJob}{enter}`);
     cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type('{esc}');
   });
   cy.get(ANOMALY_THRESHOLD_INPUT).type(`{selectall}${machineLearningRule.anomalyScoreThreshold}`, {
diff --git a/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts
index e9691f2d922aef..2af563973b3d3d 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts
@@ -5,13 +5,22 @@
  * 2.0.
  */
 
-import { EDIT_SUBMIT_BUTTON, KIBANA_LOADING_COMPLETE_INDICATOR } from '../screens/edit_rule';
+import {
+  BACK_TO_RULE_DETAILS,
+  EDIT_SUBMIT_BUTTON,
+  KIBANA_LOADING_COMPLETE_INDICATOR,
+} from '../screens/edit_rule';
 
 export const saveEditedRule = () => {
   cy.get(EDIT_SUBMIT_BUTTON).should('exist').click({ force: true });
   cy.get(EDIT_SUBMIT_BUTTON).should('not.exist');
 };
 
+export const goBackToRuleDetails = () => {
+  cy.get(BACK_TO_RULE_DETAILS).should('exist').click();
+  cy.get(BACK_TO_RULE_DETAILS).should('not.exist');
+};
+
 export const waitForKibana = () => {
   cy.get(KIBANA_LOADING_COMPLETE_INDICATOR).should('exist');
 };
diff --git a/x-pack/plugins/security_solution/public/app/app.tsx b/x-pack/plugins/security_solution/public/app/app.tsx
index 451e29543fa034..09173548948349 100644
--- a/x-pack/plugins/security_solution/public/app/app.tsx
+++ b/x-pack/plugins/security_solution/public/app/app.tsx
@@ -7,7 +7,6 @@
 
 import { History } from 'history';
 import React, { memo, FC } from 'react';
-import { ApolloProvider } from 'react-apollo';
 import { Store, Action } from 'redux';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
@@ -19,30 +18,22 @@ import { DEFAULT_DARK_MODE, APP_NAME } from '../../common/constants';
 import { ErrorToastDispatcher } from '../common/components/error_toast_dispatcher';
 import { MlCapabilitiesProvider } from '../common/components/ml/permissions/ml_capabilities_provider';
 import { GlobalToaster, ManageGlobalToaster } from '../common/components/toasters';
-import { AppFrontendLibs } from '../common/lib/lib';
 import { KibanaContextProvider, useKibana, useUiSetting$ } from '../common/lib/kibana';
 import { State } from '../common/store';
 
-import { ApolloClientContext } from '../common/utils/apollo_context';
 import { ManageGlobalTimeline } from '../timelines/components/manage_timeline';
 import { StartServices } from '../types';
 import { PageRouter } from './routes';
 import { EuiThemeProvider } from '../../../../../src/plugins/kibana_react/common';
 
-interface StartAppComponent extends AppFrontendLibs {
+interface StartAppComponent {
   children: React.ReactNode;
   history: History;
   onAppLeave: (handler: AppLeaveHandler) => void;
   store: Store<State, Action>;
 }
 
-const StartAppComponent: FC<StartAppComponent> = ({
-  children,
-  apolloClient,
-  history,
-  onAppLeave,
-  store,
-}) => {
+const StartAppComponent: FC<StartAppComponent> = ({ children, history, onAppLeave, store }) => {
   const { i18n } = useKibana().services;
   const [darkMode] = useUiSetting$<boolean>(DEFAULT_DARK_MODE);
 
@@ -52,21 +43,17 @@ const StartAppComponent: FC<StartAppComponent> = ({
         <ManageGlobalToaster>
           <ManageGlobalTimeline>
             <ReduxStoreProvider store={store}>
-              <ApolloProvider client={apolloClient}>
-                <ApolloClientContext.Provider value={apolloClient}>
-                  <EuiThemeProvider darkMode={darkMode}>
-                    <MlCapabilitiesProvider>
-                      <ManageUserInfo>
-                        <PageRouter history={history} onAppLeave={onAppLeave}>
-                          {children}
-                        </PageRouter>
-                      </ManageUserInfo>
-                    </MlCapabilitiesProvider>
-                  </EuiThemeProvider>
-                  <ErrorToastDispatcher />
-                  <GlobalToaster />
-                </ApolloClientContext.Provider>
-              </ApolloProvider>
+              <EuiThemeProvider darkMode={darkMode}>
+                <MlCapabilitiesProvider>
+                  <ManageUserInfo>
+                    <PageRouter history={history} onAppLeave={onAppLeave}>
+                      {children}
+                    </PageRouter>
+                  </ManageUserInfo>
+                </MlCapabilitiesProvider>
+              </EuiThemeProvider>
+              <ErrorToastDispatcher />
+              <GlobalToaster />
             </ReduxStoreProvider>
           </ManageGlobalTimeline>
         </ManageGlobalToaster>
@@ -77,7 +64,7 @@ const StartAppComponent: FC<StartAppComponent> = ({
 
 const StartApp = memo(StartAppComponent);
 
-interface SecurityAppComponentProps extends AppFrontendLibs {
+interface SecurityAppComponentProps {
   children: React.ReactNode;
   history: History;
   onAppLeave: (handler: AppLeaveHandler) => void;
@@ -87,7 +74,6 @@ interface SecurityAppComponentProps extends AppFrontendLibs {
 
 const SecurityAppComponent: React.FC<SecurityAppComponentProps> = ({
   children,
-  apolloClient,
   history,
   onAppLeave,
   services,
@@ -99,7 +85,7 @@ const SecurityAppComponent: React.FC<SecurityAppComponentProps> = ({
       ...services,
     }}
   >
-    <StartApp apolloClient={apolloClient} history={history} onAppLeave={onAppLeave} store={store}>
+    <StartApp history={history} onAppLeave={onAppLeave} store={store}>
       {children}
     </StartApp>
   </KibanaContextProvider>
diff --git a/x-pack/plugins/security_solution/public/app/index.tsx b/x-pack/plugins/security_solution/public/app/index.tsx
index dadba699bd243f..1e304c26869602 100644
--- a/x-pack/plugins/security_solution/public/app/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/index.tsx
@@ -12,7 +12,6 @@ import { SecurityApp } from './app';
 import { RenderAppProps } from './types';
 
 export const renderApp = ({
-  apolloClient,
   element,
   history,
   onAppLeave,
@@ -21,13 +20,7 @@ export const renderApp = ({
   SubPluginRoutes,
 }: RenderAppProps): (() => void) => {
   render(
-    <SecurityApp
-      apolloClient={apolloClient}
-      history={history}
-      onAppLeave={onAppLeave}
-      services={services}
-      store={store}
-    >
+    <SecurityApp history={history} onAppLeave={onAppLeave} services={services} store={store}>
       <SubPluginRoutes />
     </SecurityApp>,
     element
diff --git a/x-pack/plugins/security_solution/public/app/types.ts b/x-pack/plugins/security_solution/public/app/types.ts
index 95e64fe37d3331..a617c6f14b9c48 100644
--- a/x-pack/plugins/security_solution/public/app/types.ts
+++ b/x-pack/plugins/security_solution/public/app/types.ts
@@ -19,12 +19,11 @@ import {
 
 import { AppMountParameters, AppSearchDeepLink } from '../../../../../src/core/public';
 import { StartServices } from '../types';
-import { AppFrontendLibs } from '../common/lib/lib';
 
 /**
  * The React properties used to render `SecurityApp` as well as the `element` to render it into.
  */
-export interface RenderAppProps extends AppFrontendLibs, AppMountParameters {
+export interface RenderAppProps extends AppMountParameters {
   services: StartServices;
   store: Store<State, Action>;
   SubPluginRoutes: React.FC;
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx
index 597566639a8d7d..0b3915c3d38d46 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.test.tsx
@@ -11,9 +11,6 @@ import { Router, mockHistory } from '../__mock__/router';
 import { UserActionMarkdown } from './user_action_markdown';
 import { TestProviders } from '../../../common/mock';
 import * as timelineHelpers from '../../../timelines/components/open_timeline/helpers';
-import { useApolloClient } from '../../../common/utils/apollo_context';
-const mockUseApolloClient = useApolloClient as jest.Mock;
-jest.mock('../../../common/utils/apollo_context');
 const onChangeEditable = jest.fn();
 const onSaveContent = jest.fn();
 
@@ -30,7 +27,6 @@ const defaultProps = {
 describe('UserActionMarkdown ', () => {
   const queryTimelineByIdSpy = jest.spyOn(timelineHelpers, 'queryTimelineById');
   beforeEach(() => {
-    mockUseApolloClient.mockClear();
     jest.resetAllMocks();
   });
 
@@ -49,7 +45,6 @@ describe('UserActionMarkdown ', () => {
       .simulate('click');
 
     expect(queryTimelineByIdSpy).toBeCalledWith({
-      apolloClient: mockUseApolloClient(),
       graphEventId: '',
       timelineId,
       updateIsLoading: expect.any(Function),
@@ -79,7 +74,6 @@ describe('UserActionMarkdown ', () => {
       .first()
       .simulate('click');
     expect(queryTimelineByIdSpy).toBeCalledWith({
-      apolloClient: mockUseApolloClient(),
       graphEventId: '',
       timelineId,
       updateIsLoading: expect.any(Function),
diff --git a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
index 1b812c6e81e827..66b8c00879b1c1 100644
--- a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
@@ -9,7 +9,6 @@ import { mount, shallow } from 'enzyme';
 import React from 'react';
 import { waitFor } from '@testing-library/react';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -37,23 +36,11 @@ jest.mock('../../lib/kibana', () => ({
 describe('AddFilterToGlobalSearchBar Component', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
     jest.useFakeTimers();
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     mockAddFilters.mockClear();
   });
 
diff --git a/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
index b58ecbdd3349da..98be87c737d58a 100644
--- a/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 import { Provider } from 'react-redux';
 
 import {
-  apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
@@ -24,22 +23,10 @@ import { State } from '../../store/types';
 describe('Error Toast Dispatcher', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
index 091049b967f025..5578264152c39a 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
@@ -10,10 +10,13 @@ import {
   EuiDescriptionList,
   EuiDescriptionListDescription,
   EuiDescriptionListTitle,
+  EuiSpacer,
 } from '@elastic/eui';
 import { get, getOr } from 'lodash/fp';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
+
+import * as i18n from './translations';
 import { FormattedFieldValue } from '../../../timelines/components/timeline/body/renderers/formatted_field';
 import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { BrowserFields } from '../../../../common/search_strategy/index_fields';
@@ -33,7 +36,6 @@ import { DESTINATION_IP_FIELD_NAME, SOURCE_IP_FIELD_NAME } from '../../../networ
 import { SummaryView } from './summary_view';
 import { AlertSummaryRow, getSummaryColumns, SummaryRow } from './helpers';
 import { useRuleAsync } from '../../../detections/containers/detection_engine/rules/use_rule_async';
-import * as i18n from './translations';
 import { LineClamp } from '../line_clamp';
 
 const StyledEuiDescriptionList = styled(EuiDescriptionList)`
@@ -166,7 +168,8 @@ const AlertSummaryViewComponent: React.FC<{
   data: TimelineEventsDetailsItem[];
   eventId: string;
   timelineId: string;
-}> = ({ browserFields, data, eventId, timelineId }) => {
+  title?: string;
+}> = ({ browserFields, data, eventId, timelineId, title }) => {
   const summaryRows = useMemo(() => getSummaryRows({ browserFields, data, eventId, timelineId }), [
     browserFields,
     data,
@@ -184,7 +187,8 @@ const AlertSummaryViewComponent: React.FC<{
 
   return (
     <>
-      <SummaryView summaryColumns={summaryColumns} summaryRows={summaryRows} />
+      <EuiSpacer size="l" />
+      <SummaryView summaryColumns={summaryColumns} summaryRows={summaryRows} title={title} />
       {maybeRule?.note && (
         <StyledEuiDescriptionList data-test-subj={`summary-view-guide`} compressed>
           <EuiDescriptionListTitle>{i18n.INVESTIGATION_GUIDE}</EuiDescriptionListTitle>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/columns.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/columns.tsx
index a62b652492c5f4..836a67441ef8a8 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/columns.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/columns.tsx
@@ -21,7 +21,6 @@ import styled from 'styled-components';
 
 import { onFocusReFocusDraggable } from '../accessibility/helpers';
 import { BrowserFields } from '../../containers/source';
-import { ToStringArray } from '../../../graphql/types';
 import { ColumnHeaderOptions } from '../../../timelines/store/timeline/model';
 import { DragEffects } from '../drag_and_drop/draggable_wrapper';
 import { DroppableWrapper } from '../drag_and_drop/droppable_wrapper';
@@ -175,7 +174,7 @@ export const getColumns = ({
     name: i18n.VALUE,
     sortable: true,
     truncateText: false,
-    render: (values: ToStringArray | null | undefined, data: EventFieldsData) => (
+    render: (values: string[] | null | undefined, data: EventFieldsData) => (
       <FullWidthFlexGroup
         direction="column"
         alignItems="flexStart"
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/empty_threat_details_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/empty_threat_details_view.test.tsx
new file mode 100644
index 00000000000000..b3e70fd17c0e12
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/empty_threat_details_view.test.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { ThemeProvider } from 'styled-components';
+
+import { useMountAppended } from '../../utils/use_mount_appended';
+import { getMockTheme } from '../../lib/kibana/kibana_react.mock';
+import { EmptyThreatDetailsView } from './empty_threat_details_view';
+
+jest.mock('../../lib/kibana');
+
+describe('EmptyThreatDetailsView', () => {
+  const mount = useMountAppended();
+  const mockTheme = getMockTheme({
+    eui: {
+      euiBreakpoints: {
+        l: '1200px',
+      },
+      paddingSizes: {
+        m: '8px',
+        xl: '32px',
+      },
+    },
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('renders correct items', () => {
+    const wrapper = mount(
+      <ThemeProvider theme={mockTheme}>
+        <EmptyThreatDetailsView />
+      </ThemeProvider>
+    );
+    expect(wrapper.find('[data-test-subj="empty-threat-details-view"]').exists()).toEqual(true);
+  });
+
+  test('renders link to docs', () => {
+    const wrapper = mount(
+      <ThemeProvider theme={mockTheme}>
+        <EmptyThreatDetailsView />
+      </ThemeProvider>
+    );
+    expect(wrapper.find('a').exists()).toEqual(true);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/empty_threat_details_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/empty_threat_details_view.tsx
new file mode 100644
index 00000000000000..c78df92dceb3c1
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/empty_threat_details_view.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiLink, EuiSpacer, EuiTitle } from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+import * as i18n from './translations';
+import { useKibana } from '../../lib/kibana';
+
+const EmptyThreatDetailsViewContainer = styled.div`
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+`;
+
+const Span = styled.span`
+  color: ${({ theme }) => theme.eui.euiColorDarkShade};
+  line-height: 1.8em;
+  text-align: center;
+  padding: ${({ theme }) => `${theme.eui.paddingSizes.m} ${theme.eui.paddingSizes.xl}`};
+`;
+
+const EmptyThreatDetailsViewComponent: React.FC<{}> = () => {
+  const threatIntelDocsUrl = `${
+    useKibana().services.docLinks.links.filebeat.base
+  }/filebeat-module-threatintel.html`;
+
+  return (
+    <EmptyThreatDetailsViewContainer data-test-subj="empty-threat-details-view">
+      <EuiSpacer size="xxl" />
+      <EuiTitle size="m">
+        <h2>{i18n.NO_ENRICHMENT_FOUND}</h2>
+      </EuiTitle>
+      <Span>
+        {i18n.IF_CTI_NOT_ENABLED}
+        <EuiLink href={threatIntelDocsUrl} target="_blank">
+          {i18n.CHECK_DOCS}
+        </EuiLink>
+      </Span>
+    </EmptyThreatDetailsViewContainer>
+  );
+};
+
+EmptyThreatDetailsViewComponent.displayName = 'EmptyThreatDetailsView';
+
+export const EmptyThreatDetailsView = React.memo(EmptyThreatDetailsViewComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
index e799df0fdd10db..0c7515fe75d862 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
@@ -13,7 +13,7 @@ import '../../mock/match_media';
 import '../../mock/react_beautiful_dnd';
 import { mockDetailItemData, mockDetailItemDataId, TestProviders } from '../../mock';
 
-import { EventDetails, EventsViewType, EventView, ThreatView } from './event_details';
+import { EventDetails, EventsViewType } from './event_details';
 import { mockBrowserFields } from '../../containers/source/mock';
 import { useMountAppended } from '../../utils/use_mount_appended';
 import { mockAlertDetailsData } from './__mocks__';
@@ -32,8 +32,7 @@ describe('EventDetails', () => {
     onThreatViewSelected: jest.fn(),
     timelineTabType: TimelineTabs.query,
     timelineId: 'test',
-    eventView: EventsViewType.summaryView as EventView,
-    threatView: EventsViewType.threatSummaryView as ThreatView,
+    eventView: EventsViewType.summaryView,
   };
 
   const alertsProps = {
@@ -78,13 +77,14 @@ describe('EventDetails', () => {
   });
 
   describe('alerts tabs', () => {
-    ['Summary', 'Table', 'JSON View'].forEach((tab) => {
+    ['Summary', 'Threat Intel', 'Table', 'JSON View'].forEach((tab) => {
       test(`it renders the ${tab} tab`, () => {
+        const expectedCopy = tab === 'Threat Intel' ? `${tab} (1)` : tab;
         expect(
           alertsWrapper
             .find('[data-test-subj="eventDetails"]')
             .find('[role="tablist"]')
-            .containsMatchingElement(<span>{tab}</span>)
+            .containsMatchingElement(<span>{expectedCopy}</span>)
         ).toBeTruthy();
       });
     });
@@ -99,27 +99,4 @@ describe('EventDetails', () => {
       ).toEqual('Summary');
     });
   });
-
-  describe('threat tabs', () => {
-    ['Threat Summary', 'Threat Details'].forEach((tab) => {
-      test(`it renders the ${tab} tab`, () => {
-        expect(
-          alertsWrapper
-            .find('[data-test-subj="threatDetails"]')
-            .find('[role="tablist"]')
-            .containsMatchingElement(<span>{tab}</span>)
-        ).toBeTruthy();
-      });
-    });
-
-    test('the Summary tab is selected by default', () => {
-      expect(
-        alertsWrapper
-          .find('[data-test-subj="threatDetails"]')
-          .find('.euiTab-isSelected')
-          .first()
-          .text()
-      ).toEqual('Threat Summary');
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index 0e4cf7f4ae2fe7..91ebec72d38455 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -6,31 +6,37 @@
  */
 
 import { EuiTabbedContent, EuiTabbedContentTab, EuiSpacer } from '@elastic/eui';
-import React, { useCallback, useMemo } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 import styled from 'styled-components';
 
-import { BrowserFields } from '../../containers/source';
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
 import { EventFieldsBrowser } from './event_fields_browser';
 import { JsonView } from './json_view';
-import * as i18n from './translations';
-import { AlertSummaryView } from './alert_summary_view';
 import { ThreatSummaryView } from './threat_summary_view';
 import { ThreatDetailsView } from './threat_details_view';
+import * as i18n from './translations';
+import { AlertSummaryView } from './alert_summary_view';
+import { BrowserFields } from '../../containers/source';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
 import { TimelineTabs } from '../../../../common/types/timeline';
 import { INDICATOR_DESTINATION_PATH } from '../../../../common/constants';
+import { getDataFromSourceHits } from '../../../../common/utils/field_formatters';
+
+interface EventViewTab {
+  id: EventViewId;
+  name: string;
+  content: JSX.Element;
+}
 
-export type EventView =
+export type EventViewId =
   | EventsViewType.tableView
   | EventsViewType.jsonView
-  | EventsViewType.summaryView;
-export type ThreatView = EventsViewType.threatSummaryView | EventsViewType.threatDetailsView;
+  | EventsViewType.summaryView
+  | EventsViewType.threatIntelView;
 export enum EventsViewType {
   tableView = 'table-view',
   jsonView = 'json-view',
   summaryView = 'summary-view',
-  threatSummaryView = 'threat-summary-view',
-  threatDetailsView = 'threat-details-view',
+  threatIntelView = 'threat-intel-view',
 }
 
 interface Props {
@@ -38,10 +44,6 @@ interface Props {
   data: TimelineEventsDetailsItem[];
   id: string;
   isAlert: boolean;
-  eventView: EventView;
-  threatView: ThreatView;
-  onEventViewSelected: (selected: EventView) => void;
-  onThreatViewSelected: (selected: ThreatView) => void;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
 }
@@ -56,7 +58,8 @@ const StyledEuiTabbedContent = styled(EuiTabbedContent)`
     display: flex;
     flex: 1;
     flex-direction: column;
-    overflow: scroll;
+    overflow: hidden;
+    overflow-y: auto;
     ::-webkit-scrollbar {
       -webkit-appearance: none;
       width: 7px;
@@ -77,132 +80,125 @@ const TabContentWrapper = styled.div`
 const EventDetailsComponent: React.FC<Props> = ({
   browserFields,
   data,
-  eventView,
   id,
   isAlert,
-  onEventViewSelected,
-  onThreatViewSelected,
-  threatView,
   timelineId,
   timelineTabType,
 }) => {
-  const handleEventTabClick = useCallback((e) => onEventViewSelected(e.id), [onEventViewSelected]);
-  const handleThreatTabClick = useCallback((e) => onThreatViewSelected(e.id), [
-    onThreatViewSelected,
-  ]);
-
-  const alerts = useMemo(
-    () => [
-      {
-        id: EventsViewType.summaryView,
-        name: i18n.SUMMARY,
-        content: (
-          <>
-            <EuiSpacer size="l" />
-            <AlertSummaryView
-              {...{
-                data,
-                eventId: id,
-                browserFields,
-                timelineId,
-              }}
-            />
-          </>
-        ),
-      },
-    ],
-    [data, id, browserFields, timelineId]
-  );
-  const tabs: EuiTabbedContentTab[] = useMemo(
-    () => [
-      ...(isAlert ? alerts : []),
-      {
-        id: EventsViewType.tableView,
-        name: i18n.TABLE,
-        content: (
-          <>
-            <EuiSpacer size="l" />
-            <EventFieldsBrowser
-              browserFields={browserFields}
-              data={data}
-              eventId={id}
-              timelineId={timelineId}
-              timelineTabType={timelineTabType}
-            />
-          </>
-        ),
-      },
-      {
-        id: EventsViewType.jsonView,
-        'data-test-subj': 'jsonViewTab',
-        name: i18n.JSON_VIEW,
-        content: (
-          <>
-            <EuiSpacer size="m" />
-            <TabContentWrapper>
-              <JsonView data={data} />
-            </TabContentWrapper>
-          </>
-        ),
-      },
-    ],
-    [alerts, browserFields, data, id, isAlert, timelineId, timelineTabType]
+  const [selectedTabId, setSelectedTabId] = useState<EventViewId>(EventsViewType.summaryView);
+  const handleTabClick = useCallback(
+    (tab: EuiTabbedContentTab) => setSelectedTabId(tab.id as EventViewId),
+    [setSelectedTabId]
   );
 
-  const selectedEventTab = useMemo(() => tabs.find((t) => t.id === eventView) ?? tabs[0], [
-    tabs,
-    eventView,
-  ]);
+  const threatData = useMemo(() => {
+    if (isAlert && data) {
+      const threatIndicator = data.find(
+        ({ field, originalValue }) => field === INDICATOR_DESTINATION_PATH && originalValue
+      );
+      if (!threatIndicator) return [];
+      const { originalValue } = threatIndicator;
+      const values = Array.isArray(originalValue) ? originalValue : [originalValue];
+      return values.map((value) => getDataFromSourceHits(JSON.parse(value)));
+    }
+    return [];
+  }, [data, isAlert]);
+
+  const threatCount = useMemo(() => threatData.length, [threatData.length]);
+
+  const summaryTab = useMemo(
+    () =>
+      isAlert
+        ? {
+            id: EventsViewType.summaryView,
+            name: i18n.SUMMARY,
+            content: (
+              <>
+                <AlertSummaryView
+                  {...{
+                    data,
+                    eventId: id,
+                    browserFields,
+                    timelineId,
+                    title: threatCount ? i18n.ALERT_SUMMARY : undefined,
+                  }}
+                />
+                {threatCount > 0 && <ThreatSummaryView {...{ data, timelineId, eventId: id }} />}
+              </>
+            ),
+          }
+        : undefined,
+    [browserFields, data, id, isAlert, timelineId, threatCount]
+  );
 
-  const isThreatPresent: boolean = useMemo(
+  const threatIntelTab = useMemo(
     () =>
-      selectedEventTab.id === tabs[0].id &&
-      isAlert &&
-      data.some((item) => item.field === INDICATOR_DESTINATION_PATH),
-    [tabs, selectedEventTab, isAlert, data]
+      isAlert
+        ? {
+            id: EventsViewType.threatIntelView,
+            name: `${i18n.THREAT_INTEL} (${threatCount})`,
+            content: <ThreatDetailsView threatData={threatData} />,
+          }
+        : undefined,
+    [isAlert, threatCount, threatData]
   );
 
-  const threatTabs: EuiTabbedContentTab[] = useMemo(() => {
-    return isAlert && isThreatPresent
-      ? [
-          {
-            id: EventsViewType.threatSummaryView,
-            name: i18n.THREAT_SUMMARY,
-            content: <ThreatSummaryView {...{ data, eventId: id, timelineId }} />,
-          },
-          {
-            id: EventsViewType.threatDetailsView,
-            name: i18n.THREAT_DETAILS,
-            content: <ThreatDetailsView data={data} />,
-          },
-        ]
-      : [];
-  }, [data, id, isAlert, timelineId, isThreatPresent]);
-
-  const selectedThreatTab = useMemo(
-    () => threatTabs.find((t) => t.id === threatView) ?? threatTabs[0],
-    [threatTabs, threatView]
+  const tableTab = useMemo(
+    () => ({
+      id: EventsViewType.tableView,
+      name: i18n.TABLE,
+      content: (
+        <>
+          <EuiSpacer size="l" />
+          <EventFieldsBrowser
+            browserFields={browserFields}
+            data={data}
+            eventId={id}
+            timelineId={timelineId}
+            timelineTabType={timelineTabType}
+          />
+        </>
+      ),
+    }),
+    [browserFields, data, id, timelineId, timelineTabType]
   );
 
+  const jsonTab = useMemo(
+    () => ({
+      id: EventsViewType.jsonView,
+      'data-test-subj': 'jsonViewTab',
+      name: i18n.JSON_VIEW,
+      content: (
+        <>
+          <EuiSpacer size="m" />
+          <TabContentWrapper>
+            <JsonView data={data} />
+          </TabContentWrapper>
+        </>
+      ),
+    }),
+    [data]
+  );
+
+  const tabs = useMemo(() => {
+    return [summaryTab, threatIntelTab, tableTab, jsonTab].filter(
+      (tab: EventViewTab | undefined): tab is EventViewTab => !!tab
+    );
+  }, [summaryTab, threatIntelTab, tableTab, jsonTab]);
+
+  const selectedTab = useMemo(() => tabs.find((tab) => tab.id === selectedTabId), [
+    tabs,
+    selectedTabId,
+  ]);
+
   return (
-    <>
-      <StyledEuiTabbedContent
-        data-test-subj="eventDetails"
-        tabs={tabs}
-        selectedTab={selectedEventTab}
-        onTabClick={handleEventTabClick}
-        key="event-summary-tabs"
-      />
-      {isThreatPresent && (
-        <StyledEuiTabbedContent
-          data-test-subj="threatDetails"
-          tabs={threatTabs}
-          selectedTab={selectedThreatTab}
-          onTabClick={handleThreatTabClick}
-          key="threat-summary-tabs"
-        />
-      )}
-    </>
+    <StyledEuiTabbedContent
+      data-test-subj="eventDetails"
+      tabs={tabs}
+      selectedTab={selectedTab}
+      onTabClick={handleTabClick}
+      key="event-summary-tabs"
+    />
   );
 };
 
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/helpers.tsx
index 67e67584849cc8..dfbaadbeed7b14 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/helpers.tsx
@@ -22,7 +22,6 @@ import {
   DEFAULT_DATE_COLUMN_MIN_WIDTH,
   DEFAULT_COLUMN_MIN_WIDTH,
 } from '../../../timelines/components/timeline/body/constants';
-import { ToStringArray } from '../../../graphql/types';
 
 import * as i18n from './translations';
 
@@ -50,7 +49,7 @@ export interface Item {
   field: JSX.Element;
   fieldId: string;
   type: string;
-  values: ToStringArray;
+  values: string[];
 }
 
 export interface AlertSummaryRow {
@@ -225,7 +224,7 @@ export const getSummaryColumns = (
       field: 'title',
       truncateText: false,
       render: getTitle,
-      width: '120px',
+      width: '160px',
       name: '',
     },
     {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/summary_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/summary_view.tsx
index 3b2c55e9a6b67d..1dda40ae4b19d7 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/summary_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/summary_view.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiInMemoryTable, EuiBasicTableColumn } from '@elastic/eui';
+import { EuiInMemoryTable, EuiBasicTableColumn, EuiTitle, EuiHorizontalRule } from '@elastic/eui';
 import React from 'react';
 import styled from 'styled-components';
 
@@ -27,18 +27,47 @@ const StyledEuiInMemoryTable = styled(EuiInMemoryTable as any)`
   }
 `;
 
+const StyledEuiTitle = styled(EuiTitle)`
+  color: ${({ theme }) => theme.eui.euiColorDarkShade};
+  text-transform: lowercase;
+  padding-top: ${({ theme }) => theme.eui.paddingSizes.s};
+  h2 {
+    min-width: 120px;
+  }
+  hr {
+    max-width: 75%;
+  }
+`;
+
+const FlexDiv = styled.div`
+  display: flex;
+  align-items: center;
+  justify-content: flex-start;
+`;
+
 export const SummaryViewComponent: React.FC<{
+  title?: string;
   summaryColumns: Array<EuiBasicTableColumn<SummaryRow>>;
   summaryRows: SummaryRow[];
   dataTestSubj?: string;
-}> = ({ summaryColumns, summaryRows, dataTestSubj = 'summary-view' }) => {
+}> = ({ summaryColumns, summaryRows, dataTestSubj = 'summary-view', title }) => {
   return (
-    <StyledEuiInMemoryTable
-      data-test-subj={dataTestSubj}
-      items={summaryRows}
-      columns={summaryColumns}
-      compressed
-    />
+    <>
+      {title && (
+        <StyledEuiTitle size="xxs">
+          <FlexDiv>
+            <h2>{title}</h2>
+            <EuiHorizontalRule margin="none" />
+          </FlexDiv>
+        </StyledEuiTitle>
+      )}
+      <StyledEuiInMemoryTable
+        data-test-subj={dataTestSubj}
+        items={summaryRows}
+        columns={summaryColumns}
+        compressed
+      />
+    </>
   );
 };
 
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.test.tsx
index 81bffe9b66638a..4b2f56a2050421 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.test.tsx
@@ -8,8 +8,6 @@
 import React from 'react';
 
 import { ThreatDetailsView } from './threat_details_view';
-import { mockAlertDetailsData } from './__mocks__';
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 
 import { TestProviders } from '../../mock';
 import { useMountAppended } from '../../utils/use_mount_appended';
@@ -20,11 +18,56 @@ jest.mock('../../../detections/containers/detection_engine/rules/use_rule_async'
   };
 });
 
-const props = {
-  data: mockAlertDetailsData as TimelineEventsDetailsItem[],
-  eventId: '5d1d53da502f56aacc14c3cb5c669363d102b31f99822e5d369d4804ed370a31',
-  timelineId: 'detections-page',
-};
+const mostRecentDate = '2021-04-25T18:17:00.000Z';
+
+const threatData = [
+  [
+    {
+      category: 'matched',
+      field: 'matched.field',
+      isObjectArray: false,
+      originalValue: ['test_field_2'],
+      values: ['test_field_2'],
+    },
+    {
+      category: 'first_seen',
+      field: 'first_seen',
+      isObjectArray: false,
+      originalValue: ['2019-04-25T18:17:00.000Z'],
+      values: ['2019-04-25T18:17:00.000Z'],
+    },
+    {
+      category: 'event',
+      field: 'event.reference',
+      isObjectArray: false,
+      originalValue: ['https://test.com/'],
+      values: ['https://test.com/'],
+    },
+    {
+      category: 'event',
+      field: 'event.url',
+      isObjectArray: false,
+      originalValue: ['https://test2.com/'],
+      values: ['https://test2.com/'],
+    },
+  ],
+  [
+    {
+      category: 'first_seen',
+      field: 'first_seen',
+      isObjectArray: false,
+      originalValue: [mostRecentDate],
+      values: [mostRecentDate],
+    },
+    {
+      category: 'matched',
+      field: 'matched.field',
+      isObjectArray: false,
+      originalValue: ['test_field'],
+      values: ['test_field'],
+    },
+  ],
+];
 
 describe('ThreatDetailsView', () => {
   const mount = useMountAppended();
@@ -36,9 +79,36 @@ describe('ThreatDetailsView', () => {
   test('render correct items', () => {
     const wrapper = mount(
       <TestProviders>
-        <ThreatDetailsView {...props} />
+        <ThreatDetailsView threatData={threatData} />
       </TestProviders>
     );
     expect(wrapper.find('[data-test-subj="threat-details-view-0"]').exists()).toEqual(true);
   });
+
+  test('renders empty view if there are no items', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <ThreatDetailsView threatData={[[]]} />
+      </TestProviders>
+    );
+    expect(wrapper.find('[data-test-subj="empty-threat-details-view"]').exists()).toEqual(true);
+  });
+
+  test('renders link for event.url and event.reference', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <ThreatDetailsView threatData={threatData} />
+      </TestProviders>
+    );
+    expect(wrapper.find('a').length).toEqual(2);
+  });
+
+  test('orders items by first_seen', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <ThreatDetailsView threatData={threatData} />
+      </TestProviders>
+    );
+    expect(wrapper.find('.euiToolTipAnchor span').at(0).text()).toEqual(mostRecentDate);
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.tsx
index 08899862374424..0f577200b7b47b 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/threat_details_view.tsx
@@ -10,51 +10,50 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiHorizontalRule,
+  EuiSpacer,
   EuiToolTip,
+  EuiLink,
 } from '@elastic/eui';
-import React, { useMemo } from 'react';
+import React from 'react';
 
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
+import { isEmpty } from 'fp-ts/Array';
 import { SummaryView } from './summary_view';
 import { getSummaryColumns, SummaryRow, ThreatDetailsRow } from './helpers';
-import { getDataFromSourceHits } from '../../../../common/utils/field_formatters';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { INDICATOR_DESTINATION_PATH } from '../../../../common/constants';
+import {
+  FIRSTSEEN,
+  INDICATOR_EVENT_URL,
+  INDICATOR_REFERENCE,
+} from '../../../../common/cti/constants';
+import { EmptyThreatDetailsView } from './empty_threat_details_view';
 
 const ThreatDetailsDescription: React.FC<ThreatDetailsRow['description']> = ({
   fieldName,
   value,
-}) => (
-  <EuiToolTip
-    data-test-subj="message-tool-tip"
-    content={
-      <EuiFlexGroup direction="column" gutterSize="none">
-        <EuiFlexItem grow={false}>
-          <span>{fieldName}</span>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    }
-  >
+}) => {
+  const tooltipChild = [INDICATOR_EVENT_URL, INDICATOR_REFERENCE].some(
+    (field) => field === fieldName
+  ) ? (
+    <EuiLink href={value} target="_blank">
+      {value}
+    </EuiLink>
+  ) : (
     <span>{value}</span>
-  </EuiToolTip>
-);
-
-const getSummaryRowsArray = ({
-  data,
-}: {
-  data: TimelineEventsDetailsItem[];
-}): ThreatDetailsRow[][] => {
-  if (!data) return [[]];
-  const threatInfo = data.find(
-    ({ field, originalValue }) => field === INDICATOR_DESTINATION_PATH && originalValue
   );
-  if (!threatInfo) return [[]];
-  const { originalValue } = threatInfo;
-  const values = Array.isArray(originalValue) ? originalValue : [originalValue];
-  return values.map((value) =>
-    getDataFromSourceHits(JSON.parse(value)).map((threatInfoItem) => ({
-      title: threatInfoItem.field.replace(`${INDICATOR_DESTINATION_PATH}.`, ''),
-      description: { fieldName: threatInfoItem.field, value: threatInfoItem.originalValue },
-    }))
+  return (
+    <EuiToolTip
+      data-test-subj="message-tool-tip"
+      content={
+        <EuiFlexGroup direction="column" gutterSize="none">
+          <EuiFlexItem grow={false}>
+            <span>{fieldName}</span>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      }
+    >
+      {tooltipChild}
+    </EuiToolTip>
   );
 };
 
@@ -62,17 +61,51 @@ const summaryColumns: Array<EuiBasicTableColumn<SummaryRow>> = getSummaryColumns
   ThreatDetailsDescription
 );
 
+const getISOStringFromThreatDataItem = (threatDataItem: TimelineEventsDetailsItem[]) => {
+  const firstSeen = threatDataItem.find(
+    (item: TimelineEventsDetailsItem) => item.field === FIRSTSEEN
+  );
+  if (firstSeen) {
+    const { originalValue } = firstSeen;
+    const firstSeenValue = Array.isArray(originalValue) ? originalValue[0] : originalValue;
+    if (!Number.isNaN(Date.parse(firstSeenValue))) {
+      return firstSeenValue;
+    }
+  }
+  return new Date(-1).toString();
+};
+
+const getThreatDetailsRowsArray = (threatData: TimelineEventsDetailsItem[][]) =>
+  threatData
+    .sort(
+      (a, b) =>
+        Date.parse(getISOStringFromThreatDataItem(b)) -
+        Date.parse(getISOStringFromThreatDataItem(a))
+    )
+    .map((items) =>
+      items.map(({ field, originalValue }) => ({
+        title: field,
+        description: {
+          fieldName: `${INDICATOR_DESTINATION_PATH}.${field}`,
+          value: Array.isArray(originalValue) ? originalValue[0] : originalValue,
+        },
+      }))
+    );
+
 const ThreatDetailsViewComponent: React.FC<{
-  data: TimelineEventsDetailsItem[];
-}> = ({ data }) => {
-  const summaryRowsArray = useMemo(() => getSummaryRowsArray({ data }), [data]);
-  return (
+  threatData: TimelineEventsDetailsItem[][];
+}> = ({ threatData }) => {
+  const threatDetailsRowsArray = getThreatDetailsRowsArray(threatData);
+  return isEmpty(threatDetailsRowsArray) || isEmpty(threatDetailsRowsArray[0]) ? (
+    <EmptyThreatDetailsView />
+  ) : (
     <>
-      {summaryRowsArray.map((summaryRows, index, arr) => {
+      {threatDetailsRowsArray.map((summaryRows, index, arr) => {
         const key = summaryRows.find((threat) => threat.title === 'matched.id')?.description
           .value[0];
         return (
-          <div key={key}>
+          <div key={`${key}-${index}`}>
+            {index === 0 && <EuiSpacer size="l" />}
             <SummaryView
               summaryColumns={summaryColumns}
               summaryRows={summaryRows}
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.test.tsx
index 756fc7d32b371d..fa12ff3db7895c 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.test.tsx
@@ -8,11 +8,10 @@
 import React from 'react';
 
 import { ThreatSummaryView } from './threat_summary_view';
-import { mockAlertDetailsData } from './__mocks__';
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
-
 import { TestProviders } from '../../mock';
 import { useMountAppended } from '../../utils/use_mount_appended';
+import { mockAlertDetailsData } from './__mocks__';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 
 jest.mock('../../../detections/containers/detection_engine/rules/use_rule_async', () => {
   return {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.tsx
index 96ae2071c449b4..67b09e8e596990 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/threat_summary_view.tsx
@@ -5,16 +5,39 @@
  * 2.0.
  */
 
-import { EuiBasicTableColumn } from '@elastic/eui';
-import React, { useMemo } from 'react';
+import { EuiBasicTableColumn, EuiSpacer } from '@elastic/eui';
+import React from 'react';
 
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
-import { FormattedFieldValue } from '../../../timelines/components/timeline/body/renderers/formatted_field';
-import { BrowserFields } from '../../../../common/search_strategy/index_fields';
+import * as i18n from './translations';
 import { SummaryView } from './summary_view';
 import { getSummaryColumns, SummaryRow, ThreatSummaryRow } from './helpers';
+import { FormattedFieldValue } from '../../../timelines/components/timeline/body/renderers/formatted_field';
+import { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
+import { SORTED_THREAT_SUMMARY_FIELDS } from '../../../../common/cti/constants';
 import { INDICATOR_DESTINATION_PATH } from '../../../../common/constants';
 
+const getThreatSummaryRows = (
+  data: TimelineEventsDetailsItem[],
+  timelineId: string,
+  eventId: string
+) =>
+  SORTED_THREAT_SUMMARY_FIELDS.map((threatSummaryField) => {
+    const item = data.find(({ field }) => field === threatSummaryField);
+    if (item) {
+      const { field, originalValue } = item;
+      return {
+        title: field.replace(`${INDICATOR_DESTINATION_PATH}.`, ''),
+        description: {
+          values: Array.isArray(originalValue) ? originalValue : [originalValue],
+          contextId: timelineId,
+          eventId,
+          fieldName: field,
+        },
+      };
+    }
+    return null;
+  }).filter((item: ThreatSummaryRow | null): item is ThreatSummaryRow => !!item);
+
 const getDescription = ({
   contextId,
   eventId,
@@ -34,56 +57,22 @@ const getDescription = ({
   </>
 );
 
-const getSummaryRows = ({
-  data,
-  timelineId: contextId,
-  eventId,
-}: {
-  data: TimelineEventsDetailsItem[];
-  browserFields?: BrowserFields;
-  timelineId: string;
-  eventId: string;
-}) => {
-  if (!data) return [];
-  return data.reduce<SummaryRow[]>((acc, { field, originalValue }) => {
-    if (field.startsWith(`${INDICATOR_DESTINATION_PATH}.`) && originalValue) {
-      return [
-        ...acc,
-        {
-          title: field.replace(`${INDICATOR_DESTINATION_PATH}.`, ''),
-          description: {
-            values: Array.isArray(originalValue) ? originalValue : [originalValue],
-            contextId,
-            eventId,
-            fieldName: field,
-          },
-        },
-      ];
-    }
-    return acc;
-  }, []);
-};
-
 const summaryColumns: Array<EuiBasicTableColumn<SummaryRow>> = getSummaryColumns(getDescription);
 
 const ThreatSummaryViewComponent: React.FC<{
   data: TimelineEventsDetailsItem[];
-  eventId: string;
   timelineId: string;
-}> = ({ data, eventId, timelineId }) => {
-  const summaryRows = useMemo(() => getSummaryRows({ data, eventId, timelineId }), [
-    data,
-    eventId,
-    timelineId,
-  ]);
-
-  return (
+  eventId: string;
+}> = ({ data, timelineId, eventId }) => (
+  <>
+    <EuiSpacer size="l" />
     <SummaryView
+      title={i18n.THREAT_SUMMARY}
       summaryColumns={summaryColumns}
-      summaryRows={summaryRows}
+      summaryRows={getThreatSummaryRows(data, timelineId, eventId)}
       dataTestSubj="threat-summary-view"
     />
-  );
-};
+  </>
+);
 
 export const ThreatSummaryView = React.memo(ThreatSummaryViewComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/translations.ts b/x-pack/plugins/security_solution/public/common/components/event_details/translations.ts
index 73a2e0d57307c8..1ff88d9c2018b9 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/translations.ts
@@ -11,12 +11,35 @@ export const SUMMARY = i18n.translate('xpack.securitySolution.alertDetails.summa
   defaultMessage: 'Summary',
 });
 
+export const ALERT_SUMMARY = i18n.translate('xpack.securitySolution.alertDetails.alertSummary', {
+  defaultMessage: 'Alert Summary',
+});
+
+export const THREAT_INTEL = i18n.translate('xpack.securitySolution.alertDetails.threatIntel', {
+  defaultMessage: 'Threat Intel',
+});
+
 export const THREAT_SUMMARY = i18n.translate('xpack.securitySolution.alertDetails.threatSummary', {
   defaultMessage: 'Threat Summary',
 });
 
-export const THREAT_DETAILS = i18n.translate('xpack.securitySolution.alertDetails.threatDetails', {
-  defaultMessage: 'Threat Details',
+export const NO_ENRICHMENT_FOUND = i18n.translate(
+  'xpack.securitySolution.alertDetails.noEnrichmentFound',
+  {
+    defaultMessage: 'No Threat Intel Enrichment Found',
+  }
+);
+
+export const IF_CTI_NOT_ENABLED = i18n.translate(
+  'xpack.securitySolution.alertDetails.ifCtiNotEnabled',
+  {
+    defaultMessage:
+      "If you haven't enabled any threat intelligence sources and want to learn more about this capability, ",
+  }
+);
+
+export const CHECK_DOCS = i18n.translate('xpack.securitySolution.alertDetails.checkDocs', {
+  defaultMessage: 'please check out our documentation.',
 });
 
 export const INVESTIGATION_GUIDE = i18n.translate(
diff --git a/x-pack/plugins/security_solution/public/common/components/generic_downloader/index.tsx b/x-pack/plugins/security_solution/public/common/components/generic_downloader/index.tsx
index fa75b5d181856f..2a2e425702755e 100644
--- a/x-pack/plugins/security_solution/public/common/components/generic_downloader/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/generic_downloader/index.tsx
@@ -12,6 +12,7 @@ import * as i18n from './translations';
 
 import { ExportDocumentsProps } from '../../../detections/containers/detection_engine/rules';
 import { useStateToaster, errorToToaster } from '../toasters';
+import { TimelineErrorResponse } from '../../../../common/types/timeline';
 
 const InvisibleAnchor = styled.a`
   display: none;
@@ -22,7 +23,7 @@ export type ExportSelectedData = ({
   filename,
   ids,
   signal,
-}: ExportDocumentsProps) => Promise<Blob>;
+}: ExportDocumentsProps) => Promise<Blob | TimelineErrorResponse>;
 
 export interface GenericDownloaderProps {
   filename: string;
diff --git a/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
index 2a7b7811a2de82..6f3e28469a949d 100644
--- a/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
@@ -11,7 +11,6 @@ import React from 'react';
 import {
   TestProviders,
   mockGlobalState,
-  apolloClientObservable,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
   createSecuritySolutionStorageMock,
@@ -35,25 +34,13 @@ describe('Inspect Button', () => {
     state: state.inputs,
   };
 
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   describe('Render', () => {
     beforeEach(() => {
       const myState = cloneDeep(state);
       myState.inputs = upsertQuery(newQuery);
-      store = createStore(
-        myState,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     });
     test('Eui Empty Button', () => {
       const wrapper = mount(
@@ -157,13 +144,7 @@ describe('Inspect Button', () => {
         response: ['my response'],
       };
       myState.inputs = upsertQuery(myQuery);
-      store = createStore(
-        myState,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     });
     test('Open Inspect Modal', () => {
       const wrapper = mount(
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.test.ts b/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.test.ts
index e2b5a131a79542..e5d395561cc0a6 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.test.ts
@@ -7,7 +7,7 @@
 
 import { getCriteriaFromNetworkType } from './get_criteria_from_network_type';
 import { NetworkType } from '../../../../network/store/model';
-import { FlowTarget } from '../../../../graphql/types';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 describe('get_criteria_from_network_type', () => {
   test('returns network names from criteria if the network type is details and it is source', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.ts b/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.ts
index 0bc42690f67bdf..84fd7bd9d42d8f 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/criteria/get_criteria_from_network_type.ts
@@ -7,7 +7,7 @@
 
 import { CriteriaFields } from '../types';
 import { NetworkType } from '../../../../network/store/model';
-import { FlowTarget } from '../../../../graphql/types';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 export const getCriteriaFromNetworkType = (
   type: NetworkType,
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.test.ts b/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.test.ts
index 16e4150845b70d..f9122038e989ee 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { FlowTarget } from '../../../../graphql/types';
+import { FlowTarget } from '../../../../../common/search_strategy';
 import { CriteriaFields } from '../types';
 import { networkToCriteria } from './network_to_criteria';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.ts b/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.ts
index 72828be7e48777..10a2606a7545ee 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/criteria/network_to_criteria.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { FlowTarget } from '../../../../../common/search_strategy';
 import { CriteriaFields } from '../types';
-import { FlowTarget } from '../../../../graphql/types';
 
 export const networkToCriteria = (ip: string, flowTarget: FlowTarget): CriteriaFields[] => {
   if (flowTarget === FlowTarget.source) {
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/tables/get_anomalies_network_table_columns.tsx b/x-pack/plugins/security_solution/public/common/components/ml/tables/get_anomalies_network_table_columns.tsx
index a2741331756ac2..bc383ccefa4532 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/tables/get_anomalies_network_table_columns.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml/tables/get_anomalies_network_table_columns.tsx
@@ -24,7 +24,7 @@ import { ExplorerLink } from '../links/create_explorer_link';
 import { FormattedRelativePreferenceDate } from '../../formatted_date';
 import { NetworkType } from '../../../../network/store/model';
 import { escapeDataProviderId } from '../../drag_and_drop/helpers';
-import { FlowTarget } from '../../../../graphql/types';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 export const getAnomaliesNetworkTableColumns = (
   startDate: string,
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/tables/network_equality.test.ts b/x-pack/plugins/security_solution/public/common/components/ml/tables/network_equality.test.ts
index 4ab2b8cf44a0e5..dd85d9fedab01e 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/tables/network_equality.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/tables/network_equality.test.ts
@@ -8,7 +8,7 @@
 import { networkEquality } from './network_equality';
 import { AnomaliesNetworkTableProps } from '../types';
 import { NetworkType } from '../../../../network/store/model';
-import { FlowTarget } from '../../../../graphql/types';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 describe('network_equality', () => {
   test('it returns true if start and end date are equal', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/types.ts b/x-pack/plugins/security_solution/public/common/components/ml/types.ts
index 51da87e571e524..494c8a522ffac7 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/types.ts
@@ -6,10 +6,10 @@
  */
 
 import { Influencer } from '../../../../../ml/public';
+import { FlowTarget } from '../../../../common/search_strategy';
 
 import { HostsType } from '../../../hosts/store/model';
 import { NetworkType } from '../../../network/store/model';
-import { FlowTarget } from '../../../graphql/types';
 
 export interface Source {
   job_id: string;
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_modules.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_modules.tsx
index ebf726ae9b8ce7..8dac6234f19a86 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_modules.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_modules.tsx
@@ -18,5 +18,6 @@ export const mlModules: string[] = [
   'siem_winlogbeat',
   'siem_winlogbeat_auth',
   'security_linux',
+  'security_network',
   'security_windows',
 ];
diff --git a/x-pack/plugins/security_solution/public/common/components/paginated_table/helpers.ts b/x-pack/plugins/security_solution/public/common/components/paginated_table/helpers.ts
index 8c8f8d0acebc03..1e7b1c749c0047 100644
--- a/x-pack/plugins/security_solution/public/common/components/paginated_table/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/paginated_table/helpers.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { PaginationInputPaginated } from '../../../graphql/types';
+import { PaginationInputPaginated } from '../../../../common/search_strategy';
 
 export const generateTablePaginationOptions = (
   activePage: number,
diff --git a/x-pack/plugins/security_solution/public/common/components/paginated_table/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/paginated_table/index.test.tsx
index 3439bb0a7ddb39..64c3584bc668cd 100644
--- a/x-pack/plugins/security_solution/public/common/components/paginated_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/paginated_table/index.test.tsx
@@ -9,12 +9,12 @@ import { mount, shallow } from 'enzyme';
 import React from 'react';
 
 import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../common/constants';
-import { Direction } from '../../../graphql/types';
 
 import { BasicTableProps, PaginatedTable } from './index';
 import { getHostsColumns, mockData, rowItems, sortedHosts } from './index.mock';
 import { ThemeProvider } from 'styled-components';
 import { getMockTheme } from '../../lib/kibana/kibana_react.mock';
+import { Direction } from '../../../../common/search_strategy';
 
 jest.mock('react', () => {
   const r = jest.requireActual('react');
diff --git a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
index 3729f9dcdf68b6..e8f382a5050d82 100644
--- a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
@@ -12,7 +12,6 @@ import { Sourcerer } from './index';
 import { DEFAULT_INDEX_PATTERN } from '../../../../common/constants';
 import { sourcererActions, sourcererModel } from '../../store/sourcerer';
 import {
-  apolloClientObservable,
   createSecuritySolutionStorageMock,
   kibanaObservable,
   mockGlobalState,
@@ -53,22 +52,10 @@ describe('Sourcerer component', () => {
   });
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   // Using props callback instead of simulating clicks,
@@ -100,13 +87,7 @@ describe('Sourcerer component', () => {
       },
     };
 
-    store = createStore(
-      state2,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state2, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     const wrapper = mount(
       <TestProviders store={store}>
         <Sourcerer {...defaultProps} />
@@ -154,7 +135,6 @@ describe('Sourcerer component', () => {
         },
       },
       SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
       kibanaObservable,
       storage
     );
@@ -185,7 +165,6 @@ describe('Sourcerer component', () => {
         },
       },
       SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
       kibanaObservable,
       storage
     );
@@ -209,7 +188,6 @@ describe('Sourcerer component', () => {
         },
       },
       SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
       kibanaObservable,
       storage
     );
@@ -251,7 +229,6 @@ describe('Sourcerer component', () => {
         },
       },
       SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
       kibanaObservable,
       storage
     );
diff --git a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
index 4c4cc1f838a503..e2961de91c448e 100644
--- a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
@@ -31,7 +31,6 @@ import {
   mockNarrowDateRange,
 } from '../../../network/components/kpi_network/mock';
 import {
-  apolloClientObservable,
   createSecuritySolutionStorageMock,
   kibanaObservable,
   mockGlobalState,
@@ -60,13 +59,7 @@ describe('Stat Items Component', () => {
   const mockTheme = getMockTheme({ eui: { euiColorMediumShade: '#ece' } });
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   describe.each([
     [
diff --git a/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
index 5af5b81c75cd67..7cc0b80b51f80e 100644
--- a/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
@@ -12,7 +12,6 @@ import { Provider as ReduxStoreProvider } from 'react-redux';
 import { DEFAULT_TIMEPICKER_QUICK_RANGES } from '../../../../common/constants';
 import { useUiSetting$ } from '../../lib/kibana';
 import {
-  apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
@@ -83,23 +82,11 @@ describe('SIEM Super Date Picker', () => {
   describe('#SuperDatePicker', () => {
     const state: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
-    let store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
     beforeEach(() => {
       jest.clearAllMocks();
-      store = createStore(
-        state,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
       mockUseUiSetting$.mockImplementation((key, defaultValue) => {
         const useUiSetting$Mock = createUseUiSetting$Mock();
 
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
index 0b5e07488ff2ad..005602738f376e 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
@@ -11,7 +11,6 @@ import { waitFor } from '@testing-library/react';
 import '../../mock/match_media';
 import { mockBrowserFields } from '../../containers/source/mock';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -157,13 +156,7 @@ const state: State = {
 };
 
 const { storage } = createSecuritySolutionStorageMock();
-const store = createStore(
-  state,
-  SUB_PLUGINS_REDUCER,
-  apolloClientObservable,
-  kibanaObservable,
-  storage
-);
+const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
 let testProps = {
   browserFields: mockBrowserFields,
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
index 56a6dd089cf058..a2d5076031328c 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
@@ -29,7 +29,6 @@ import { SecurityPageName } from '../../../../common/constants';
 export const dispatchSetInitialStateFromUrl = (
   dispatch: Dispatch
 ): DispatchSetInitialStateFromUrl => ({
-  apolloClient,
   detailName,
   filterManager,
   indexPattern,
@@ -99,7 +98,6 @@ export const dispatchSetInitialStateFromUrl = (
       if (timeline != null && timeline.id !== '') {
         queryTimelineById({
           activeTimelineTab: timeline.activeTab,
-          apolloClient,
           duplicate: false,
           graphEventId: timeline.graphEventId,
           timelineId: timeline.id,
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/types.ts b/x-pack/plugins/security_solution/public/common/components/url_state/types.ts
index 8e41514d416ecb..1a8d512d211e68 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/types.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import ApolloClient from 'apollo-client';
 import * as H from 'history';
 import { ActionCreator } from 'typescript-fsa';
 import {
@@ -148,7 +147,6 @@ export interface UrlStateToRedux {
 }
 
 export interface SetInitialStateFromUrl<TCache> {
-  apolloClient: ApolloClient<TCache> | ApolloClient<{}> | undefined;
   detailName: string | undefined;
   filterManager: FilterManager;
   indexPattern: IIndexPattern | undefined;
@@ -160,7 +158,6 @@ export interface SetInitialStateFromUrl<TCache> {
 }
 
 export type DispatchSetInitialStateFromUrl = <TCache>({
-  apolloClient,
   detailName,
   indexPattern,
   pageName,
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/use_url_state.tsx b/x-pack/plugins/security_solution/public/common/components/url_state/use_url_state.tsx
index 84f74434cbcd0e..7785fa6af2569a 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/use_url_state.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/use_url_state.tsx
@@ -10,7 +10,6 @@ import { useEffect, useRef, useState } from 'react';
 import deepEqual from 'fast-deep-equal';
 
 import { useKibana } from '../../lib/kibana';
-import { useApolloClient } from '../../utils/apollo_context';
 import { CONSTANTS, UrlStateType } from './constants';
 import {
   getQueryStringFromLocation,
@@ -70,7 +69,6 @@ export const useUrlStateHooks = ({
   urlState,
 }: UrlStateContainerPropTypes) => {
   const [isInitializing, setIsInitializing] = useState(true);
-  const apolloClient = useApolloClient();
   const { filterManager, savedQueries } = useKibana().services.data.query;
   const prevProps = usePrevious({ pathName, pageName, urlState });
 
@@ -161,7 +159,6 @@ export const useUrlStateHooks = ({
     });
 
     setInitialStateFromUrl({
-      apolloClient,
       detailName,
       filterManager,
       indexPattern,
diff --git a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/types.ts b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/types.ts
index a50894ad278f38..2d3bb00501da5d 100644
--- a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/types.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/types.ts
@@ -9,9 +9,9 @@ import { ESTermQuery } from '../../../../../common/typed_json';
 import { NarrowDateRange } from '../../../components/ml/types';
 import { UpdateDateRange } from '../../../components/charts/common';
 import { GlobalTimeArgs } from '../../use_global_time';
-import { FlowTarget } from '../../../../graphql/types';
 import { HostsType } from '../../../../hosts/store/model';
 import { NetworkType } from '../../../../network/store//model';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 interface QueryTabBodyProps {
   type: HostsType | NetworkType;
diff --git a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/utils.ts b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/utils.ts
index ed0be60f22516b..9a9b5b13137e6c 100644
--- a/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/utils.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/anomalies/anomalies_query_tab_body/utils.ts
@@ -8,9 +8,9 @@
 import deepmerge from 'deepmerge';
 
 import { MlSummaryJob } from '../../../../../../ml/public';
+import { FlowTarget } from '../../../../../common/search_strategy';
 import { ESTermQuery } from '../../../../../common/typed_json';
 import { createFilter } from '../../helpers';
-import { FlowTarget } from '../../../../graphql/types';
 
 export const getAnomaliesFilterQuery = (
   filterQuery: string | ESTermQuery | undefined,
diff --git a/x-pack/plugins/security_solution/public/common/containers/errors/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/errors/index.test.tsx
deleted file mode 100644
index 822c9362063330..00000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/errors/index.test.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { reTryOneTimeOnErrorHandler, errorLinkHandler } from '.';
-import { ServerError } from 'apollo-link-http-common';
-import { Operation } from 'apollo-link';
-import { GraphQLError } from 'graphql';
-import * as store from '../../store';
-import { onError } from 'apollo-link-error';
-
-const mockDispatch = jest.fn();
-jest.mock('apollo-link-error');
-jest.mock('../../store');
-(store.getStore as jest.Mock).mockReturnValue({ dispatch: mockDispatch });
-
-describe('errorLinkHandler', () => {
-  const mockGraphQLErrors: GraphQLError = {
-    message: 'GraphQLError',
-  } as GraphQLError;
-  const mockNetworkError: ServerError = {
-    result: {},
-    statusCode: 503,
-    name: '',
-    message: 'error',
-    response: {
-      ok: false,
-    } as Response,
-  };
-  const mockOperation: Operation = {} as Operation;
-  const mockForward = jest.fn();
-
-  afterEach(() => {
-    mockDispatch.mockClear();
-  });
-
-  test('it should display error if graphQLErrors exist', () => {
-    errorLinkHandler({
-      graphQLErrors: [mockGraphQLErrors],
-      operation: mockOperation,
-      forward: mockForward,
-    });
-
-    expect(store.getStore).toBeCalled();
-    expect(mockDispatch.mock.calls.length).toBe(1);
-  });
-
-  test('it should display error if networkError exist', () => {
-    errorLinkHandler({
-      networkError: mockNetworkError,
-      operation: mockOperation,
-      forward: mockForward,
-    });
-
-    expect(store.getStore).toBeCalled();
-    expect(mockDispatch.mock.calls.length).toBe(1);
-  });
-});
-
-describe('errorLink', () => {
-  test('onError should be called with errorLinkHandler', () => {
-    expect(onError).toHaveBeenCalledWith(errorLinkHandler);
-  });
-});
-
-describe('reTryOneTimeOnErrorHandler', () => {
-  const mockNetworkError: ServerError = {
-    result: {},
-    statusCode: 503,
-    name: '',
-    message: 'error',
-    response: {
-      ok: false,
-    } as Response,
-  };
-  const mockOperation: Operation = {} as Operation;
-  const mockForward = jest.fn();
-
-  afterEach(() => {
-    mockForward.mockClear();
-  });
-  test('it should retry only if network status code is 503', () => {
-    reTryOneTimeOnErrorHandler({
-      networkError: mockNetworkError,
-      operation: mockOperation,
-      forward: mockForward,
-    });
-    expect(mockForward).toBeCalledWith(mockOperation);
-  });
-
-  test('it should not retry if other error happens', () => {
-    reTryOneTimeOnErrorHandler({
-      networkError: { ...mockNetworkError, statusCode: 500 },
-      operation: mockOperation,
-      forward: mockForward,
-    });
-    expect(mockForward).not.toBeCalled();
-  });
-});
-
-describe('reTryOneTimeOnErrorLink', () => {
-  test('onError should be called with reTryOneTimeOnErrorHandler', () => {
-    expect(onError).toHaveBeenCalledWith(reTryOneTimeOnErrorHandler);
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/containers/errors/index.tsx b/x-pack/plugins/security_solution/public/common/containers/errors/index.tsx
deleted file mode 100644
index f1b3a1b0c43524..00000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/errors/index.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { onError, ErrorLink } from 'apollo-link-error';
-import { get, throttle, noop } from 'lodash/fp';
-
-import uuid from 'uuid';
-
-import * as i18n from './translations';
-
-import { getStore } from '../../store';
-import { appActions } from '../../store/actions';
-
-export const errorLinkHandler: ErrorLink.ErrorHandler = ({ graphQLErrors, networkError }) => {
-  const store = getStore();
-  const dispatch = throttle(50, store != null ? store.dispatch : noop);
-
-  if (graphQLErrors != null && store != null) {
-    dispatch(
-      appActions.addError({
-        id: uuid.v4(),
-        title: i18n.DATA_FETCH_FAILURE,
-        message: graphQLErrors.map(({ message }) => message),
-      })
-    );
-  }
-
-  if (networkError != null && store != null) {
-    dispatch(
-      appActions.addError({
-        id: uuid.v4(),
-        title: i18n.NETWORK_FAILURE,
-        message: [networkError.message],
-      })
-    );
-  }
-};
-export const errorLink = onError(errorLinkHandler);
-
-export const reTryOneTimeOnErrorHandler: ErrorLink.ErrorHandler = ({
-  networkError,
-  operation,
-  forward,
-}) => {
-  if (networkError != null) {
-    const statusCode = get('statusCode', networkError);
-    if (statusCode != null && statusCode === 503) {
-      return forward(operation);
-    }
-  }
-};
-
-export const reTryOneTimeOnErrorLink = onError(reTryOneTimeOnErrorHandler);
diff --git a/x-pack/plugins/security_solution/public/common/containers/errors/translations.ts b/x-pack/plugins/security_solution/public/common/containers/errors/translations.ts
deleted file mode 100644
index bec8c98951f285..00000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/errors/translations.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const DATA_FETCH_FAILURE = i18n.translate(
-  'xpack.securitySolution.containers.errors.dataFetchFailureTitle',
-  {
-    defaultMessage: 'Data Fetch Failure',
-  }
-);
-
-export const NETWORK_FAILURE = i18n.translate(
-  'xpack.securitySolution.containers.errors.networkFailureTitle',
-  {
-    defaultMessage: 'Network Failure',
-  }
-);
diff --git a/x-pack/plugins/security_solution/public/common/containers/helpers.ts b/x-pack/plugins/security_solution/public/common/containers/helpers.ts
index efc50f4e4d9481..f46147ceabf7c9 100644
--- a/x-pack/plugins/security_solution/public/common/containers/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/helpers.ts
@@ -5,12 +5,9 @@
  * 2.0.
  */
 
-import { FetchPolicy } from 'apollo-client';
 import { isString } from 'lodash/fp';
 
 import { ESQuery } from '../../../common/typed_json';
 
 export const createFilter = (filterQuery: ESQuery | string | undefined) =>
   isString(filterQuery) ? filterQuery : JSON.stringify(filterQuery);
-
-export const getDefaultFetchPolicy = (): FetchPolicy => 'cache-and-network';
diff --git a/x-pack/plugins/security_solution/public/common/containers/query_template.tsx b/x-pack/plugins/security_solution/public/common/containers/query_template.tsx
deleted file mode 100644
index e8c7d2e0ef4369..00000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/query_template.tsx
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ApolloQueryResult } from 'apollo-client';
-import React from 'react';
-import { FetchMoreOptions, FetchMoreQueryOptions, OperationVariables } from 'react-apollo';
-
-import { ESQuery } from '../../../common/typed_json';
-import { DocValueFields } from './source';
-
-export { DocValueFields };
-
-export interface QueryTemplateProps {
-  indexNames: string[];
-  docValueFields?: DocValueFields[];
-  id?: string;
-  endDate?: string;
-  filterQuery?: ESQuery | string;
-  skip?: boolean;
-  sourceId: string;
-  startDate?: string;
-}
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export type FetchMoreOptionsArgs<TData, TVariables> = FetchMoreQueryOptions<any, any> &
-  FetchMoreOptions<TData, TVariables>;
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type PromiseApolloQueryResult = Promise<ApolloQueryResult<any>>;
-
-export class QueryTemplate<
-  T extends QueryTemplateProps,
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  TData = any,
-  TVariables = OperationVariables
-> extends React.PureComponent<T, TData, TVariables> {
-  private fetchMore!: (
-    fetchMoreOptions: FetchMoreOptionsArgs<TData, TVariables>
-  ) => PromiseApolloQueryResult;
-
-  private fetchMoreOptions!: (
-    newCursor: string,
-    tiebreaker?: string
-  ) => FetchMoreOptionsArgs<TData, TVariables>;
-
-  private refetch!: (variables?: TVariables) => Promise<ApolloQueryResult<TData>>;
-
-  private executeBeforeFetchMore!: ({ id }: { id?: string }) => void;
-
-  private executeBeforeRefetch!: ({ id }: { id?: string }) => void;
-
-  public setExecuteBeforeFetchMore = (val: ({ id }: { id?: string }) => void) => {
-    this.executeBeforeFetchMore = val;
-  };
-  public setExecuteBeforeRefetch = (val: ({ id }: { id?: string }) => void) => {
-    this.executeBeforeRefetch = val;
-  };
-
-  public setFetchMore = (
-    val: (fetchMoreOptions: FetchMoreOptionsArgs<TData, TVariables>) => PromiseApolloQueryResult
-  ) => {
-    this.fetchMore = val;
-  };
-
-  public setFetchMoreOptions = (
-    val: (newCursor: string, tiebreaker?: string) => FetchMoreOptionsArgs<TData, TVariables>
-  ) => {
-    this.fetchMoreOptions = val;
-  };
-
-  public setRefetch = (val: (variables?: TVariables) => Promise<ApolloQueryResult<TData>>) => {
-    this.refetch = val;
-  };
-
-  public wrappedLoadMore = (newCursor: string, tiebreaker?: string) => {
-    this.executeBeforeFetchMore({ id: this.props.id });
-    return this.fetchMore(this.fetchMoreOptions(newCursor, tiebreaker));
-  };
-
-  public wrappedRefetch = (variables?: TVariables) => {
-    this.executeBeforeRefetch({ id: this.props.id });
-    return this.refetch(variables);
-  };
-}
diff --git a/x-pack/plugins/security_solution/public/common/containers/query_template_paginated.tsx b/x-pack/plugins/security_solution/public/common/containers/query_template_paginated.tsx
deleted file mode 100644
index 0dc8aa9abf38fd..00000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/query_template_paginated.tsx
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ApolloQueryResult, NetworkStatus } from 'apollo-client';
-import memoizeOne from 'memoize-one';
-import React from 'react';
-import { FetchMoreOptions, FetchMoreQueryOptions, OperationVariables } from 'react-apollo';
-import deepEqual from 'fast-deep-equal';
-
-import { ESQuery } from '../../../common/typed_json';
-import { inputsModel } from '../store/model';
-import { generateTablePaginationOptions } from '../components/paginated_table/helpers';
-import { DocValueFields } from './source';
-
-export { DocValueFields };
-
-export interface QueryTemplatePaginatedProps {
-  docValueFields?: DocValueFields[];
-  id?: string;
-  endDate?: string;
-  filterQuery?: ESQuery | string;
-  skip?: boolean;
-  sourceId: string;
-  startDate?: string;
-}
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type FetchMoreOptionsArgs<TData, TVariables> = FetchMoreQueryOptions<any, any> &
-  FetchMoreOptions<TData, TVariables>;
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type PromiseApolloQueryResult = Promise<ApolloQueryResult<any>>;
-
-export class QueryTemplatePaginated<
-  T extends QueryTemplatePaginatedProps,
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  TData = any,
-  TVariables = OperationVariables
-> extends React.PureComponent<T, TData, TVariables> {
-  private queryVariables: TVariables | null = null;
-  private myLoading: boolean = false;
-  private fetchMore!: (
-    fetchMoreOptions: FetchMoreOptionsArgs<TData, TVariables>
-  ) => PromiseApolloQueryResult;
-
-  private fetchMoreOptions!: (newActivePage: number) => FetchMoreOptionsArgs<TData, TVariables>;
-
-  public memoizedRefetchQuery: (
-    variables: TVariables,
-    limit: number,
-    refetch: (variables?: TVariables) => Promise<ApolloQueryResult<TData>>
-  ) => inputsModel.Refetch;
-
-  constructor(props: T) {
-    super(props);
-    this.memoizedRefetchQuery = memoizeOne(this.refetchQuery);
-  }
-
-  public setFetchMore = (
-    val: (fetchMoreOptions: FetchMoreOptionsArgs<TData, TVariables>) => PromiseApolloQueryResult
-  ) => {
-    this.fetchMore = val;
-  };
-
-  public setFetchMoreOptions = (
-    val: (newActivePage: number) => FetchMoreOptionsArgs<TData, TVariables>
-  ) => {
-    this.fetchMoreOptions = val;
-  };
-
-  public wrappedLoadMore = (newActivePage: number) => {
-    return this.fetchMore(this.fetchMoreOptions(newActivePage));
-  };
-
-  public refetchQuery = (
-    variables: TVariables,
-    limit: number,
-    refetch: (variables?: TVariables) => Promise<ApolloQueryResult<TData>>
-  ): inputsModel.Refetch => () => {
-    refetch({ ...variables, pagination: generateTablePaginationOptions(0, limit) });
-  };
-
-  public setPrevVariables(vars: TVariables) {
-    this.queryVariables = vars;
-  }
-
-  public isItAValidLoading(loading: boolean, variables: TVariables, networkStatus: NetworkStatus) {
-    if (
-      !this.myLoading &&
-      (!deepEqual(variables, this.queryVariables) || networkStatus === NetworkStatus.refetch) &&
-      loading
-    ) {
-      this.myLoading = true;
-    } else if (this.myLoading && !loading) {
-      this.myLoading = false;
-    }
-    this.setPrevVariables(variables);
-    return this.myLoading;
-  }
-}
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
index 7a20c98a8d4bfe..542369fdf5aa36 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
@@ -12,7 +12,7 @@ import { act, renderHook } from '@testing-library/react-hooks';
 import { Provider } from 'react-redux';
 
 import { useInitSourcerer } from '.';
-import { mockPatterns, mockSource } from './mocks';
+import { mockPatterns } from './mocks';
 // import { SourcererScopeName } from '../../store/sourcerer/model';
 import { RouteSpyState } from '../../utils/route/types';
 import { SecurityPageName } from '../../../../common/constants';
@@ -22,14 +22,12 @@ import {
   initialState as userInfoState,
 } from '../../../detections/components/user_info';
 import {
-  apolloClientObservable,
   createSecuritySolutionStorageMock,
   kibanaObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
 } from '../../mock';
 import { SourcererScopeName } from '../../store/sourcerer/model';
-const mockSourceDefaults = mockSource;
 
 const mockRouteSpy: RouteSpyState = {
   pageName: SecurityPageName.overview,
@@ -81,11 +79,6 @@ jest.mock('../../lib/kibana', () => ({
   }),
   useUiSetting$: jest.fn().mockImplementation(() => [mockPatterns]),
 }));
-jest.mock('../../utils/apollo_context', () => ({
-  useApolloClient: jest.fn().mockReturnValue({
-    query: jest.fn().mockImplementation(() => Promise.resolve(mockSourceDefaults)),
-  }),
-}));
 
 describe('Sourcerer Hooks', () => {
   const state: State = {
@@ -112,24 +105,12 @@ describe('Sourcerer Hooks', () => {
     },
   };
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
     jest.clearAllMocks();
     jest.restoreAllMocks();
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     mockUseUserInfo.mockImplementation(() => userInfoState);
   });
   it('initializes loading default and timeline index patterns', async () => {
diff --git a/x-pack/plugins/security_solution/public/common/lib/compose/helpers.test.ts b/x-pack/plugins/security_solution/public/common/lib/compose/helpers.test.ts
deleted file mode 100644
index 8465e343d2a41b..00000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/compose/helpers.test.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { InMemoryCache, IntrospectionFragmentMatcher } from 'apollo-cache-inmemory';
-import { errorLink, reTryOneTimeOnErrorLink } from '../../containers/errors';
-import { getLinks } from './helpers';
-import { withClientState } from 'apollo-link-state';
-import * as apolloLinkHttp from 'apollo-link-http';
-import introspectionQueryResultData from '../../../graphql/introspection.json';
-
-jest.mock('apollo-cache-inmemory');
-jest.mock('apollo-link-http');
-jest.mock('apollo-link-state');
-jest.mock('../../containers/errors');
-const mockWithClientState = 'mockWithClientState';
-const mockHttpLink = { mockHttpLink: 'mockHttpLink' };
-
-(withClientState as jest.Mock).mockReturnValue(mockWithClientState);
-(apolloLinkHttp.createHttpLink as jest.Mock).mockImplementation(() => mockHttpLink);
-
-describe('getLinks helper', () => {
-  test('It should return links in correct order', () => {
-    const mockCache = new InMemoryCache({
-      dataIdFromObject: () => null,
-      fragmentMatcher: new IntrospectionFragmentMatcher({
-        // @ts-expect-error apollo-cache-inmemory types don't match actual introspection data
-        introspectionQueryResultData,
-      }),
-    });
-    const links = getLinks(mockCache, 'basePath');
-    expect(links[0]).toEqual(errorLink);
-    expect(links[1]).toEqual(reTryOneTimeOnErrorLink);
-    expect(links[2]).toEqual(mockWithClientState);
-    expect(links[3]).toEqual(mockHttpLink);
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/lib/compose/helpers.ts b/x-pack/plugins/security_solution/public/common/lib/compose/helpers.ts
deleted file mode 100644
index d9833844d843f6..00000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/compose/helpers.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { createHttpLink } from 'apollo-link-http';
-import { withClientState } from 'apollo-link-state';
-import { InMemoryCache } from 'apollo-cache-inmemory';
-
-import { errorLink, reTryOneTimeOnErrorLink } from '../../containers/errors';
-
-export const getLinks = (cache: InMemoryCache, basePath: string) => [
-  errorLink,
-  reTryOneTimeOnErrorLink,
-  withClientState({
-    cache,
-    resolvers: {},
-  }),
-  createHttpLink({
-    credentials: 'same-origin',
-    headers: { 'kbn-xsrf': 'true' },
-    uri: `${basePath}/api/solutions/security/graphql`,
-  }),
-];
diff --git a/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx b/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx
deleted file mode 100644
index 74a31ac58c6c5b..00000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/compose/kibana_compose.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { InMemoryCache, IntrospectionFragmentMatcher } from 'apollo-cache-inmemory';
-import ApolloClient from 'apollo-client';
-import { ApolloLink } from 'apollo-link';
-
-import introspectionQueryResultData from '../../../graphql/introspection.json';
-import { AppFrontendLibs } from '../lib';
-import { getLinks } from './helpers';
-import { CoreStart } from '../../../../../../../src/core/public';
-
-export function composeLibs(core: CoreStart): AppFrontendLibs {
-  const cache = new InMemoryCache({
-    dataIdFromObject: () => null,
-    fragmentMatcher: new IntrospectionFragmentMatcher({
-      // @ts-expect-error apollo-cache-inmemory types don't match actual introspection data
-      introspectionQueryResultData,
-    }),
-  });
-  const basePath = core.http.basePath.get();
-
-  const apolloClient = new ApolloClient({
-    connectToDevTools: process.env.NODE_ENV !== 'production',
-    cache,
-    link: ApolloLink.from(getLinks(cache, basePath)),
-  });
-
-  const libs: AppFrontendLibs = {
-    apolloClient,
-  };
-  return libs;
-}
diff --git a/x-pack/plugins/security_solution/public/common/lib/lib.ts b/x-pack/plugins/security_solution/public/common/lib/lib.ts
deleted file mode 100644
index 7919ef78fff0b9..00000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/lib.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { NormalizedCacheObject } from 'apollo-cache-inmemory';
-import ApolloClient from 'apollo-client';
-
-export interface AppFrontendLibs {
-  apolloClient: AppApolloClient;
-}
-
-export type AppTimezoneProvider = () => string;
-
-export type AppApolloClient = ApolloClient<NormalizedCacheObject>;
-
-export interface AppFrameworkAdapter {
-  appState?: object;
-  bytesFormat?: string;
-  dateFormat?: string;
-  dateFormatTz?: string;
-  darkMode?: boolean;
-  indexPattern?: string;
-  anomalyScore?: number;
-  scaledDateFormat?: string;
-  timezone?: string;
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  setUISettings(key: string, value: any): void;
-}
-
-export interface AppKibanaUIConfig {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  get(key: string): any;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  set(key: string, value: any): Promise<boolean>;
-}
diff --git a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
index 6f0f719c867d20..2d3a01f820b44e 100644
--- a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
@@ -14,7 +14,7 @@ import { coreMock } from '../../../../../../../src/core/public/mocks';
 import { StartPlugins } from '../../../types';
 import { depsStartMock } from './dependencies_start_mock';
 import { MiddlewareActionSpyHelper, createSpyMiddleware } from '../../store/test_utils';
-import { apolloClientObservable, kibanaObservable } from '../test_providers';
+import { kibanaObservable } from '../test_providers';
 import { createStore, State } from '../../store';
 import { AppRootProvider } from './app_root_provider';
 import { managementMiddlewareFactory } from '../../../management/store/middleware';
@@ -58,14 +58,10 @@ export const createAppRootMockRenderer = (): AppContextTestRender => {
   const middlewareSpy = createSpyMiddleware();
   const { storage } = createSecuritySolutionStorageMock();
 
-  const store = createStore(
-    mockGlobalState,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage,
-    [...managementMiddlewareFactory(coreStart, depsStart), middlewareSpy.actionSpyMiddleware]
-  );
+  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, kibanaObservable, storage, [
+    ...managementMiddlewareFactory(coreStart, depsStart),
+    middlewareSpy.actionSpyMiddleware,
+  ]);
 
   const MockKibanaContextProvider = createKibanaContextProviderMock();
 
diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 5baec992748232..90526e84a2262b 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -7,11 +7,8 @@
 
 import euiDarkVars from '@elastic/eui/dist/eui_theme_dark.json';
 import { I18nProvider } from '@kbn/i18n/react';
-import { InMemoryCache as Cache } from 'apollo-cache-inmemory';
-import ApolloClient from 'apollo-client';
-import { ApolloLink } from 'apollo-link';
+
 import React from 'react';
-import { ApolloProvider } from 'react-apollo';
 import { DragDropContext, DropResult, ResponderProvided } from 'react-beautiful-dnd';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 import { Store } from 'redux';
@@ -36,12 +33,6 @@ interface Props {
   onDragEnd?: (result: DropResult, provided: ResponderProvided) => void;
 }
 
-export const apolloClient = new ApolloClient({
-  cache: new Cache(),
-  link: new ApolloLink((o, f) => (f ? f(o) : null)),
-});
-
-export const apolloClientObservable = new BehaviorSubject(apolloClient);
 export const kibanaObservable = new BehaviorSubject(createStartServicesMock());
 
 Object.defineProperty(window, 'localStorage', {
@@ -54,24 +45,16 @@ const { storage } = createSecuritySolutionStorageMock();
 /** A utility for wrapping children in the providers required to run most tests */
 const TestProvidersComponent: React.FC<Props> = ({
   children,
-  store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  ),
+  store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage),
   onDragEnd = jest.fn(),
 }) => (
   <I18nProvider>
     <MockKibanaContextProvider>
-      <ApolloProvider client={apolloClient}>
-        <ReduxStoreProvider store={store}>
-          <ThemeProvider theme={() => ({ eui: euiDarkVars, darkMode: true })}>
-            <DragDropContext onDragEnd={onDragEnd}>{children}</DragDropContext>
-          </ThemeProvider>
-        </ReduxStoreProvider>
-      </ApolloProvider>
+      <ReduxStoreProvider store={store}>
+        <ThemeProvider theme={() => ({ eui: euiDarkVars, darkMode: true })}>
+          <DragDropContext onDragEnd={onDragEnd}>{children}</DragDropContext>
+        </ThemeProvider>
+      </ReduxStoreProvider>
     </MockKibanaContextProvider>
   </I18nProvider>
 );
diff --git a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
index 5aef3b97c81b79..c02c47d45f7324 100644
--- a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
@@ -12,1736 +12,1606 @@ import {
   TimelineType,
   TimelineStatus,
   TimelineTabs,
+  TimelineResult,
 } from '../../../common/types/timeline';
 
 import { OpenTimelineResult } from '../../timelines/components/open_timeline/types';
-import { GetAllTimeline, SortFieldTimeline, TimelineResult, Direction } from '../../graphql/types';
-import { TimelineEventsDetailsItem } from '../../../common/search_strategy';
-import { allTimelinesQuery } from '../../timelines/containers/all/index.gql_query';
+import { Direction, TimelineEventsDetailsItem } from '../../../common/search_strategy';
 import { CreateTimelineProps } from '../../detections/components/alerts_table/types';
 import { TimelineModel } from '../../timelines/store/timeline/model';
 import { timelineDefaults } from '../../timelines/store/timeline/defaults';
 
-export interface MockedProvidedQuery {
-  request: {
-    query: GetAllTimeline.Query;
-    variables: GetAllTimeline.Variables;
-  };
-  result: {
-    data: {
-      getAllTimeline: {
-        totalCount: number;
-        timeline: TimelineResult[];
-      };
-    };
-  };
-}
-/** Mocks results of a query run by the `OpenTimeline` component */
-export const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
-  {
-    request: {
-      query: (allTimelinesQuery as unknown) as GetAllTimeline.Query,
-      variables: {
-        onlyUserFavorite: false,
-        pageInfo: {
-          pageIndex: 1,
-          pageSize: 10,
-        },
-        search: '',
-        sort: {
-          sortField: 'updated' as SortFieldTimeline,
-          sortOrder: 'desc' as Direction,
+export const mockOpenTimelineQueryResults = {
+  totalCount: 11,
+  timeline: [
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811609',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
         },
-      },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 1',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
     },
-    result: {
-      data: {
-        getAllTimeline: {
-          totalCount: 11,
-          timeline: [
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811609',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 1',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f91',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 2',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f92',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 2',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 3',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f93',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 4',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f94',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 5',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f95',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 6',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f96',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 7',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f97',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 7',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f98',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 7',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f99',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 7',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f910',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 7',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-            {
-              savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f911',
-              description: 'hhw4',
-              favorite: [
-                {
-                  fullName: null,
-                  userName: 'elastic',
-                  favoriteDate: 1558390951234,
-                },
-              ],
-              eventIdToNoteIds: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  timelineVersion: null,
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-              ],
-              notes: [
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'test pinned event 2',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404484133,
-                  createdBy: 'elastic',
-                  updated: 1558404484133,
-                  updatedBy: 'elastic',
-                  version: 'WzEzOSwxXQ==',
-                },
-                {
-                  eventId: 'ZF0W12oB9v5HJNSHwY6L',
-                  note: 'Test pinned 1',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404474317,
-                  createdBy: 'elastic',
-                  updated: 1558404474317,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNywxXQ==',
-                },
-                {
-                  eventId: '4l0W12oB9v5HJNSHY4wv',
-                  note: 'again',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404491600,
-                  createdBy: 'elastic',
-                  updated: 1558404491600,
-                  updatedBy: 'elastic',
-                  version: 'WzE0MSwxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'Hello world',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404450688,
-                  createdBy: 'elastic',
-                  updated: 1558404450688,
-                  updatedBy: 'elastic',
-                  version: 'WzEzMywxXQ==',
-                },
-                {
-                  eventId: null,
-                  note: 'here I am',
-                  timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
-                  timelineVersion: null,
-                  noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-                  created: 1558404458065,
-                  createdBy: 'elastic',
-                  updated: 1558404458065,
-                  updatedBy: 'elastic',
-                  version: 'WzEzNCwxXQ==',
-                },
-              ],
-              noteIds: [
-                '308783f0-7b6d-11e9-980a-e5349fc014ef',
-                '34ec1690-7b6d-11e9-980a-e5349fc014ef',
-              ],
-              pinnedEventIds: [
-                'Wl0W12oB9v5HJNSHb400',
-                '410W12oB9v5HJNSHY4wv',
-                'ZF0W12oB9v5HJNSHwY6L',
-              ],
-              title: 'test 7',
-              timelineType: TimelineType.default,
-              templateTimelineId: null,
-              templateTimelineVersion: null,
-              created: 1558386787614,
-              createdBy: 'elastic',
-              updated: 1558390951234,
-              updatedBy: 'elastic',
-              version: 'WzEyOCwxXQ==',
-            },
-          ],
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f91',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
         },
-      },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 2',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
     },
-  },
-];
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f92',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 2',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 3',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f93',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 4',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f94',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 5',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f95',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 6',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f96',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 7',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f97',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 7',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f98',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 7',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f99',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 7',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f910',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 7',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+    {
+      savedObjectId: '10849df0-7b44-11e9-a608-ab3d811602f911',
+      description: 'hhw4',
+      favorite: [
+        {
+          fullName: null,
+          userName: 'elastic',
+          favoriteDate: 1558390951234,
+        },
+      ],
+      eventIdToNoteIds: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          timelineVersion: null,
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+      ],
+      notes: [
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'test pinned event 2',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '44763500-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404484133,
+          createdBy: 'elastic',
+          updated: 1558404484133,
+          updatedBy: 'elastic',
+          version: 'WzEzOSwxXQ==',
+        },
+        {
+          eventId: 'ZF0W12oB9v5HJNSHwY6L',
+          note: 'Test pinned 1',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '3e9d51e0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404474317,
+          createdBy: 'elastic',
+          updated: 1558404474317,
+          updatedBy: 'elastic',
+          version: 'WzEzNywxXQ==',
+        },
+        {
+          eventId: '4l0W12oB9v5HJNSHY4wv',
+          note: 'again',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '48eaf440-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404491600,
+          createdBy: 'elastic',
+          updated: 1558404491600,
+          updatedBy: 'elastic',
+          version: 'WzE0MSwxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'Hello world',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '308783f0-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404450688,
+          createdBy: 'elastic',
+          updated: 1558404450688,
+          updatedBy: 'elastic',
+          version: 'WzEzMywxXQ==',
+        },
+        {
+          eventId: null,
+          note: 'here I am',
+          timelineId: '10849df0-7b44-11e9-a608-ab3d811602f9',
+          timelineVersion: null,
+          noteId: '34ec1690-7b6d-11e9-980a-e5349fc014ef',
+          created: 1558404458065,
+          createdBy: 'elastic',
+          updated: 1558404458065,
+          updatedBy: 'elastic',
+          version: 'WzEzNCwxXQ==',
+        },
+      ],
+      noteIds: ['308783f0-7b6d-11e9-980a-e5349fc014ef', '34ec1690-7b6d-11e9-980a-e5349fc014ef'],
+      pinnedEventIds: ['Wl0W12oB9v5HJNSHb400', '410W12oB9v5HJNSHY4wv', 'ZF0W12oB9v5HJNSHwY6L'],
+      title: 'test 7',
+      timelineType: TimelineType.default,
+      templateTimelineId: null,
+      templateTimelineVersion: null,
+      created: 1558386787614,
+      createdBy: 'elastic',
+      updated: 1558390951234,
+      updatedBy: 'elastic',
+      version: 'WzEyOCwxXQ==',
+    },
+  ],
+};
 
 /** Mocks results of a query run by the `OpenTimeline` component */
 export const mockTimelineResults: OpenTimelineResult[] = [
@@ -2170,7 +2040,7 @@ export const mockTimelineModel: TimelineModel = {
   version: '1',
 };
 
-export const mockTimelineResult: TimelineResult = {
+export const mockGetOneTimelineResult: TimelineResult = {
   savedObjectId: 'ef579e40-jibber-jabber',
   columns: timelineDefaults.columns.filter((column) => column.id !== 'event.action'),
   dateRange: { start: '2020-03-18T13:46:38.929Z', end: '2020-03-18T13:52:38.929Z' },
@@ -2193,13 +2063,13 @@ export const mockTimelineResult: TimelineResult = {
   templateTimelineId: null,
   templateTimelineVersion: null,
   savedQueryId: null,
-  sort: [{ columnId: '@timestamp', columnType: 'number', sortDirection: 'desc' }],
+  sort: [{ columnId: '@timestamp', columnType: 'number', sortDirection: Direction.desc }],
   version: '1',
 };
 
-export const mockTimelineApolloResult = {
+export const mockTimelineResult = {
   data: {
-    getOneTimeline: mockTimelineResult,
+    getOneTimeline: mockGetOneTimelineResult,
   },
   loading: false,
   networkStatus: 7,
diff --git a/x-pack/plugins/security_solution/public/common/store/store.ts b/x-pack/plugins/security_solution/public/common/store/store.ts
index efd97891f15731..e253ae1bbaf985 100644
--- a/x-pack/plugins/security_solution/public/common/store/store.ts
+++ b/x-pack/plugins/security_solution/public/common/store/store.ts
@@ -26,7 +26,6 @@ import { timelineSelectors } from '../../timelines/store/timeline';
 import { inputsSelectors } from './inputs';
 import { SubPluginsInitReducer, createReducer } from './reducer';
 import { createRootEpic } from './epic';
-import { AppApolloClient } from '../lib/lib';
 import { AppAction } from './actions';
 import { Immutable } from '../../../common/endpoint/types';
 import { State } from './types';
@@ -52,7 +51,6 @@ let store: Store<State, Action> | null = null;
 export const createStore = (
   state: PreloadedState<State>,
   pluginsReducer: SubPluginsInitReducer,
-  apolloClient: Observable<AppApolloClient>,
   kibana: Observable<CoreStart>,
   storage: Storage,
   additionalMiddleware?: Array<Middleware<{}, State, Dispatch<AppAction | Immutable<AppAction>>>>
@@ -60,7 +58,6 @@ export const createStore = (
   const composeEnhancers = window.__REDUX_DEVTOOLS_EXTENSION_COMPOSE__ || compose;
 
   const middlewareDependencies: TimelineEpicDependencies<State> = {
-    apolloClient$: apolloClient,
     kibana$: kibana,
     selectAllTimelineQuery: inputsSelectors.globalQueryByIdSelector,
     selectNotesByIdSelector: appSelectors.selectNotesByIdSelector,
diff --git a/x-pack/plugins/security_solution/public/common/utils/apollo_context.ts b/x-pack/plugins/security_solution/public/common/utils/apollo_context.ts
deleted file mode 100644
index c53d9903cd8d57..00000000000000
--- a/x-pack/plugins/security_solution/public/common/utils/apollo_context.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { ApolloClient } from 'apollo-client';
-import { createContext, useContext } from 'react';
-
-/**
- * This is a temporary provider and hook for use with hooks until react-apollo
- * has upgraded to the new-style `createContext` api.
- */
-
-export const ApolloClientContext = createContext<ApolloClient<{}> | undefined>(undefined);
-
-export const useApolloClient = () => {
-  return useContext(ApolloClientContext);
-};
diff --git a/x-pack/plugins/security_solution/public/common/utils/route/types.ts b/x-pack/plugins/security_solution/public/common/utils/route/types.ts
index 7305fc31210850..189e68d1c55bb2 100644
--- a/x-pack/plugins/security_solution/public/common/utils/route/types.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/route/types.ts
@@ -14,7 +14,7 @@ import { TimelineType } from '../../../../common/types/timeline';
 import { HostsTableType } from '../../../hosts/store/model';
 import { NetworkRouteType } from '../../../network/pages/navigation/types';
 import { AdministrationSubTab as AdministrationType } from '../../../management/types';
-import { FlowTarget } from '../../../graphql/types';
+import { FlowTarget } from '../../../../common/search_strategy';
 
 export type SiemRouteType = HostsTableType | NetworkRouteType | TimelineType | AdministrationType;
 export interface RouteSpyState {
diff --git a/x-pack/plugins/security_solution/public/common/utils/timeline/use_timeline_click.tsx b/x-pack/plugins/security_solution/public/common/utils/timeline/use_timeline_click.tsx
index 4289ccfbc61fa6..2756ba2a696e10 100644
--- a/x-pack/plugins/security_solution/public/common/utils/timeline/use_timeline_click.tsx
+++ b/x-pack/plugins/security_solution/public/common/utils/timeline/use_timeline_click.tsx
@@ -7,7 +7,6 @@
 
 import { useCallback } from 'react';
 import { useDispatch } from 'react-redux';
-import { useApolloClient } from '../../../common/utils/apollo_context';
 import {
   dispatchUpdateTimeline,
   queryTimelineById,
@@ -16,12 +15,10 @@ import { updateIsLoading as dispatchUpdateIsLoading } from '../../../timelines/s
 
 export const useTimelineClick = () => {
   const dispatch = useDispatch();
-  const apolloClient = useApolloClient();
 
   const handleTimelineClick = useCallback(
     (timelineId: string, graphEventId?: string) => {
       queryTimelineById({
-        apolloClient,
         graphEventId,
         timelineId,
         updateIsLoading: ({
@@ -34,7 +31,7 @@ export const useTimelineClick = () => {
         updateTimeline: dispatchUpdateTimeline(dispatch),
       });
     },
-    [apolloClient, dispatch]
+    [dispatch]
   );
 
   return handleTimelineClick;
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index 6eccba954a1750..d5b64a8fe27fce 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { get } from 'lodash/fp';
 import sinon from 'sinon';
 import moment from 'moment';
 
@@ -13,9 +12,7 @@ import { sendAlertToTimelineAction, determineToAndFrom } from './actions';
 import {
   mockEcsDataWithAlert,
   defaultTimelineProps,
-  apolloClient,
-  mockTimelineApolloResult,
-  mockTimelineDetailsApollo,
+  mockTimelineResult,
   mockTimelineDetails,
 } from '../../../common/mock/';
 import { CreateTimeline, UpdateTimelineLoading } from './types';
@@ -28,8 +25,11 @@ import {
 } from '../../../../common/types/timeline';
 import { ISearchStart } from '../../../../../../../src/plugins/data/public';
 import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+import { getTimelineTemplate } from '../../../timelines/containers/api';
 
-jest.mock('apollo-client');
+jest.mock('../../../timelines/containers/api', () => ({
+  getTimelineTemplate: jest.fn(),
+}));
 
 describe('alert actions', () => {
   const anchor = '2020-03-01T17:59:46.349Z';
@@ -60,13 +60,7 @@ describe('alert actions', () => {
       searchSource: {} as ISearchStart['searchSource'],
     };
 
-    jest.spyOn(apolloClient, 'query').mockImplementation((obj) => {
-      const id = get('variables.id', obj);
-      if (id != null) {
-        return Promise.resolve(mockTimelineApolloResult);
-      }
-      return Promise.resolve(mockTimelineDetailsApollo);
-    });
+    (getTimelineTemplate as jest.Mock).mockResolvedValue(mockTimelineResult);
 
     clock = sinon.useFakeTimers(unix);
   });
@@ -79,7 +73,6 @@ describe('alert actions', () => {
     describe('timeline id is NOT empty string and apollo client exists', () => {
       test('it invokes updateTimelineIsLoading to set to true', async () => {
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
           nonEcsData: [],
@@ -96,7 +89,6 @@ describe('alert actions', () => {
 
       test('it invokes createTimeline with designated timeline template if "timelineTemplate" exists', async () => {
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
           nonEcsData: [],
@@ -236,8 +228,8 @@ describe('alert actions', () => {
       });
 
       test('it invokes createTimeline with kqlQuery.filterQuery.kuery.kind as "kuery" if not specified in returned timeline template', async () => {
-        const mockTimelineApolloResultModified = {
-          ...mockTimelineApolloResult,
+        const mockTimelineResultModified = {
+          ...mockTimelineResult,
           kqlQuery: {
             filterQuery: {
               kuery: {
@@ -246,10 +238,9 @@ describe('alert actions', () => {
             },
           },
         };
-        jest.spyOn(apolloClient, 'query').mockResolvedValue(mockTimelineApolloResultModified);
+        (getTimelineTemplate as jest.Mock).mockResolvedValue(mockTimelineResultModified);
 
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
           nonEcsData: [],
@@ -263,12 +254,11 @@ describe('alert actions', () => {
       });
 
       test('it invokes createTimeline with default timeline if apolloClient throws', async () => {
-        jest.spyOn(apolloClient, 'query').mockImplementation(() => {
+        (getTimelineTemplate as jest.Mock).mockImplementation(() => {
           throw new Error('Test error');
         });
 
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
           nonEcsData: [],
@@ -303,7 +293,6 @@ describe('alert actions', () => {
         };
 
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: ecsDataMock,
           nonEcsData: [],
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index 4dd40eb2ddaeef..e5cefca66d0fdd 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -13,7 +13,12 @@ import moment from 'moment';
 import { i18n } from '@kbn/i18n';
 
 import type { Filter } from '../../../../../../../src/plugins/data/common/es_query/filters';
-import { TimelineId, TimelineStatus, TimelineType } from '../../../../common/types/timeline';
+import {
+  TimelineId,
+  TimelineResult,
+  TimelineStatus,
+  TimelineType,
+} from '../../../../common/types/timeline';
 import { updateAlertStatus } from '../../containers/detection_engine/alerts/api';
 import {
   SendAlertToTimelineActionProps,
@@ -21,7 +26,6 @@ import {
   UpdateAlertStatusActionProps,
 } from './types';
 import { Ecs } from '../../../../common/ecs';
-import { GetOneTimeline, TimelineResult } from '../../../graphql/types';
 import {
   TimelineNonEcsData,
   TimelineEventsDetailsItem,
@@ -29,7 +33,6 @@ import {
   TimelineEventsDetailsStrategyResponse,
   TimelineEventsQueries,
 } from '../../../../common/search_strategy/timeline';
-import { oneTimelineQuery } from '../../../timelines/containers/one/index.gql_query';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import {
   omitTypenameInTimeline,
@@ -47,6 +50,7 @@ import {
   QueryOperator,
 } from '../../../timelines/components/timeline/data_providers/data_provider';
 import { esFilters } from '../../../../../../../src/plugins/data/public';
+import { getTimelineTemplate } from '../../../timelines/containers/api';
 
 export const getUpdateAlertsQuery = (eventIds: Readonly<string[]>) => {
   return {
@@ -362,7 +366,6 @@ export const buildEqlDataProviderOrFilter = (
 };
 
 export const sendAlertToTimelineAction = async ({
-  apolloClient,
   createTimeline,
   ecsData: ecs,
   nonEcsData,
@@ -381,18 +384,11 @@ export const sendAlertToTimelineAction = async ({
   const { to, from } = determineToAndFrom({ ecs });
 
   // For now we do not want to populate the template timeline if we have alertIds
-  if (!isEmpty(timelineId) && apolloClient != null && isEmpty(alertIds)) {
+  if (!isEmpty(timelineId) && isEmpty(alertIds)) {
     try {
       updateTimelineIsLoading({ id: TimelineId.active, isLoading: true });
       const [responseTimeline, eventDataResp] = await Promise.all([
-        apolloClient.query<GetOneTimeline.Query, GetOneTimeline.Variables>({
-          query: oneTimelineQuery,
-          fetchPolicy: 'no-cache',
-          variables: {
-            id: timelineId,
-            timelineType: TimelineType.template,
-          },
-        }),
+        getTimelineTemplate(timelineId),
         searchStrategyClient
           .search<TimelineEventsDetailsRequestOptions, TimelineEventsDetailsStrategyResponse>(
             {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts
index 98cb939ca2656a..69cf6ac43d4a74 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts
@@ -18,7 +18,7 @@ import {
   DataProvidersAnd,
 } from '../../../timelines/components/timeline/data_providers/data_provider';
 import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
-import { TimelineType } from '../../../graphql/types';
+import { TimelineType } from '../../../../common/types/timeline';
 
 interface FindValueToChangeInQuery {
   field: string;
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
index 2f0fee980c2181..3bf30d57d4a8a5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
@@ -13,7 +13,6 @@ import { TimelineId } from '../../../../../common/types/timeline';
 import { Ecs } from '../../../../../common/ecs';
 import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
 import { timelineActions } from '../../../../timelines/store/timeline';
-import { useApolloClient } from '../../../../common/utils/apollo_context';
 import { sendAlertToTimelineAction } from '../actions';
 import { dispatchUpdateTimeline } from '../../../../timelines/components/open_timeline/helpers';
 import { ActionIconItem } from '../../../../timelines/components/timeline/body/actions/action_icon_item';
@@ -42,7 +41,6 @@ const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineAction
     data: { search: searchStrategyClient },
   } = useKibana().services;
   const dispatch = useDispatch();
-  const apolloClient = useApolloClient();
 
   const updateTimelineIsLoading = useCallback(
     (payload) => dispatch(timelineActions.updateIsLoading(payload)),
@@ -74,7 +72,6 @@ const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineAction
     try {
       if (ecsRowData != null) {
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: ecsRowData,
           nonEcsData: nonEcsRowData,
@@ -85,7 +82,6 @@ const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineAction
       if (ecsRowData == null && fetchEcsAlertsData) {
         const alertsEcsData = await fetchEcsAlertsData(alertIds);
         await sendAlertToTimelineAction({
-          apolloClient,
           createTimeline,
           ecsData: alertsEcsData,
           nonEcsData: nonEcsRowData,
@@ -98,7 +94,6 @@ const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineAction
     }
   }, [
     alertIds,
-    apolloClient,
     createTimeline,
     ecsRowData,
     fetchEcsAlertsData,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
index 987372b95a26ce..290f9ed560f2e3 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
@@ -5,14 +5,12 @@
  * 2.0.
  */
 
-import ApolloClient from 'apollo-client';
-
 import { ISearchStart } from '../../../../../../../src/plugins/data/public';
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
 import { Ecs } from '../../../../common/ecs';
 import { TimelineNonEcsData } from '../../../../common/search_strategy/timeline';
+import { NoteResult } from '../../../../common/types/timeline/note';
 import { DataProvider } from '../../../timelines/components/timeline/data_providers/data_provider';
-import { NoteResult } from '../../../graphql/types';
 import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { inputsModel } from '../../../common/store';
 
@@ -54,7 +52,6 @@ export interface UpdateAlertStatusActionProps {
 }
 
 export interface SendAlertToTimelineActionProps {
-  apolloClient?: ApolloClient<{}>;
   createTimeline: CreateTimeline;
   ecsData: Ecs | Ecs[];
   nonEcsData: TimelineNonEcsData[];
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.test.tsx
index 4c303bb7dd093a..3400a960bbc60a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.test.tsx
@@ -15,7 +15,7 @@ import { AllRulesTabs } from '../../../pages/detection_engine/rules/all';
 describe('AllRulesTables', () => {
   it('renders correctly', () => {
     const Component = () => {
-      const ref = useRef();
+      const ref = useRef(null);
 
       return (
         <AllRulesTables
@@ -50,7 +50,7 @@ describe('AllRulesTables', () => {
 
   it('renders rules tab when "selectedTab" is "rules"', () => {
     const Component = () => {
-      const ref = useRef();
+      const ref = useRef(null);
 
       return (
         <AllRulesTables
@@ -86,7 +86,7 @@ describe('AllRulesTables', () => {
 
   it('renders monitoring tab when "selectedTab" is "monitoring"', () => {
     const Component = () => {
-      const ref = useRef();
+      const ref = useRef(null);
 
       return (
         <AllRulesTables
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx
index 1292c3fc69a280..dc513f9581db6d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx
@@ -6,28 +6,22 @@
  */
 
 import {
+  Direction,
   EuiBasicTable,
   EuiBasicTableColumn,
   EuiEmptyPrompt,
-  Direction,
   EuiTableSelectionType,
 } from '@elastic/eui';
-import React, { useMemo, memo } from 'react';
-import styled from 'styled-components';
 
-import { EuiBasicTableOnChange } from '../../../pages/detection_engine/rules/types';
-import * as i18n from '../../../pages/detection_engine/rules/translations';
+import React, { memo } from 'react';
+import { Rule, Rules, RulesSortingFields } from '../../../containers/detection_engine/rules/types';
+import { AllRulesTabs } from '../../../pages/detection_engine/rules/all';
 import {
   RulesColumns,
   RuleStatusRowItemType,
 } from '../../../pages/detection_engine/rules/all/columns';
-import { Rule, Rules, RulesSortingFields } from '../../../containers/detection_engine/rules/types';
-import { AllRulesTabs } from '../../../pages/detection_engine/rules/all';
-
-// EuiBasicTable give me a hardtime with adding the ref attributes so I went the easy way
-// after few hours of fight with typescript !!!! I lost :(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const MyEuiBasicTable = styled(EuiBasicTable as any)`` as any;
+import * as i18n from '../../../pages/detection_engine/rules/translations';
+import { EuiBasicTableOnChange } from '../../../pages/detection_engine/rules/types';
 
 export interface SortingType {
   sort: {
@@ -51,10 +45,14 @@ interface AllRulesTablesProps {
   rulesStatuses: RuleStatusRowItemType[];
   sorting: SortingType;
   tableOnChangeCallback: ({ page, sort }: EuiBasicTableOnChange) => void;
-  tableRef?: React.MutableRefObject<EuiBasicTable | undefined>;
+  tableRef?: React.MutableRefObject<EuiBasicTable | null>;
   selectedTab: AllRulesTabs;
 }
 
+const emptyPrompt = (
+  <EuiEmptyPrompt title={<h3>{i18n.NO_RULES}</h3>} titleSize="xs" body={i18n.NO_RULES_BODY} />
+);
+
 export const AllRulesTablesComponent: React.FC<AllRulesTablesProps> = ({
   euiBasicTableSelectionProps,
   hasNoPermissions,
@@ -68,16 +66,10 @@ export const AllRulesTablesComponent: React.FC<AllRulesTablesProps> = ({
   tableRef,
   selectedTab,
 }) => {
-  const emptyPrompt = useMemo(() => {
-    return (
-      <EuiEmptyPrompt title={<h3>{i18n.NO_RULES}</h3>} titleSize="xs" body={i18n.NO_RULES_BODY} />
-    );
-  }, []);
-
   return (
     <>
       {selectedTab === AllRulesTabs.rules && (
-        <MyEuiBasicTable
+        <EuiBasicTable
           data-test-subj="rules-table"
           columns={rulesColumns}
           isSelectable={!hasNoPermissions ?? false}
@@ -92,7 +84,7 @@ export const AllRulesTablesComponent: React.FC<AllRulesTablesProps> = ({
         />
       )}
       {selectedTab === AllRulesTabs.monitoring && (
-        <MyEuiBasicTable
+        <EuiBasicTable
           data-test-subj="monitoring-table"
           columns={monitoringColumns}
           isSelectable={!hasNoPermissions ?? false}
@@ -101,7 +93,6 @@ export const AllRulesTablesComponent: React.FC<AllRulesTablesProps> = ({
           noItemsMessage={emptyPrompt}
           onChange={tableOnChangeCallback}
           pagination={pagination}
-          sorting={sorting}
         />
       )}
     </>
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.test.tsx
index c354b7081c72c8..53f478da28055f 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.test.tsx
@@ -11,6 +11,7 @@ import React from 'react';
 import {
   deleteRulesAction,
   duplicateRulesAction,
+  editRuleAction,
 } from '../../../pages/detection_engine/rules/all/actions';
 import { RuleActionsOverflow } from './index';
 import { mockRule } from '../../../pages/detection_engine/rules/all/__mocks__/mock';
@@ -24,9 +25,17 @@ jest.mock('react-router-dom', () => ({
 jest.mock('../../../pages/detection_engine/rules/all/actions', () => ({
   deleteRulesAction: jest.fn(),
   duplicateRulesAction: jest.fn(),
+  editRuleAction: jest.fn(),
 }));
 
+const duplicateRulesActionMock = duplicateRulesAction as jest.Mock;
+const flushPromises = () => new Promise(setImmediate);
+
 describe('RuleActionsOverflow', () => {
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
   describe('snapshots', () => {
     test('renders correctly against snapshot', () => {
       const wrapper = shallow(
@@ -208,6 +217,27 @@ describe('RuleActionsOverflow', () => {
     });
   });
 
+  test('it calls editRuleAction after the rule is duplicated', async () => {
+    const rule = mockRule('id');
+    const ruleDuplicate = mockRule('newRule');
+    duplicateRulesActionMock.mockImplementation(() => Promise.resolve([ruleDuplicate]));
+    const wrapper = mount(
+      <RuleActionsOverflow
+        rule={rule}
+        userHasNoPermissions={false}
+        canDuplicateRuleWithActions={true}
+      />
+    );
+    wrapper.find('[data-test-subj="rules-details-popover-button-icon"] button').simulate('click');
+    wrapper.update();
+    wrapper.find('[data-test-subj="rules-details-duplicate-rule"] button').simulate('click');
+    wrapper.update();
+    await flushPromises();
+
+    expect(duplicateRulesAction).toHaveBeenCalled();
+    expect(editRuleAction).toHaveBeenCalledWith(ruleDuplicate, expect.anything());
+  });
+
   describe('rules details export rule', () => {
     test('it does not open the popover when rules-details-popover-button-icon is clicked and the user does not have permission', () => {
       const rule = mockRule('id');
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.tsx
index d1077b282ec5ef..0482e1997c9d13 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.tsx
@@ -24,6 +24,7 @@ import { displaySuccessToast, useStateToaster } from '../../../../common/compone
 import {
   deleteRulesAction,
   duplicateRulesAction,
+  editRuleAction,
 } from '../../../pages/detection_engine/rules/all/actions';
 import { GenericDownloader } from '../../../../common/components/generic_downloader';
 import { getRulesUrl } from '../../../../common/components/link_to/redirect_to_detection_engine';
@@ -74,7 +75,15 @@ const RuleActionsOverflowComponent = ({
               data-test-subj="rules-details-duplicate-rule"
               onClick={async () => {
                 setIsPopoverOpen(false);
-                await duplicateRulesAction([rule], [rule.id], noop, dispatchToaster);
+                const createdRules = await duplicateRulesAction(
+                  [rule],
+                  [rule.id],
+                  noop,
+                  dispatchToaster
+                );
+                if (createdRules?.length) {
+                  editRuleAction(createdRules[0], history);
+                }
               }}
             >
               <EuiToolTip
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
index 3a9697da8bd640..3d1b3a422ff642 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
@@ -405,6 +405,15 @@ describe('Detections Rules API', () => {
       });
     });
 
+    test('check duplicated rules are disabled by default', async () => {
+      await duplicateRules({ rules: rulesMock.data.map((rule) => ({ ...rule, enabled: true })) });
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      const [path, options] = fetchMock.mock.calls[0];
+      expect(path).toBe('/api/detection_engine/rules/_bulk_create');
+      const rules = JSON.parse(options.body);
+      expect(rules).toMatchObject([{ enabled: false }, { enabled: false }]);
+    });
+
     test('happy path', async () => {
       const ruleResp = await duplicateRules({ rules: rulesMock.data });
       expect(ruleResp).toEqual(rulesMock);
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
index edcab974c97611..d4c4e10813172a 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
@@ -231,7 +231,7 @@ export const duplicateRules = async ({ rules }: DuplicateRulesProps): Promise<Bu
         rule_id: undefined,
         updated_at: undefined,
         updated_by: undefined,
-        enabled: rule.enabled,
+        enabled: false,
         immutable: undefined,
         last_success_at: undefined,
         last_success_message: undefined,
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.test.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.test.ts
index c90bfe2b0267f4..60edeaf0de9832 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.test.ts
@@ -42,7 +42,7 @@ describe('allRulesReducer', () => {
     jest
       .spyOn(global.Date, 'now')
       .mockImplementationOnce(() => new Date('2020-10-31T11:01:58.135Z').valueOf());
-    reducer = createRulesTableReducer({ current: undefined });
+    reducer = createRulesTableReducer({ current: null });
   });
 
   afterEach(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.ts
index 92f21f6b508aaa..01a87fef2b723d 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/rules_table_reducer.ts
@@ -50,7 +50,7 @@ export type RulesTableAction =
   | { type: 'failure' };
 
 export const createRulesTableReducer = (
-  tableRef: React.MutableRefObject<EuiBasicTable<unknown> | undefined>
+  tableRef: React.MutableRefObject<EuiBasicTable<unknown> | null>
 ) => {
   const rulesTableReducer = (state: RulesTableState, action: RulesTableAction): RulesTableState => {
     switch (action.type) {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/use_rules_table.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/use_rules_table.ts
index e36474a2fdddd0..7fcefe02cfe33b 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/use_rules_table.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/rules_table/use_rules_table.ts
@@ -43,7 +43,7 @@ const initialStateDefaults: RulesTableState = {
 };
 
 export interface UseRulesTableParams {
-  tableRef: React.MutableRefObject<EuiBasicTable<unknown> | undefined>;
+  tableRef: React.MutableRefObject<EuiBasicTable<unknown> | null>;
   initialStateOverride?: Partial<RulesTableState>;
 }
 
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
index d9fc3a60cb7170..6bca9bf2756bbb 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
@@ -11,7 +11,6 @@ import { useParams } from 'react-router-dom';
 import { waitFor } from '@testing-library/react';
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   createSecuritySolutionStorageMock,
   kibanaObservable,
   mockGlobalState,
@@ -62,13 +61,7 @@ const state: State = {
 };
 
 const { storage } = createSecuritySolutionStorageMock();
-const store = createStore(
-  state,
-  SUB_PLUGINS_REDUCER,
-  apolloClientObservable,
-  kibanaObservable,
-  storage
-);
+const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
 describe('DetectionEnginePageComponent', () => {
   beforeAll(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/actions.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/actions.tsx
index 6cc75a3fda03c5..de33d414398a87 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/actions.tsx
@@ -40,7 +40,7 @@ export const duplicateRulesAction = async (
   ruleIds: string[],
   dispatch: React.Dispatch<RulesTableAction>,
   dispatchToaster: Dispatch<ActionToaster>
-) => {
+): Promise<Rule[] | undefined> => {
   try {
     dispatch({ type: 'loadingRuleIds', ids: ruleIds, actionType: 'duplicate' });
     const response = await duplicateRules({
@@ -48,7 +48,7 @@ export const duplicateRulesAction = async (
       // and the two types conflict with each other.
       rules: rules.map((rule) => transformOutput(rule as CreateRulesSchema) as Rule),
     });
-    const { errors } = bucketRulesResponse(response);
+    const { errors, rules: createdRules } = bucketRulesResponse(response);
     if (errors.length > 0) {
       displayErrorToast(
         i18n.DUPLICATE_RULE_ERROR,
@@ -59,6 +59,8 @@ export const duplicateRulesAction = async (
       displaySuccessToast(i18n.SUCCESSFULLY_DUPLICATED_RULES(ruleIds.length), dispatchToaster);
     }
     dispatch({ type: 'loadingRuleIds', ids: [], actionType: null });
+
+    return createdRules;
   } catch (error) {
     dispatch({ type: 'loadingRuleIds', ids: [], actionType: null });
     errorToToaster({ title: i18n.DUPLICATE_RULE_ERROR, error, dispatchToaster });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
index d3e055a695d61b..648d653d6a3c84 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
@@ -132,6 +132,7 @@ export const getBatchItems = ({
 
     <EuiContextMenuItem
       key={i18n.BATCH_ACTION_DUPLICATE_SELECTED}
+      data-test-subj="duplicateRuleBulk"
       icon="copy"
       disabled={missingActionPrivileges || containsLoading || selectedRuleIds.length === 0}
       onClick={async () => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.test.tsx
index d39009cd9631ca..8eb80bd0d51352 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.test.tsx
@@ -5,50 +5,41 @@
  * 2.0.
  */
 
+import { scopedHistoryMock } from 'src/core/public/mocks';
 import uuid from 'uuid';
-import { createMemoryHistory } from 'history';
-
-const history = createMemoryHistory();
-
 import '../../../../../common/mock/match_media';
-import { mockRule } from './__mocks__/mock';
+import { deleteRulesAction, duplicateRulesAction, editRuleAction } from './actions';
 import { getActions } from './columns';
+import { mockRule } from './__mocks__/mock';
 
 jest.mock('./actions', () => ({
   duplicateRulesAction: jest.fn(),
   deleteRulesAction: jest.fn(),
+  editRuleAction: jest.fn(),
 }));
 
-import { duplicateRulesAction, deleteRulesAction } from './actions';
+const history = scopedHistoryMock.create();
+const duplicateRulesActionMock = duplicateRulesAction as jest.Mock;
+const deleteRulesActionMock = deleteRulesAction as jest.Mock;
+const editRuleActionMock = editRuleAction as jest.Mock;
 
 describe('AllRulesTable Columns', () => {
   describe('getActions', () => {
     const rule = mockRule(uuid.v4());
-    let results: string[] = [];
     const dispatch = jest.fn();
     const dispatchToaster = jest.fn();
     const reFetchRules = jest.fn();
     const refetchPrePackagedRulesStatus = jest.fn();
 
     beforeEach(() => {
-      results = [];
-
-      reFetchRules.mockImplementation(() => {
-        results.push('reFetchRules');
-        Promise.resolve();
-      });
+      duplicateRulesActionMock.mockClear();
+      deleteRulesActionMock.mockClear();
+      reFetchRules.mockClear();
     });
 
-    test('duplicate rule onClick should call refetch after the rule is duplicated', async () => {
-      (duplicateRulesAction as jest.Mock).mockImplementation(
-        () =>
-          new Promise<void>((resolve) =>
-            setTimeout(() => {
-              results.push('duplicateRulesAction');
-              resolve();
-            }, 500)
-          )
-      );
+    test('duplicate rule onClick should call rule edit after the rule is duplicated', async () => {
+      const ruleDuplicate = mockRule('newRule');
+      duplicateRulesActionMock.mockImplementation(() => Promise.resolve([ruleDuplicate]));
 
       const duplicateRulesActionObject = getActions(
         dispatch,
@@ -59,20 +50,11 @@ describe('AllRulesTable Columns', () => {
         true
       )[1];
       await duplicateRulesActionObject.onClick(rule);
-      expect(results).toEqual(['duplicateRulesAction', 'reFetchRules']);
+      expect(duplicateRulesActionMock).toHaveBeenCalled();
+      expect(editRuleActionMock).toHaveBeenCalledWith(ruleDuplicate, history);
     });
 
     test('delete rule onClick should call refetch after the rule is deleted', async () => {
-      (deleteRulesAction as jest.Mock).mockImplementation(
-        () =>
-          new Promise<void>((resolve) =>
-            setTimeout(() => {
-              results.push('deleteRulesAction');
-              resolve();
-            }, 500)
-          )
-      );
-
       const deleteRulesActionObject = getActions(
         dispatch,
         dispatchToaster,
@@ -82,7 +64,11 @@ describe('AllRulesTable Columns', () => {
         true
       )[3];
       await deleteRulesActionObject.onClick(rule);
-      expect(results).toEqual(['deleteRulesAction', 'reFetchRules']);
+      expect(deleteRulesActionMock).toHaveBeenCalledTimes(1);
+      expect(reFetchRules).toHaveBeenCalledTimes(1);
+      expect(deleteRulesActionMock.mock.invocationCallOrder[0]).toBeLessThan(
+        reFetchRules.mock.invocationCallOrder[0]
+      );
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
index bb5dd590a8ea2d..9ecfdc42d0792a 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
@@ -80,9 +80,15 @@ export const getActions = (
     ),
     enabled: (rowItem: Rule) => canEditRuleWithActions(rowItem, actionsPrivileges),
     onClick: async (rowItem: Rule) => {
-      await duplicateRulesAction([rowItem], [rowItem.id], dispatch, dispatchToaster);
-      await reFetchRules();
-      await refetchPrePackagedRulesStatus();
+      const createdRules = await duplicateRulesAction(
+        [rowItem],
+        [rowItem.id],
+        dispatch,
+        dispatchToaster
+      );
+      if (createdRules?.length) {
+        editRuleAction(createdRules[0], history);
+      }
     },
   },
   {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx
index d5acf0e1de3cf8..5cfa5ecd225ecc 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx
@@ -13,7 +13,6 @@ import {
   EuiProgress,
   EuiSearchBarProps,
 } from '@elastic/eui';
-import styled from 'styled-components';
 import { History } from 'history';
 
 import { AutoDownload } from '../../../../../../common/components/auto_download/auto_download';
@@ -34,10 +33,6 @@ import { patchRule } from '../../../../../containers/detection_engine/rules/api'
 import { ExceptionsSearchBar } from './exceptions_search_bar';
 import { getSearchFilters } from '../helpers';
 
-// Known lost battle with Eui :(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const MyEuiBasicTable = styled(EuiBasicTable as any)`` as any;
-
 export type Func = () => Promise<void>;
 
 interface ExceptionListsTableProps {
@@ -317,7 +312,7 @@ export const ExceptionListsTable = React.memo<ExceptionListsTableProps>(
       () => ({
         pageIndex: pagination.page - 1,
         pageSize: pagination.perPage,
-        totalItemCount: pagination.total,
+        totalItemCount: pagination.total || 0,
         pageSizeOptions: [5, 10, 20, 50, 100, 200, 300],
       }),
       [pagination]
@@ -368,7 +363,7 @@ export const ExceptionListsTable = React.memo<ExceptionListsTableProps>(
                   numberSelectedItems={0}
                   onRefresh={handleRefresh}
                 />
-                <MyEuiBasicTable
+                <EuiBasicTable
                   data-test-subj="exceptions-table"
                   columns={exceptionsColumns}
                   isSelectable={!hasNoPermissions ?? false}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_tables.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_tables.tsx
index b8741197a7ab14..353cc657f21167 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_tables.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_tables.tsx
@@ -106,7 +106,7 @@ export const RulesTables = React.memo<RulesTableProps>(
       },
     } = useKibana();
 
-    const tableRef = useRef<EuiBasicTable>();
+    const tableRef = useRef<EuiBasicTable>(null);
 
     const [defaultAutoRefreshSetting] = useUiSetting$<{
       on: boolean;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
index c9468005960a65..b1c7bf8aa41e43 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
@@ -11,7 +11,6 @@ import { waitFor } from '@testing-library/react';
 
 import '../../../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   createSecuritySolutionStorageMock,
   kibanaObservable,
   mockGlobalState,
@@ -60,13 +59,7 @@ const state: State = {
   ...mockGlobalState,
 };
 const { storage } = createSecuritySolutionStorageMock();
-const store = createStore(
-  state,
-  SUB_PLUGINS_REDUCER,
-  apolloClientObservable,
-  kibanaObservable,
-  storage
-);
+const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
 describe('RuleDetailsPageComponent', () => {
   beforeAll(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
index da5cf720d53154..355aa2e4620b86 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
@@ -343,6 +343,7 @@ const EditRulePageComponent: FC = () => {
                 href: getRuleDetailsUrl(ruleId ?? ''),
                 text: `${i18n.BACK_TO} ${rule?.name ?? ''}`,
                 pageId: SecurityPageName.detections,
+                dataTestSubj: 'ruleEditBackToRuleDetails',
               }}
               isLoading={isLoading}
               title={i18n.PAGE_TITLE}
diff --git a/x-pack/plugins/security_solution/public/graphql/introspection.json b/x-pack/plugins/security_solution/public/graphql/introspection.json
deleted file mode 100644
index 752173ded5163e..00000000000000
--- a/x-pack/plugins/security_solution/public/graphql/introspection.json
+++ /dev/null
@@ -1,7647 +0,0 @@
-{
-  "__schema": {
-    "queryType": { "name": "Query" },
-    "mutationType": { "name": "Mutation" },
-    "subscriptionType": null,
-    "types": [
-      {
-        "kind": "OBJECT",
-        "name": "Query",
-        "description": "",
-        "fields": [
-          {
-            "name": "getNote",
-            "description": "",
-            "args": [
-              {
-                "name": "id",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "getNotesByTimelineId",
-            "description": "",
-            "args": [
-              {
-                "name": "timelineId",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "getNotesByEventId",
-            "description": "",
-            "args": [
-              {
-                "name": "eventId",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "getAllNotes",
-            "description": "",
-            "args": [
-              {
-                "name": "pageInfo",
-                "description": "",
-                "type": { "kind": "INPUT_OBJECT", "name": "PageInfoNote", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "search",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "sort",
-                "description": "",
-                "type": { "kind": "INPUT_OBJECT", "name": "SortNote", "ofType": null },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "ResponseNotes", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "getAllPinnedEventsByTimelineId",
-            "description": "",
-            "args": [
-              {
-                "name": "timelineId",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "PinnedEvent", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "source",
-            "description": "Get a security data source by id",
-            "args": [
-              {
-                "name": "id",
-                "description": "The id of the source",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "Source", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "allSources",
-            "description": "Get a list of all security data sources",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "Source", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "getOneTimeline",
-            "description": "",
-            "args": [
-              {
-                "name": "id",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              },
-              {
-                "name": "timelineType",
-                "description": "",
-                "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "TimelineResult", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "getAllTimeline",
-            "description": "",
-            "args": [
-              {
-                "name": "pageInfo",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "INPUT_OBJECT", "name": "PageInfoTimeline", "ofType": null }
-                },
-                "defaultValue": null
-              },
-              {
-                "name": "search",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "sort",
-                "description": "",
-                "type": { "kind": "INPUT_OBJECT", "name": "SortTimeline", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "onlyUserFavorite",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "timelineType",
-                "description": "",
-                "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "status",
-                "description": "",
-                "type": { "kind": "ENUM", "name": "TimelineStatus", "ofType": null },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "ResponseTimelines", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ID",
-        "description": "The `ID` scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as `\"4\"`) or integer (such as `4`) input value will be accepted as an ID.",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "NoteResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "eventId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "note",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timelineId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "noteId",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "created",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "createdBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timelineVersion",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updated",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updatedBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "String",
-        "description": "The `String` scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "Float",
-        "description": "The `Float` scalar type represents signed double-precision fractional values as specified by [IEEE 754](http://en.wikipedia.org/wiki/IEEE_floating_point). ",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "PageInfoNote",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "pageIndex",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "pageSize",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "SortNote",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "sortField",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "ENUM", "name": "SortFieldNote", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "sortOrder",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "ENUM", "name": "Direction", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "SortFieldNote",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "updatedBy",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "updated", "description": "", "isDeprecated": false, "deprecationReason": null }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "Direction",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          { "name": "asc", "description": "", "isDeprecated": false, "deprecationReason": null },
-          { "name": "desc", "description": "", "isDeprecated": false, "deprecationReason": null }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ResponseNotes",
-        "description": "",
-        "fields": [
-          {
-            "name": "notes",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "totalCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "PinnedEvent",
-        "description": "",
-        "fields": [
-          {
-            "name": "code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "pinnedEventId",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "eventId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timelineId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timelineVersion",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "created",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "createdBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updated",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updatedBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "Source",
-        "description": "",
-        "fields": [
-          {
-            "name": "id",
-            "description": "The id of the source",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "configuration",
-            "description": "The raw configuration of the source",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "SourceConfiguration", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "status",
-            "description": "The status of the source",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "SourceStatus", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SourceConfiguration",
-        "description": "A set of configuration options for a security data source",
-        "fields": [
-          {
-            "name": "fields",
-            "description": "The field mapping to use for this source",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "SourceFields", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SourceFields",
-        "description": "A mapping of semantic fields to their document counterparts",
-        "fields": [
-          {
-            "name": "container",
-            "description": "The field to identify a container by",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "host",
-            "description": "The fields to identify a host by",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message",
-            "description": "The fields that may contain the log event message. The first field found win.",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "pod",
-            "description": "The field to identify a pod by",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tiebreaker",
-            "description": "The field to use as a tiebreaker for log events that have identical timestamps",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timestamp",
-            "description": "The field to use as a timestamp for metrics and logs",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SourceStatus",
-        "description": "The status of an infrastructure data source",
-        "fields": [
-          {
-            "name": "indicesExist",
-            "description": "Whether the configured alias or wildcard pattern resolve to any auditbeat indices",
-            "args": [
-              {
-                "name": "defaultIndex",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                    }
-                  }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "indexFields",
-            "description": "The list of fields defined in the index mappings",
-            "args": [
-              {
-                "name": "defaultIndex",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                    }
-                  }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "Boolean",
-        "description": "The `Boolean` scalar type represents `true` or `false`.",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "TimelineType",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "default",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "template",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "TimelineResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "columns",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "ColumnHeaderResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "created",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "createdBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dataProviders",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "DataProviderResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dateRange",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "DateRangePickerResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "eqlOptions",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "EqlOptionsResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "eventIdToNoteIds",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "eventType",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "excludedRowRendererIds",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "ENUM", "name": "RowRendererId", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "favorite",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "FavoriteTimelineResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "filters",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "FilterTimelineResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "kqlMode",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "kqlQuery",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SerializedFilterQueryResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "indexNames",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "notes",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "noteIds",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "pinnedEventIds",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "pinnedEventsSaveObject",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "PinnedEvent", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "savedQueryId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "savedObjectId",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sort",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "status",
-            "description": "",
-            "args": [],
-            "type": { "kind": "ENUM", "name": "TimelineStatus", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "title",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "templateTimelineId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "templateTimelineVersion",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Int", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timelineType",
-            "description": "",
-            "args": [],
-            "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updated",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updatedBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ColumnHeaderResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "aggregatable",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "category",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "columnHeaderType",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "example",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "indexes",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "placeholder",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "searchable",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "DataProviderResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "enabled",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "excluded",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "kqlQuery",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "queryMatch",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "QueryMatchResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "ENUM", "name": "DataProviderType", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "and",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "DataProviderResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "QueryMatchResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "field",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "displayField",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "value",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "displayValue",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "operator",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "DataProviderType",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "default",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "template",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "DateRangePickerResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "start",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "end",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToAny",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "EqlOptionsResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "eventCategoryField",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tiebreakerField",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timestampField",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "query",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "size",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "RowRendererId",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          { "name": "alerts", "description": "", "isDeprecated": false, "deprecationReason": null },
-          { "name": "auditd", "description": "", "isDeprecated": false, "deprecationReason": null },
-          {
-            "name": "auditd_file",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "library",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "netflow",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "plain", "description": "", "isDeprecated": false, "deprecationReason": null },
-          {
-            "name": "registry",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "suricata",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "system", "description": "", "isDeprecated": false, "deprecationReason": null },
-          {
-            "name": "system_dns",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "system_endgame_process",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "system_file",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "system_fim",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "system_security_event",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "system_socket",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "threat_match",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "zeek", "description": "", "isDeprecated": false, "deprecationReason": null }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "FavoriteTimelineResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "fullName",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "userName",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "favoriteDate",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "FilterTimelineResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "exists",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "meta",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "FilterMetaTimelineResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "match_all",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "missing",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "query",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "range",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "script",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "FilterMetaTimelineResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "alias",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "controlledBy",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "disabled",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "field",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "formattedValue",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "index",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "key",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "negate",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "params",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "value",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SerializedFilterQueryResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "filterQuery",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SerializedKueryQueryResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SerializedKueryQueryResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "kuery",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "KueryFilterQueryResult", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "serializedQuery",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "KueryFilterQueryResult",
-        "description": "",
-        "fields": [
-          {
-            "name": "kind",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "expression",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "TimelineStatus",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          { "name": "active", "description": "", "isDeprecated": false, "deprecationReason": null },
-          { "name": "draft", "description": "", "isDeprecated": false, "deprecationReason": null },
-          {
-            "name": "immutable",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "Int",
-        "description": "The `Int` scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1. ",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "PageInfoTimeline",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "pageIndex",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "pageSize",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "SortTimeline",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "sortField",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "ENUM", "name": "SortFieldTimeline", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "sortOrder",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "ENUM", "name": "Direction", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "SortFieldTimeline",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          { "name": "title", "description": "", "isDeprecated": false, "deprecationReason": null },
-          {
-            "name": "description",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updated",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "created", "description": "", "isDeprecated": false, "deprecationReason": null }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ResponseTimelines",
-        "description": "",
-        "fields": [
-          {
-            "name": "timeline",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "TimelineResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "totalCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "defaultTimelineCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "templateTimelineCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "elasticTemplateTimelineCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "customTemplateTimelineCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "favoriteCount",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "Mutation",
-        "description": "",
-        "fields": [
-          {
-            "name": "persistNote",
-            "description": "Persists a note",
-            "args": [
-              {
-                "name": "noteId",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "version",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "note",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "INPUT_OBJECT", "name": "NoteInput", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "ResponseNote", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deleteNote",
-            "description": "",
-            "args": [
-              {
-                "name": "id",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                    }
-                  }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deleteNoteByTimelineId",
-            "description": "",
-            "args": [
-              {
-                "name": "timelineId",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              },
-              {
-                "name": "version",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-                "defaultValue": null
-              }
-            ],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "persistPinnedEventOnTimeline",
-            "description": "Persists a pinned event in a timeline",
-            "args": [
-              {
-                "name": "pinnedEventId",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "eventId",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              },
-              {
-                "name": "timelineId",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-                "defaultValue": null
-              }
-            ],
-            "type": { "kind": "OBJECT", "name": "PinnedEvent", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deletePinnedEventOnTimeline",
-            "description": "Remove a pinned events in a timeline",
-            "args": [
-              {
-                "name": "id",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                    }
-                  }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deleteAllPinnedEventsOnTimeline",
-            "description": "Remove all pinned events in a timeline",
-            "args": [
-              {
-                "name": "timelineId",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "persistTimeline",
-            "description": "Persists a timeline",
-            "args": [
-              {
-                "name": "id",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "version",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "timeline",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "INPUT_OBJECT", "name": "TimelineInput", "ofType": null }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "ResponseTimeline", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "persistFavorite",
-            "description": "",
-            "args": [
-              {
-                "name": "timelineId",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "templateTimelineId",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "templateTimelineVersion",
-                "description": "",
-                "type": { "kind": "SCALAR", "name": "Int", "ofType": null },
-                "defaultValue": null
-              },
-              {
-                "name": "timelineType",
-                "description": "",
-                "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "ResponseFavoriteTimeline", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deleteTimeline",
-            "description": "",
-            "args": [
-              {
-                "name": "id",
-                "description": "",
-                "type": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": { "kind": "SCALAR", "name": "ID", "ofType": null }
-                    }
-                  }
-                },
-                "defaultValue": null
-              }
-            ],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "NoteInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "eventId",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "note",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "timelineId",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ResponseNote",
-        "description": "",
-        "fields": [
-          {
-            "name": "code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "note",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "NoteResult", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "TimelineInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "columns",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "INPUT_OBJECT", "name": "ColumnHeaderInput", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "dataProviders",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "INPUT_OBJECT", "name": "DataProviderInput", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "description",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "eqlOptions",
-            "description": "",
-            "type": { "kind": "INPUT_OBJECT", "name": "EqlOptionsInput", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "eventType",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "excludedRowRendererIds",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "ENUM", "name": "RowRendererId", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "filters",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "INPUT_OBJECT", "name": "FilterTimelineInput", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "kqlMode",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "kqlQuery",
-            "description": "",
-            "type": {
-              "kind": "INPUT_OBJECT",
-              "name": "SerializedFilterQueryInput",
-              "ofType": null
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "indexNames",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "title",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "templateTimelineId",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "templateTimelineVersion",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Int", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "timelineType",
-            "description": "",
-            "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "dateRange",
-            "description": "",
-            "type": { "kind": "INPUT_OBJECT", "name": "DateRangePickerInput", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "savedQueryId",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "sort",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "INPUT_OBJECT", "name": "SortTimelineInput", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "status",
-            "description": "",
-            "type": { "kind": "ENUM", "name": "TimelineStatus", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "ColumnHeaderInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "aggregatable",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "category",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "columnHeaderType",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "description",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "example",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "indexes",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "id",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "placeholder",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "searchable",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "DataProviderInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "id",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "enabled",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "excluded",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "kqlQuery",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "queryMatch",
-            "description": "",
-            "type": { "kind": "INPUT_OBJECT", "name": "QueryMatchInput", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "and",
-            "description": "",
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "INPUT_OBJECT", "name": "DataProviderInput", "ofType": null }
-              }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "type": { "kind": "ENUM", "name": "DataProviderType", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "QueryMatchInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "field",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "displayField",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "value",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "displayValue",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "operator",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "EqlOptionsInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "eventCategoryField",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "tiebreakerField",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "timestampField",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "query",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "size",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "FilterTimelineInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "exists",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "meta",
-            "description": "",
-            "type": { "kind": "INPUT_OBJECT", "name": "FilterMetaTimelineInput", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "match_all",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "missing",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "query",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "range",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "script",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "FilterMetaTimelineInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "alias",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "controlledBy",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "disabled",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "field",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "formattedValue",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "index",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "key",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "negate",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "params",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "value",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "SerializedFilterQueryInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "filterQuery",
-            "description": "",
-            "type": { "kind": "INPUT_OBJECT", "name": "SerializedKueryQueryInput", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "SerializedKueryQueryInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "kuery",
-            "description": "",
-            "type": { "kind": "INPUT_OBJECT", "name": "KueryFilterQueryInput", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "serializedQuery",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "KueryFilterQueryInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "kind",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "expression",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "DateRangePickerInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "start",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "end",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "SortTimelineInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "columnId",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "sortDirection",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ResponseTimeline",
-        "description": "",
-        "fields": [
-          {
-            "name": "code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timeline",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "TimelineResult", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ResponseFavoriteTimeline",
-        "description": "",
-        "fields": [
-          {
-            "name": "code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "savedObjectId",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "templateTimelineId",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "templateTimelineVersion",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Int", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timelineType",
-            "description": "",
-            "args": [],
-            "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "favorite",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "FavoriteTimelineResult", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "__Schema",
-        "description": "A GraphQL Schema defines the capabilities of a GraphQL server. It exposes all available types and directives on the server, as well as the entry points for query, mutation, and subscription operations.",
-        "fields": [
-          {
-            "name": "types",
-            "description": "A list of all types supported by this server.",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "__Type", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "queryType",
-            "description": "The type that query operations will be rooted at.",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "__Type", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "mutationType",
-            "description": "If this server supports mutation, the type that mutation operations will be rooted at.",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "__Type", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "subscriptionType",
-            "description": "If this server support subscription, the type that subscription operations will be rooted at.",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "__Type", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "directives",
-            "description": "A list of all directives supported by this server.",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "__Directive", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "__Type",
-        "description": "The fundamental unit of any GraphQL Schema is the type. There are many kinds of types in GraphQL as represented by the `__TypeKind` enum.\n\nDepending on the kind of a type, certain fields describe information about that type. Scalar types provide no information beyond a name and description, while Enum types provide their values. Object and Interface types provide the fields they describe. Abstract types, Union and Interface, provide the Object types possible at runtime. List and NonNull types compose other types.",
-        "fields": [
-          {
-            "name": "kind",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "ENUM", "name": "__TypeKind", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "fields",
-            "description": null,
-            "args": [
-              {
-                "name": "includeDeprecated",
-                "description": null,
-                "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-                "defaultValue": "false"
-              }
-            ],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "__Field", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "interfaces",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "__Type", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "possibleTypes",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "__Type", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "enumValues",
-            "description": null,
-            "args": [
-              {
-                "name": "includeDeprecated",
-                "description": null,
-                "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-                "defaultValue": "false"
-              }
-            ],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "__EnumValue", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "inputFields",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "OBJECT", "name": "__InputValue", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ofType",
-            "description": null,
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "__Type", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "__TypeKind",
-        "description": "An enum describing what kind of type a given `__Type` is.",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "SCALAR",
-            "description": "Indicates this type is a scalar.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "OBJECT",
-            "description": "Indicates this type is an object. `fields` and `interfaces` are valid fields.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "INTERFACE",
-            "description": "Indicates this type is an interface. `fields` and `possibleTypes` are valid fields.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "UNION",
-            "description": "Indicates this type is a union. `possibleTypes` is a valid field.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ENUM",
-            "description": "Indicates this type is an enum. `enumValues` is a valid field.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "INPUT_OBJECT",
-            "description": "Indicates this type is an input object. `inputFields` is a valid field.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "LIST",
-            "description": "Indicates this type is a list. `ofType` is a valid field.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "NON_NULL",
-            "description": "Indicates this type is a non-null. `ofType` is a valid field.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "__Field",
-        "description": "Object and Interface types are described by a list of Fields, each of which has a name, potentially a list of arguments, and a return type.",
-        "fields": [
-          {
-            "name": "name",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "args",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "__InputValue", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "__Type", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "isDeprecated",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deprecationReason",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "__InputValue",
-        "description": "Arguments provided to Fields or Directives and the input fields of an InputObject are represented as Input Values which describe their type and optionally a default value.",
-        "fields": [
-          {
-            "name": "name",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "__Type", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "defaultValue",
-            "description": "A GraphQL-formatted string representing the default value for this input value.",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "__EnumValue",
-        "description": "One possible value for a given Enum. Enum values are unique values, not a placeholder for a string or numeric value. However an Enum value is returned in a JSON response as a string.",
-        "fields": [
-          {
-            "name": "name",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "isDeprecated",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "deprecationReason",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "__Directive",
-        "description": "A Directive provides a way to describe alternate runtime execution and type validation behavior in a GraphQL document.\n\nIn some cases, you need to provide options to alter GraphQL's execution behavior in ways field arguments will not suffice, such as conditionally including or skipping a field. Directives provide this by describing additional information to the executor.",
-        "fields": [
-          {
-            "name": "name",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": null,
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "locations",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "ENUM", "name": "__DirectiveLocation", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "args",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "OBJECT", "name": "__InputValue", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "onOperation",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": true,
-            "deprecationReason": "Use `locations`."
-          },
-          {
-            "name": "onFragment",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": true,
-            "deprecationReason": "Use `locations`."
-          },
-          {
-            "name": "onField",
-            "description": null,
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": true,
-            "deprecationReason": "Use `locations`."
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "__DirectiveLocation",
-        "description": "A Directive can be adjacent to many parts of the GraphQL language, a __DirectiveLocation describes one such possible adjacencies.",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "QUERY",
-            "description": "Location adjacent to a query operation.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "MUTATION",
-            "description": "Location adjacent to a mutation operation.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "SUBSCRIPTION",
-            "description": "Location adjacent to a subscription operation.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "FIELD",
-            "description": "Location adjacent to a field.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "FRAGMENT_DEFINITION",
-            "description": "Location adjacent to a fragment definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "FRAGMENT_SPREAD",
-            "description": "Location adjacent to a fragment spread.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "INLINE_FRAGMENT",
-            "description": "Location adjacent to an inline fragment.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "SCHEMA",
-            "description": "Location adjacent to a schema definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "SCALAR",
-            "description": "Location adjacent to a scalar definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "OBJECT",
-            "description": "Location adjacent to an object type definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "FIELD_DEFINITION",
-            "description": "Location adjacent to a field definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ARGUMENT_DEFINITION",
-            "description": "Location adjacent to an argument definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "INTERFACE",
-            "description": "Location adjacent to an interface definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "UNION",
-            "description": "Location adjacent to a union definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ENUM",
-            "description": "Location adjacent to an enum definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ENUM_VALUE",
-            "description": "Location adjacent to an enum value definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "INPUT_OBJECT",
-            "description": "Location adjacent to an input object type definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "INPUT_FIELD_DEFINITION",
-            "description": "Location adjacent to an input object field definition.",
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToStringArray",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToStringArrayNoNullable",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "EventEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "action",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "category",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "created",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToDateArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dataset",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "duration",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "end",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToDateArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "hash",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "kind",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "module",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "original",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "outcome",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "risk_score",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "risk_score_norm",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "severity",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "start",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToDateArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timezone",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToDateArray",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToNumberArray",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "Location",
-        "description": "",
-        "fields": [
-          {
-            "name": "lon",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "lat",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "GeoEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "city_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "continent_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "country_iso_code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "country_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "location",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "Location", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "region_iso_code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "region_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "PrimarySecondary",
-        "description": "",
-        "fields": [
-          {
-            "name": "primary",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "secondary",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "Summary",
-        "description": "",
-        "fields": [
-          {
-            "name": "actor",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "PrimarySecondary", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "object",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "PrimarySecondary", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "how",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message_type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sequence",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "AgentEcsField",
-        "description": "",
-        "fields": [
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "AuditdData",
-        "description": "",
-        "fields": [
-          {
-            "name": "acct",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "terminal",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "op",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "AuditdEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "result",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "session",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "data",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "AuditdData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "summary",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "Summary", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sequence",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "OsEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "platform",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "full",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "family",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "kernel",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "HostEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "architecture",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ip",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "mac",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "os",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "OsEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "Thread",
-        "description": "",
-        "fields": [
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "start",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ProcessHashData",
-        "description": "",
-        "fields": [
-          {
-            "name": "md5",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sha1",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sha256",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ProcessEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "hash",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ProcessHashData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "pid",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ppid",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "args",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "entity_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "executable",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "title",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "thread",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "Thread", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "working_directory",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SourceEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ip",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "port",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "domain",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "geo",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "GeoEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "packets",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "DestinationEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ip",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "port",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "domain",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "geo",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "GeoEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "packets",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "DnsQuestionData",
-        "description": "",
-        "fields": [
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "DnsEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "question",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "DnsQuestionData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "resolved_ip",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "response_code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "EndgameEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "exit_code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "file_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "file_path",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "logon_type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "parent_process_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "pid",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "process_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "subject_domain_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "subject_logon_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "subject_user_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "target_domain_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "target_logon_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "target_user_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SuricataAlertData",
-        "description": "",
-        "fields": [
-          {
-            "name": "signature",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "signature_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SuricataEveData",
-        "description": "",
-        "fields": [
-          {
-            "name": "alert",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SuricataAlertData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "flow_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "proto",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SuricataEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "eve",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SuricataEveData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "TlsJa3Data",
-        "description": "",
-        "fields": [
-          {
-            "name": "hash",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "FingerprintData",
-        "description": "",
-        "fields": [
-          {
-            "name": "sha1",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "TlsClientCertificateData",
-        "description": "",
-        "fields": [
-          {
-            "name": "fingerprint",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "FingerprintData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "TlsServerCertificateData",
-        "description": "",
-        "fields": [
-          {
-            "name": "fingerprint",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "FingerprintData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "TlsFingerprintsData",
-        "description": "",
-        "fields": [
-          {
-            "name": "ja3",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "TlsJa3Data", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "TlsEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "client_certificate",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "TlsClientCertificateData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "fingerprints",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "TlsFingerprintsData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "server_certificate",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "TlsServerCertificateData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekConnectionData",
-        "description": "",
-        "fields": [
-          {
-            "name": "local_resp",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "local_orig",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "missed_bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "state",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "history",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToBooleanArray",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekNoticeData",
-        "description": "",
-        "fields": [
-          {
-            "name": "suppress_for",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "msg",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "note",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sub",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dst",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dropped",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "peer_descr",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekDnsData",
-        "description": "",
-        "fields": [
-          {
-            "name": "AA",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "qclass_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "RD",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "qtype_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "rejected",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "qtype",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "query",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "trans_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "qclass",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "RA",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "TC",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "FileFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "path",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "target_path",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "extension",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "device",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "inode",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "uid",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "owner",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "gid",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "group",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "mode",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "size",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "mtime",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToDateArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ctime",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToDateArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekHttpData",
-        "description": "",
-        "fields": [
-          {
-            "name": "resp_mime_types",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "trans_depth",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "status_msg",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "resp_fuids",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tags",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "HttpBodyData",
-        "description": "",
-        "fields": [
-          {
-            "name": "content",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "HttpRequestData",
-        "description": "",
-        "fields": [
-          {
-            "name": "method",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "body",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "HttpBodyData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "referrer",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "HttpResponseData",
-        "description": "",
-        "fields": [
-          {
-            "name": "status_code",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "body",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "HttpBodyData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "HttpEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "request",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "HttpRequestData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "response",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "HttpResponseData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "UrlEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "domain",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "original",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "username",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "password",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekFileData",
-        "description": "",
-        "fields": [
-          {
-            "name": "session_ids",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timedout",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "local_orig",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tx_host",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "source",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "is_orig",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "overflow_bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "sha1",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "duration",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "depth",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "analyzers",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "mime_type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "rx_host",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "total_bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "fuid",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "seen_bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "missing_bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "md5",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekSslData",
-        "description": "",
-        "fields": [
-          {
-            "name": "cipher",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "established",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "resumed",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ZeekEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "session_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "connection",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekConnectionData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "notice",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekNoticeData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dns",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekDnsData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "http",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekHttpData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "files",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekFileData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "ssl",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekSslData", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "UserEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "domain",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "full_name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "email",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "hash",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "group",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "WinlogEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "event_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "NetworkEcsField",
-        "description": "",
-        "fields": [
-          {
-            "name": "bytes",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "community_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "direction",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "packets",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "protocol",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "transport",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "PackageEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "arch",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "entity_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "size",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "summary",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "AuditEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "package",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "PackageEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SshEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "method",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "signature",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "AuthEcsFields",
-        "description": "",
-        "fields": [
-          {
-            "name": "ssh",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SshEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SystemEcsField",
-        "description": "",
-        "fields": [
-          {
-            "name": "audit",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "AuditEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "auth",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "AuthEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "RuleField",
-        "description": "",
-        "fields": [
-          {
-            "name": "id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "rule_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "false_positives",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "saved_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timeline_id",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timeline_title",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "max_signals",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToNumberArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "risk_score",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "output_index",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "from",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "immutable",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "index",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "interval",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "language",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "query",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "references",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "severity",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tags",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "threat",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "size",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "to",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "enabled",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToBooleanArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "filters",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "created_at",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updated_at",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "created_by",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "updated_by",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "version",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "note",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "threshold",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "exceptions_list",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "SignalField",
-        "description": "",
-        "fields": [
-          {
-            "name": "rule",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "RuleField", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "original_time",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "status",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "RuleEcsField",
-        "description": "",
-        "fields": [
-          {
-            "name": "reference",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "ECS",
-        "description": "",
-        "fields": [
-          {
-            "name": "_id",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "_index",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "agent",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "AgentEcsField", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "auditd",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "AuditdEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "destination",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "DestinationEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "dns",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "DnsEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "endgame",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "EndgameEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "event",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "EventEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "geo",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "GeoEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "host",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "HostEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "network",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "NetworkEcsField", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "rule",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "RuleEcsField", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "signal",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SignalField", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "source",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SourceEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "suricata",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SuricataEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tls",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "TlsEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "zeek",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ZeekEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "http",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "HttpEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "url",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "UrlEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "timestamp",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Date", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "message",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "user",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "UserEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "winlog",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "WinlogEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "process",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "ProcessEcsFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "file",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "FileFields", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "system",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "SystemEcsField", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "Date",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "EcsEdges",
-        "description": "",
-        "fields": [
-          {
-            "name": "node",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "ECS", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "cursor",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "OBJECT", "name": "CursorType", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "CursorType",
-        "description": "",
-        "fields": [
-          {
-            "name": "value",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "tiebreaker",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "SCALAR",
-        "name": "ToIFieldSubTypeNonNullable",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "IndexField",
-        "description": "A descriptor of a field in an index",
-        "fields": [
-          {
-            "name": "category",
-            "description": "Where the field belong",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "example",
-            "description": "Example of field's value",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "indexes",
-            "description": "whether the field's belong to an alias index",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "name",
-            "description": "The name of the field",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "type",
-            "description": "The type of the field's values as recognized by Kibana",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "searchable",
-            "description": "Whether the field's values can be efficiently searched for",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "aggregatable",
-            "description": "Whether the field's values can be aggregated",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "description",
-            "description": "Description of the field",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "format",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "esTypes",
-            "description": "the elastic type as mapped in the index",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToStringArrayNoNullable", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "subType",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "ToIFieldSubTypeNonNullable", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "TimerangeInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "interval",
-            "description": "The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan.",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "to",
-            "description": "The end of the timerange",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "from",
-            "description": "The beginning of the timerange",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "docValueFieldsInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "field",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "format",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "PaginationInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "limit",
-            "description": "The limit parameter allows you to configure the maximum amount of items to be returned",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "cursor",
-            "description": "The cursor parameter defines the next result you want to fetch",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "tiebreaker",
-            "description": "The tiebreaker parameter allow to be more precise to fetch the next item",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "PaginationInputPaginated",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "activePage",
-            "description": "The activePage parameter defines the page of results you want to fetch",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "cursorStart",
-            "description": "The cursorStart parameter defines the start of the results to be displayed",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "fakePossibleCount",
-            "description": "The fakePossibleCount parameter determines the total count in order to show 5 additional pages",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "querySize",
-            "description": "The querySize parameter is the number of items to be returned",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "FlowTarget",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          { "name": "client", "description": "", "isDeprecated": false, "deprecationReason": null },
-          {
-            "name": "destination",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "server", "description": "", "isDeprecated": false, "deprecationReason": null },
-          { "name": "source", "description": "", "isDeprecated": false, "deprecationReason": null }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "FlowTargetSourceDest",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "destination",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          { "name": "source", "description": "", "isDeprecated": false, "deprecationReason": null }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "ENUM",
-        "name": "FlowDirection",
-        "description": "",
-        "fields": null,
-        "inputFields": null,
-        "interfaces": null,
-        "enumValues": [
-          {
-            "name": "uniDirectional",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "biDirectional",
-            "description": "",
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "SortField",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "sortFieldId",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-            },
-            "defaultValue": null
-          },
-          {
-            "name": "direction",
-            "description": "",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "ENUM", "name": "Direction", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "PageInfo",
-        "description": "",
-        "fields": [
-          {
-            "name": "endCursor",
-            "description": "",
-            "args": [],
-            "type": { "kind": "OBJECT", "name": "CursorType", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "hasNextPage",
-            "description": "",
-            "args": [],
-            "type": { "kind": "SCALAR", "name": "Boolean", "ofType": null },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "Inspect",
-        "description": "",
-        "fields": [
-          {
-            "name": "dsl",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "response",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-                }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "OBJECT",
-        "name": "PageInfoPaginated",
-        "description": "",
-        "fields": [
-          {
-            "name": "activePage",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "fakeTotalCount",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
-          {
-            "name": "showMorePagesIndicator",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          }
-        ],
-        "inputFields": null,
-        "interfaces": [],
-        "enumValues": null,
-        "possibleTypes": null
-      },
-      {
-        "kind": "INPUT_OBJECT",
-        "name": "FavoriteTimelineInput",
-        "description": "",
-        "fields": null,
-        "inputFields": [
-          {
-            "name": "fullName",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "userName",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": null
-          },
-          {
-            "name": "favoriteDate",
-            "description": "",
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
-            "defaultValue": null
-          }
-        ],
-        "interfaces": null,
-        "enumValues": null,
-        "possibleTypes": null
-      }
-    ],
-    "directives": [
-      {
-        "name": "skip",
-        "description": "Directs the executor to skip this field or fragment when the `if` argument is true.",
-        "locations": ["FIELD", "FRAGMENT_SPREAD", "INLINE_FRAGMENT"],
-        "args": [
-          {
-            "name": "if",
-            "description": "Skipped when true.",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ]
-      },
-      {
-        "name": "include",
-        "description": "Directs the executor to include this field or fragment only when the `if` argument is true.",
-        "locations": ["FIELD", "FRAGMENT_SPREAD", "INLINE_FRAGMENT"],
-        "args": [
-          {
-            "name": "if",
-            "description": "Included when true.",
-            "type": {
-              "kind": "NON_NULL",
-              "name": null,
-              "ofType": { "kind": "SCALAR", "name": "Boolean", "ofType": null }
-            },
-            "defaultValue": null
-          }
-        ]
-      },
-      {
-        "name": "deprecated",
-        "description": "Marks an element of a GraphQL schema as no longer supported.",
-        "locations": ["FIELD_DEFINITION", "ENUM_VALUE"],
-        "args": [
-          {
-            "name": "reason",
-            "description": "Explains why this element was deprecated, usually also including a suggestion for how to access supported similar data. Formatted in [Markdown](https://daringfireball.net/projects/markdown/).",
-            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
-            "defaultValue": "\"No longer supported\""
-          }
-        ]
-      }
-    ]
-  }
-}
diff --git a/x-pack/plugins/security_solution/public/graphql/types.ts b/x-pack/plugins/security_solution/public/graphql/types.ts
deleted file mode 100644
index a41111c3e123ab..00000000000000
--- a/x-pack/plugins/security_solution/public/graphql/types.ts
+++ /dev/null
@@ -1,2435 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export type Maybe<T> = T | null;
-
-export interface PageInfoNote {
-  pageIndex: number;
-
-  pageSize: number;
-}
-
-export interface SortNote {
-  sortField: SortFieldNote;
-
-  sortOrder: Direction;
-}
-
-export interface PageInfoTimeline {
-  pageIndex: number;
-
-  pageSize: number;
-}
-
-export interface SortTimeline {
-  sortField: SortFieldTimeline;
-
-  sortOrder: Direction;
-}
-
-export interface NoteInput {
-  eventId?: Maybe<string>;
-
-  note?: Maybe<string>;
-
-  timelineId?: Maybe<string>;
-}
-
-export interface TimelineInput {
-  columns?: Maybe<ColumnHeaderInput[]>;
-
-  dataProviders?: Maybe<DataProviderInput[]>;
-
-  description?: Maybe<string>;
-
-  eqlOptions?: Maybe<EqlOptionsInput>;
-
-  eventType?: Maybe<string>;
-
-  excludedRowRendererIds?: Maybe<RowRendererId[]>;
-
-  filters?: Maybe<FilterTimelineInput[]>;
-
-  kqlMode?: Maybe<string>;
-
-  kqlQuery?: Maybe<SerializedFilterQueryInput>;
-
-  indexNames?: Maybe<string[]>;
-
-  title?: Maybe<string>;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  dateRange?: Maybe<DateRangePickerInput>;
-
-  savedQueryId?: Maybe<string>;
-
-  sort?: Maybe<SortTimelineInput[]>;
-
-  status?: Maybe<TimelineStatus>;
-}
-
-export interface ColumnHeaderInput {
-  aggregatable?: Maybe<boolean>;
-
-  category?: Maybe<string>;
-
-  columnHeaderType?: Maybe<string>;
-
-  description?: Maybe<string>;
-
-  example?: Maybe<string>;
-
-  indexes?: Maybe<string[]>;
-
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  placeholder?: Maybe<string>;
-
-  searchable?: Maybe<boolean>;
-
-  type?: Maybe<string>;
-}
-
-export interface DataProviderInput {
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  enabled?: Maybe<boolean>;
-
-  excluded?: Maybe<boolean>;
-
-  kqlQuery?: Maybe<string>;
-
-  queryMatch?: Maybe<QueryMatchInput>;
-
-  and?: Maybe<DataProviderInput[]>;
-
-  type?: Maybe<DataProviderType>;
-}
-
-export interface QueryMatchInput {
-  field?: Maybe<string>;
-
-  displayField?: Maybe<string>;
-
-  value?: Maybe<string>;
-
-  displayValue?: Maybe<string>;
-
-  operator?: Maybe<string>;
-}
-
-export interface EqlOptionsInput {
-  eventCategoryField?: Maybe<string>;
-
-  tiebreakerField?: Maybe<string>;
-
-  timestampField?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  size?: Maybe<ToAny>;
-}
-
-export interface FilterTimelineInput {
-  exists?: Maybe<string>;
-
-  meta?: Maybe<FilterMetaTimelineInput>;
-
-  match_all?: Maybe<string>;
-
-  missing?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  range?: Maybe<string>;
-
-  script?: Maybe<string>;
-}
-
-export interface FilterMetaTimelineInput {
-  alias?: Maybe<string>;
-
-  controlledBy?: Maybe<string>;
-
-  disabled?: Maybe<boolean>;
-
-  field?: Maybe<string>;
-
-  formattedValue?: Maybe<string>;
-
-  index?: Maybe<string>;
-
-  key?: Maybe<string>;
-
-  negate?: Maybe<boolean>;
-
-  params?: Maybe<string>;
-
-  type?: Maybe<string>;
-
-  value?: Maybe<string>;
-}
-
-export interface SerializedFilterQueryInput {
-  filterQuery?: Maybe<SerializedKueryQueryInput>;
-}
-
-export interface SerializedKueryQueryInput {
-  kuery?: Maybe<KueryFilterQueryInput>;
-
-  serializedQuery?: Maybe<string>;
-}
-
-export interface KueryFilterQueryInput {
-  kind?: Maybe<string>;
-
-  expression?: Maybe<string>;
-}
-
-export interface DateRangePickerInput {
-  start?: Maybe<ToAny>;
-
-  end?: Maybe<ToAny>;
-}
-
-export interface SortTimelineInput {
-  columnId?: Maybe<string>;
-
-  sortDirection?: Maybe<string>;
-}
-
-export interface TimerangeInput {
-  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
-  interval: string;
-  /** The end of the timerange */
-  to: string;
-  /** The beginning of the timerange */
-  from: string;
-}
-
-export interface DocValueFieldsInput {
-  field: string;
-
-  format: string;
-}
-
-export interface PaginationInput {
-  /** The limit parameter allows you to configure the maximum amount of items to be returned */
-  limit: number;
-  /** The cursor parameter defines the next result you want to fetch */
-  cursor?: Maybe<string>;
-  /** The tiebreaker parameter allow to be more precise to fetch the next item */
-  tiebreaker?: Maybe<string>;
-}
-
-export interface PaginationInputPaginated {
-  /** The activePage parameter defines the page of results you want to fetch */
-  activePage: number;
-  /** The cursorStart parameter defines the start of the results to be displayed */
-  cursorStart: number;
-  /** The fakePossibleCount parameter determines the total count in order to show 5 additional pages */
-  fakePossibleCount: number;
-  /** The querySize parameter is the number of items to be returned */
-  querySize: number;
-}
-
-export interface SortField {
-  sortFieldId: string;
-
-  direction: Direction;
-}
-
-export interface FavoriteTimelineInput {
-  fullName?: Maybe<string>;
-
-  userName?: Maybe<string>;
-
-  favoriteDate?: Maybe<number>;
-}
-
-export enum SortFieldNote {
-  updatedBy = 'updatedBy',
-  updated = 'updated',
-}
-
-export enum Direction {
-  asc = 'asc',
-  desc = 'desc',
-}
-
-export enum TimelineType {
-  default = 'default',
-  template = 'template',
-}
-
-export enum DataProviderType {
-  default = 'default',
-  template = 'template',
-}
-
-export enum RowRendererId {
-  alerts = 'alerts',
-  auditd = 'auditd',
-  auditd_file = 'auditd_file',
-  library = 'library',
-  netflow = 'netflow',
-  plain = 'plain',
-  registry = 'registry',
-  suricata = 'suricata',
-  system = 'system',
-  system_dns = 'system_dns',
-  system_endgame_process = 'system_endgame_process',
-  system_file = 'system_file',
-  system_fim = 'system_fim',
-  system_security_event = 'system_security_event',
-  system_socket = 'system_socket',
-  threat_match = 'threat_match',
-  zeek = 'zeek',
-}
-
-export enum TimelineStatus {
-  active = 'active',
-  draft = 'draft',
-  immutable = 'immutable',
-}
-
-export enum SortFieldTimeline {
-  title = 'title',
-  description = 'description',
-  updated = 'updated',
-  created = 'created',
-}
-
-export enum FlowTarget {
-  client = 'client',
-  destination = 'destination',
-  server = 'server',
-  source = 'source',
-}
-
-export enum FlowTargetSourceDest {
-  destination = 'destination',
-  source = 'source',
-}
-
-export enum FlowDirection {
-  uniDirectional = 'uniDirectional',
-  biDirectional = 'biDirectional',
-}
-
-export type ToAny = any;
-
-export type ToStringArray = string[];
-
-export type ToStringArrayNoNullable = any;
-
-export type ToDateArray = string[];
-
-export type ToNumberArray = number[];
-
-export type ToBooleanArray = boolean[];
-
-export type Date = string;
-
-export type ToIFieldSubTypeNonNullable = any;
-
-// ====================================================
-// Scalars
-// ====================================================
-
-// ====================================================
-// Types
-// ====================================================
-
-export interface Query {
-  getNote: NoteResult;
-
-  getNotesByTimelineId: NoteResult[];
-
-  getNotesByEventId: NoteResult[];
-
-  getAllNotes: ResponseNotes;
-
-  getAllPinnedEventsByTimelineId: PinnedEvent[];
-  /** Get a security data source by id */
-  source: Source;
-  /** Get a list of all security data sources */
-  allSources: Source[];
-
-  getOneTimeline: TimelineResult;
-
-  getAllTimeline: ResponseTimelines;
-}
-
-export interface NoteResult {
-  eventId?: Maybe<string>;
-
-  note?: Maybe<string>;
-
-  timelineId?: Maybe<string>;
-
-  noteId: string;
-
-  created?: Maybe<number>;
-
-  createdBy?: Maybe<string>;
-
-  timelineVersion?: Maybe<string>;
-
-  updated?: Maybe<number>;
-
-  updatedBy?: Maybe<string>;
-
-  version?: Maybe<string>;
-}
-
-export interface ResponseNotes {
-  notes: NoteResult[];
-
-  totalCount?: Maybe<number>;
-}
-
-export interface PinnedEvent {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  pinnedEventId: string;
-
-  eventId?: Maybe<string>;
-
-  timelineId?: Maybe<string>;
-
-  timelineVersion?: Maybe<string>;
-
-  created?: Maybe<number>;
-
-  createdBy?: Maybe<string>;
-
-  updated?: Maybe<number>;
-
-  updatedBy?: Maybe<string>;
-
-  version?: Maybe<string>;
-}
-
-export interface Source {
-  /** The id of the source */
-  id: string;
-  /** The raw configuration of the source */
-  configuration: SourceConfiguration;
-  /** The status of the source */
-  status: SourceStatus;
-}
-
-/** A set of configuration options for a security data source */
-export interface SourceConfiguration {
-  /** The field mapping to use for this source */
-  fields: SourceFields;
-}
-
-/** A mapping of semantic fields to their document counterparts */
-export interface SourceFields {
-  /** The field to identify a container by */
-  container: string;
-  /** The fields to identify a host by */
-  host: string;
-  /** The fields that may contain the log event message. The first field found win. */
-  message: string[];
-  /** The field to identify a pod by */
-  pod: string;
-  /** The field to use as a tiebreaker for log events that have identical timestamps */
-  tiebreaker: string;
-  /** The field to use as a timestamp for metrics and logs */
-  timestamp: string;
-}
-
-/** The status of an infrastructure data source */
-export interface SourceStatus {
-  /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */
-  indicesExist: boolean;
-  /** The list of fields defined in the index mappings */
-  indexFields: string[];
-}
-
-export interface TimelineResult {
-  columns?: Maybe<ColumnHeaderResult[]>;
-
-  created?: Maybe<number>;
-
-  createdBy?: Maybe<string>;
-
-  dataProviders?: Maybe<DataProviderResult[]>;
-
-  dateRange?: Maybe<DateRangePickerResult>;
-
-  description?: Maybe<string>;
-
-  eqlOptions?: Maybe<EqlOptionsResult>;
-
-  eventIdToNoteIds?: Maybe<NoteResult[]>;
-
-  eventType?: Maybe<string>;
-
-  excludedRowRendererIds?: Maybe<RowRendererId[]>;
-
-  favorite?: Maybe<FavoriteTimelineResult[]>;
-
-  filters?: Maybe<FilterTimelineResult[]>;
-
-  kqlMode?: Maybe<string>;
-
-  kqlQuery?: Maybe<SerializedFilterQueryResult>;
-
-  indexNames?: Maybe<string[]>;
-
-  notes?: Maybe<NoteResult[]>;
-
-  noteIds?: Maybe<string[]>;
-
-  pinnedEventIds?: Maybe<string[]>;
-
-  pinnedEventsSaveObject?: Maybe<PinnedEvent[]>;
-
-  savedQueryId?: Maybe<string>;
-
-  savedObjectId: string;
-
-  sort?: Maybe<ToAny>;
-
-  status?: Maybe<TimelineStatus>;
-
-  title?: Maybe<string>;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  updated?: Maybe<number>;
-
-  updatedBy?: Maybe<string>;
-
-  version: string;
-}
-
-export interface ColumnHeaderResult {
-  aggregatable?: Maybe<boolean>;
-
-  category?: Maybe<string>;
-
-  columnHeaderType?: Maybe<string>;
-
-  description?: Maybe<string>;
-
-  example?: Maybe<string>;
-
-  indexes?: Maybe<string[]>;
-
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  placeholder?: Maybe<string>;
-
-  searchable?: Maybe<boolean>;
-
-  type?: Maybe<string>;
-}
-
-export interface DataProviderResult {
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  enabled?: Maybe<boolean>;
-
-  excluded?: Maybe<boolean>;
-
-  kqlQuery?: Maybe<string>;
-
-  queryMatch?: Maybe<QueryMatchResult>;
-
-  type?: Maybe<DataProviderType>;
-
-  and?: Maybe<DataProviderResult[]>;
-}
-
-export interface QueryMatchResult {
-  field?: Maybe<string>;
-
-  displayField?: Maybe<string>;
-
-  value?: Maybe<string>;
-
-  displayValue?: Maybe<string>;
-
-  operator?: Maybe<string>;
-}
-
-export interface DateRangePickerResult {
-  start?: Maybe<ToAny>;
-
-  end?: Maybe<ToAny>;
-}
-
-export interface EqlOptionsResult {
-  eventCategoryField?: Maybe<string>;
-
-  tiebreakerField?: Maybe<string>;
-
-  timestampField?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  size?: Maybe<ToAny>;
-}
-
-export interface FavoriteTimelineResult {
-  fullName?: Maybe<string>;
-
-  userName?: Maybe<string>;
-
-  favoriteDate?: Maybe<number>;
-}
-
-export interface FilterTimelineResult {
-  exists?: Maybe<string>;
-
-  meta?: Maybe<FilterMetaTimelineResult>;
-
-  match_all?: Maybe<string>;
-
-  missing?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  range?: Maybe<string>;
-
-  script?: Maybe<string>;
-}
-
-export interface FilterMetaTimelineResult {
-  alias?: Maybe<string>;
-
-  controlledBy?: Maybe<string>;
-
-  disabled?: Maybe<boolean>;
-
-  field?: Maybe<string>;
-
-  formattedValue?: Maybe<string>;
-
-  index?: Maybe<string>;
-
-  key?: Maybe<string>;
-
-  negate?: Maybe<boolean>;
-
-  params?: Maybe<string>;
-
-  type?: Maybe<string>;
-
-  value?: Maybe<string>;
-}
-
-export interface SerializedFilterQueryResult {
-  filterQuery?: Maybe<SerializedKueryQueryResult>;
-}
-
-export interface SerializedKueryQueryResult {
-  kuery?: Maybe<KueryFilterQueryResult>;
-
-  serializedQuery?: Maybe<string>;
-}
-
-export interface KueryFilterQueryResult {
-  kind?: Maybe<string>;
-
-  expression?: Maybe<string>;
-}
-
-export interface ResponseTimelines {
-  timeline: (Maybe<TimelineResult>)[];
-
-  totalCount?: Maybe<number>;
-
-  defaultTimelineCount?: Maybe<number>;
-
-  templateTimelineCount?: Maybe<number>;
-
-  elasticTemplateTimelineCount?: Maybe<number>;
-
-  customTemplateTimelineCount?: Maybe<number>;
-
-  favoriteCount?: Maybe<number>;
-}
-
-export interface Mutation {
-  /** Persists a note */
-  persistNote: ResponseNote;
-
-  deleteNote?: Maybe<boolean>;
-
-  deleteNoteByTimelineId?: Maybe<boolean>;
-  /** Persists a pinned event in a timeline */
-  persistPinnedEventOnTimeline?: Maybe<PinnedEvent>;
-  /** Remove a pinned events in a timeline */
-  deletePinnedEventOnTimeline: boolean;
-  /** Remove all pinned events in a timeline */
-  deleteAllPinnedEventsOnTimeline: boolean;
-  /** Persists a timeline */
-  persistTimeline: ResponseTimeline;
-
-  persistFavorite: ResponseFavoriteTimeline;
-
-  deleteTimeline: boolean;
-}
-
-export interface ResponseNote {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  note: NoteResult;
-}
-
-export interface ResponseTimeline {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  timeline: TimelineResult;
-}
-
-export interface ResponseFavoriteTimeline {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  savedObjectId: string;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  version: string;
-
-  favorite?: Maybe<FavoriteTimelineResult[]>;
-}
-
-export interface EventEcsFields {
-  action?: Maybe<string[]>;
-
-  category?: Maybe<string[]>;
-
-  code?: Maybe<string[]>;
-
-  created?: Maybe<string[]>;
-
-  dataset?: Maybe<string[]>;
-
-  duration?: Maybe<number[]>;
-
-  end?: Maybe<string[]>;
-
-  hash?: Maybe<string[]>;
-
-  id?: Maybe<string[]>;
-
-  kind?: Maybe<string[]>;
-
-  module?: Maybe<string[]>;
-
-  original?: Maybe<string[]>;
-
-  outcome?: Maybe<string[]>;
-
-  risk_score?: Maybe<number[]>;
-
-  risk_score_norm?: Maybe<number[]>;
-
-  severity?: Maybe<number[]>;
-
-  start?: Maybe<string[]>;
-
-  timezone?: Maybe<string[]>;
-
-  type?: Maybe<string[]>;
-}
-
-export interface Location {
-  lon?: Maybe<number[]>;
-
-  lat?: Maybe<number[]>;
-}
-
-export interface GeoEcsFields {
-  city_name?: Maybe<string[]>;
-
-  continent_name?: Maybe<string[]>;
-
-  country_iso_code?: Maybe<string[]>;
-
-  country_name?: Maybe<string[]>;
-
-  location?: Maybe<Location>;
-
-  region_iso_code?: Maybe<string[]>;
-
-  region_name?: Maybe<string[]>;
-}
-
-export interface PrimarySecondary {
-  primary?: Maybe<string[]>;
-
-  secondary?: Maybe<string[]>;
-
-  type?: Maybe<string[]>;
-}
-
-export interface Summary {
-  actor?: Maybe<PrimarySecondary>;
-
-  object?: Maybe<PrimarySecondary>;
-
-  how?: Maybe<string[]>;
-
-  message_type?: Maybe<string[]>;
-
-  sequence?: Maybe<string[]>;
-}
-
-export interface AgentEcsField {
-  type?: Maybe<string[]>;
-}
-
-export interface AuditdData {
-  acct?: Maybe<string[]>;
-
-  terminal?: Maybe<string[]>;
-
-  op?: Maybe<string[]>;
-}
-
-export interface AuditdEcsFields {
-  result?: Maybe<string[]>;
-
-  session?: Maybe<string[]>;
-
-  data?: Maybe<AuditdData>;
-
-  summary?: Maybe<Summary>;
-
-  sequence?: Maybe<string[]>;
-}
-
-export interface OsEcsFields {
-  platform?: Maybe<string[]>;
-
-  name?: Maybe<string[]>;
-
-  full?: Maybe<string[]>;
-
-  family?: Maybe<string[]>;
-
-  version?: Maybe<string[]>;
-
-  kernel?: Maybe<string[]>;
-}
-
-export interface HostEcsFields {
-  architecture?: Maybe<string[]>;
-
-  id?: Maybe<string[]>;
-
-  ip?: Maybe<string[]>;
-
-  mac?: Maybe<string[]>;
-
-  name?: Maybe<string[]>;
-
-  os?: Maybe<OsEcsFields>;
-
-  type?: Maybe<string[]>;
-}
-
-export interface Thread {
-  id?: Maybe<number[]>;
-
-  start?: Maybe<string[]>;
-}
-
-export interface ProcessHashData {
-  md5?: Maybe<string[]>;
-
-  sha1?: Maybe<string[]>;
-
-  sha256?: Maybe<string[]>;
-}
-
-export interface ProcessEcsFields {
-  hash?: Maybe<ProcessHashData>;
-
-  pid?: Maybe<number[]>;
-
-  name?: Maybe<string[]>;
-
-  ppid?: Maybe<number[]>;
-
-  args?: Maybe<string[]>;
-
-  entity_id?: Maybe<string[]>;
-
-  executable?: Maybe<string[]>;
-
-  title?: Maybe<string[]>;
-
-  thread?: Maybe<Thread>;
-
-  working_directory?: Maybe<string[]>;
-}
-
-export interface SourceEcsFields {
-  bytes?: Maybe<number[]>;
-
-  ip?: Maybe<string[]>;
-
-  port?: Maybe<number[]>;
-
-  domain?: Maybe<string[]>;
-
-  geo?: Maybe<GeoEcsFields>;
-
-  packets?: Maybe<number[]>;
-}
-
-export interface DestinationEcsFields {
-  bytes?: Maybe<number[]>;
-
-  ip?: Maybe<string[]>;
-
-  port?: Maybe<number[]>;
-
-  domain?: Maybe<string[]>;
-
-  geo?: Maybe<GeoEcsFields>;
-
-  packets?: Maybe<number[]>;
-}
-
-export interface DnsQuestionData {
-  name?: Maybe<string[]>;
-
-  type?: Maybe<string[]>;
-}
-
-export interface DnsEcsFields {
-  question?: Maybe<DnsQuestionData>;
-
-  resolved_ip?: Maybe<string[]>;
-
-  response_code?: Maybe<string[]>;
-}
-
-export interface EndgameEcsFields {
-  exit_code?: Maybe<number[]>;
-
-  file_name?: Maybe<string[]>;
-
-  file_path?: Maybe<string[]>;
-
-  logon_type?: Maybe<number[]>;
-
-  parent_process_name?: Maybe<string[]>;
-
-  pid?: Maybe<number[]>;
-
-  process_name?: Maybe<string[]>;
-
-  subject_domain_name?: Maybe<string[]>;
-
-  subject_logon_id?: Maybe<string[]>;
-
-  subject_user_name?: Maybe<string[]>;
-
-  target_domain_name?: Maybe<string[]>;
-
-  target_logon_id?: Maybe<string[]>;
-
-  target_user_name?: Maybe<string[]>;
-}
-
-export interface SuricataAlertData {
-  signature?: Maybe<string[]>;
-
-  signature_id?: Maybe<number[]>;
-}
-
-export interface SuricataEveData {
-  alert?: Maybe<SuricataAlertData>;
-
-  flow_id?: Maybe<number[]>;
-
-  proto?: Maybe<string[]>;
-}
-
-export interface SuricataEcsFields {
-  eve?: Maybe<SuricataEveData>;
-}
-
-export interface TlsJa3Data {
-  hash?: Maybe<string[]>;
-}
-
-export interface FingerprintData {
-  sha1?: Maybe<string[]>;
-}
-
-export interface TlsClientCertificateData {
-  fingerprint?: Maybe<FingerprintData>;
-}
-
-export interface TlsServerCertificateData {
-  fingerprint?: Maybe<FingerprintData>;
-}
-
-export interface TlsFingerprintsData {
-  ja3?: Maybe<TlsJa3Data>;
-}
-
-export interface TlsEcsFields {
-  client_certificate?: Maybe<TlsClientCertificateData>;
-
-  fingerprints?: Maybe<TlsFingerprintsData>;
-
-  server_certificate?: Maybe<TlsServerCertificateData>;
-}
-
-export interface ZeekConnectionData {
-  local_resp?: Maybe<boolean[]>;
-
-  local_orig?: Maybe<boolean[]>;
-
-  missed_bytes?: Maybe<number[]>;
-
-  state?: Maybe<string[]>;
-
-  history?: Maybe<string[]>;
-}
-
-export interface ZeekNoticeData {
-  suppress_for?: Maybe<number[]>;
-
-  msg?: Maybe<string[]>;
-
-  note?: Maybe<string[]>;
-
-  sub?: Maybe<string[]>;
-
-  dst?: Maybe<string[]>;
-
-  dropped?: Maybe<boolean[]>;
-
-  peer_descr?: Maybe<string[]>;
-}
-
-export interface ZeekDnsData {
-  AA?: Maybe<boolean[]>;
-
-  qclass_name?: Maybe<string[]>;
-
-  RD?: Maybe<boolean[]>;
-
-  qtype_name?: Maybe<string[]>;
-
-  rejected?: Maybe<boolean[]>;
-
-  qtype?: Maybe<string[]>;
-
-  query?: Maybe<string[]>;
-
-  trans_id?: Maybe<number[]>;
-
-  qclass?: Maybe<string[]>;
-
-  RA?: Maybe<boolean[]>;
-
-  TC?: Maybe<boolean[]>;
-}
-
-export interface FileFields {
-  name?: Maybe<string[]>;
-
-  path?: Maybe<string[]>;
-
-  target_path?: Maybe<string[]>;
-
-  extension?: Maybe<string[]>;
-
-  type?: Maybe<string[]>;
-
-  device?: Maybe<string[]>;
-
-  inode?: Maybe<string[]>;
-
-  uid?: Maybe<string[]>;
-
-  owner?: Maybe<string[]>;
-
-  gid?: Maybe<string[]>;
-
-  group?: Maybe<string[]>;
-
-  mode?: Maybe<string[]>;
-
-  size?: Maybe<number[]>;
-
-  mtime?: Maybe<string[]>;
-
-  ctime?: Maybe<string[]>;
-}
-
-export interface ZeekHttpData {
-  resp_mime_types?: Maybe<string[]>;
-
-  trans_depth?: Maybe<string[]>;
-
-  status_msg?: Maybe<string[]>;
-
-  resp_fuids?: Maybe<string[]>;
-
-  tags?: Maybe<string[]>;
-}
-
-export interface HttpBodyData {
-  content?: Maybe<string[]>;
-
-  bytes?: Maybe<number[]>;
-}
-
-export interface HttpRequestData {
-  method?: Maybe<string[]>;
-
-  body?: Maybe<HttpBodyData>;
-
-  referrer?: Maybe<string[]>;
-
-  bytes?: Maybe<number[]>;
-}
-
-export interface HttpResponseData {
-  status_code?: Maybe<number[]>;
-
-  body?: Maybe<HttpBodyData>;
-
-  bytes?: Maybe<number[]>;
-}
-
-export interface HttpEcsFields {
-  version?: Maybe<string[]>;
-
-  request?: Maybe<HttpRequestData>;
-
-  response?: Maybe<HttpResponseData>;
-}
-
-export interface UrlEcsFields {
-  domain?: Maybe<string[]>;
-
-  original?: Maybe<string[]>;
-
-  username?: Maybe<string[]>;
-
-  password?: Maybe<string[]>;
-}
-
-export interface ZeekFileData {
-  session_ids?: Maybe<string[]>;
-
-  timedout?: Maybe<boolean[]>;
-
-  local_orig?: Maybe<boolean[]>;
-
-  tx_host?: Maybe<string[]>;
-
-  source?: Maybe<string[]>;
-
-  is_orig?: Maybe<boolean[]>;
-
-  overflow_bytes?: Maybe<number[]>;
-
-  sha1?: Maybe<string[]>;
-
-  duration?: Maybe<number[]>;
-
-  depth?: Maybe<number[]>;
-
-  analyzers?: Maybe<string[]>;
-
-  mime_type?: Maybe<string[]>;
-
-  rx_host?: Maybe<string[]>;
-
-  total_bytes?: Maybe<number[]>;
-
-  fuid?: Maybe<string[]>;
-
-  seen_bytes?: Maybe<number[]>;
-
-  missing_bytes?: Maybe<number[]>;
-
-  md5?: Maybe<string[]>;
-}
-
-export interface ZeekSslData {
-  cipher?: Maybe<string[]>;
-
-  established?: Maybe<boolean[]>;
-
-  resumed?: Maybe<boolean[]>;
-
-  version?: Maybe<string[]>;
-}
-
-export interface ZeekEcsFields {
-  session_id?: Maybe<string[]>;
-
-  connection?: Maybe<ZeekConnectionData>;
-
-  notice?: Maybe<ZeekNoticeData>;
-
-  dns?: Maybe<ZeekDnsData>;
-
-  http?: Maybe<ZeekHttpData>;
-
-  files?: Maybe<ZeekFileData>;
-
-  ssl?: Maybe<ZeekSslData>;
-}
-
-export interface UserEcsFields {
-  domain?: Maybe<string[]>;
-
-  id?: Maybe<string[]>;
-
-  name?: Maybe<string[]>;
-
-  full_name?: Maybe<string[]>;
-
-  email?: Maybe<string[]>;
-
-  hash?: Maybe<string[]>;
-
-  group?: Maybe<string[]>;
-}
-
-export interface WinlogEcsFields {
-  event_id?: Maybe<number[]>;
-}
-
-export interface NetworkEcsField {
-  bytes?: Maybe<number[]>;
-
-  community_id?: Maybe<string[]>;
-
-  direction?: Maybe<string[]>;
-
-  packets?: Maybe<number[]>;
-
-  protocol?: Maybe<string[]>;
-
-  transport?: Maybe<string[]>;
-}
-
-export interface PackageEcsFields {
-  arch?: Maybe<string[]>;
-
-  entity_id?: Maybe<string[]>;
-
-  name?: Maybe<string[]>;
-
-  size?: Maybe<number[]>;
-
-  summary?: Maybe<string[]>;
-
-  version?: Maybe<string[]>;
-}
-
-export interface AuditEcsFields {
-  package?: Maybe<PackageEcsFields>;
-}
-
-export interface SshEcsFields {
-  method?: Maybe<string[]>;
-
-  signature?: Maybe<string[]>;
-}
-
-export interface AuthEcsFields {
-  ssh?: Maybe<SshEcsFields>;
-}
-
-export interface SystemEcsField {
-  audit?: Maybe<AuditEcsFields>;
-
-  auth?: Maybe<AuthEcsFields>;
-}
-
-export interface RuleField {
-  id?: Maybe<string[]>;
-
-  rule_id?: Maybe<string[]>;
-
-  false_positives: string[];
-
-  saved_id?: Maybe<string[]>;
-
-  timeline_id?: Maybe<string[]>;
-
-  timeline_title?: Maybe<string[]>;
-
-  max_signals?: Maybe<number[]>;
-
-  risk_score?: Maybe<string[]>;
-
-  output_index?: Maybe<string[]>;
-
-  description?: Maybe<string[]>;
-
-  from?: Maybe<string[]>;
-
-  immutable?: Maybe<boolean[]>;
-
-  index?: Maybe<string[]>;
-
-  interval?: Maybe<string[]>;
-
-  language?: Maybe<string[]>;
-
-  query?: Maybe<string[]>;
-
-  references?: Maybe<string[]>;
-
-  severity?: Maybe<string[]>;
-
-  tags?: Maybe<string[]>;
-
-  threat?: Maybe<ToAny>;
-
-  type?: Maybe<string[]>;
-
-  size?: Maybe<string[]>;
-
-  to?: Maybe<string[]>;
-
-  enabled?: Maybe<boolean[]>;
-
-  filters?: Maybe<ToAny>;
-
-  created_at?: Maybe<string[]>;
-
-  updated_at?: Maybe<string[]>;
-
-  created_by?: Maybe<string[]>;
-
-  updated_by?: Maybe<string[]>;
-
-  version?: Maybe<string[]>;
-
-  note?: Maybe<string[]>;
-
-  threshold?: Maybe<ToAny>;
-
-  exceptions_list?: Maybe<ToAny>;
-}
-
-export interface SignalField {
-  rule?: Maybe<RuleField>;
-
-  original_time?: Maybe<string[]>;
-
-  status?: Maybe<string[]>;
-}
-
-export interface RuleEcsField {
-  reference?: Maybe<string[]>;
-}
-
-export interface Ecs {
-  _id: string;
-
-  _index?: Maybe<string>;
-
-  agent?: Maybe<AgentEcsField>;
-
-  auditd?: Maybe<AuditdEcsFields>;
-
-  destination?: Maybe<DestinationEcsFields>;
-
-  dns?: Maybe<DnsEcsFields>;
-
-  endgame?: Maybe<EndgameEcsFields>;
-
-  event?: Maybe<EventEcsFields>;
-
-  geo?: Maybe<GeoEcsFields>;
-
-  host?: Maybe<HostEcsFields>;
-
-  network?: Maybe<NetworkEcsField>;
-
-  rule?: Maybe<RuleEcsField>;
-
-  signal?: Maybe<SignalField>;
-
-  source?: Maybe<SourceEcsFields>;
-
-  suricata?: Maybe<SuricataEcsFields>;
-
-  tls?: Maybe<TlsEcsFields>;
-
-  zeek?: Maybe<ZeekEcsFields>;
-
-  http?: Maybe<HttpEcsFields>;
-
-  url?: Maybe<UrlEcsFields>;
-
-  timestamp?: Maybe<string>;
-
-  message?: Maybe<string[]>;
-
-  user?: Maybe<UserEcsFields>;
-
-  winlog?: Maybe<WinlogEcsFields>;
-
-  process?: Maybe<ProcessEcsFields>;
-
-  file?: Maybe<FileFields>;
-
-  system?: Maybe<SystemEcsField>;
-}
-
-export interface EcsEdges {
-  node: Ecs;
-
-  cursor: CursorType;
-}
-
-export interface CursorType {
-  value?: Maybe<string>;
-
-  tiebreaker?: Maybe<string>;
-}
-
-/** A descriptor of a field in an index */
-export interface IndexField {
-  /** Where the field belong */
-  category: string;
-  /** Example of field's value */
-  example?: Maybe<string>;
-  /** whether the field's belong to an alias index */
-  indexes: (Maybe<string>)[];
-  /** The name of the field */
-  name: string;
-  /** The type of the field's values as recognized by Kibana */
-  type: string;
-  /** Whether the field's values can be efficiently searched for */
-  searchable: boolean;
-  /** Whether the field's values can be aggregated */
-  aggregatable: boolean;
-  /** Description of the field */
-  description?: Maybe<string>;
-
-  format?: Maybe<string>;
-  /** the elastic type as mapped in the index */
-  esTypes?: Maybe<ToStringArrayNoNullable>;
-
-  subType?: Maybe<ToIFieldSubTypeNonNullable>;
-}
-
-export interface PageInfo {
-  endCursor?: Maybe<CursorType>;
-
-  hasNextPage?: Maybe<boolean>;
-}
-
-export interface Inspect {
-  dsl: string[];
-
-  response: string[];
-}
-
-export interface PageInfoPaginated {
-  activePage: number;
-
-  fakeTotalCount: number;
-
-  showMorePagesIndicator: boolean;
-}
-
-// ====================================================
-// Arguments
-// ====================================================
-
-export interface GetNoteQueryArgs {
-  id: string;
-}
-export interface GetNotesByTimelineIdQueryArgs {
-  timelineId: string;
-}
-export interface GetNotesByEventIdQueryArgs {
-  eventId: string;
-}
-export interface GetAllNotesQueryArgs {
-  pageInfo?: Maybe<PageInfoNote>;
-
-  search?: Maybe<string>;
-
-  sort?: Maybe<SortNote>;
-}
-export interface GetAllPinnedEventsByTimelineIdQueryArgs {
-  timelineId: string;
-}
-export interface SourceQueryArgs {
-  /** The id of the source */
-  id: string;
-}
-export interface GetOneTimelineQueryArgs {
-  id: string;
-
-  timelineType?: Maybe<TimelineType>;
-}
-export interface GetAllTimelineQueryArgs {
-  pageInfo: PageInfoTimeline;
-
-  search?: Maybe<string>;
-
-  sort?: Maybe<SortTimeline>;
-
-  onlyUserFavorite?: Maybe<boolean>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  status?: Maybe<TimelineStatus>;
-}
-export interface IndicesExistSourceStatusArgs {
-  defaultIndex: string[];
-}
-export interface IndexFieldsSourceStatusArgs {
-  defaultIndex: string[];
-}
-export interface PersistNoteMutationArgs {
-  noteId?: Maybe<string>;
-
-  version?: Maybe<string>;
-
-  note: NoteInput;
-}
-export interface DeleteNoteMutationArgs {
-  id: string[];
-}
-export interface DeleteNoteByTimelineIdMutationArgs {
-  timelineId: string;
-
-  version?: Maybe<string>;
-}
-export interface PersistPinnedEventOnTimelineMutationArgs {
-  pinnedEventId?: Maybe<string>;
-
-  eventId: string;
-
-  timelineId?: Maybe<string>;
-}
-export interface DeletePinnedEventOnTimelineMutationArgs {
-  id: string[];
-}
-export interface DeleteAllPinnedEventsOnTimelineMutationArgs {
-  timelineId: string;
-}
-export interface PersistTimelineMutationArgs {
-  id?: Maybe<string>;
-
-  version?: Maybe<string>;
-
-  timeline: TimelineInput;
-}
-export interface PersistFavoriteMutationArgs {
-  timelineId?: Maybe<string>;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-}
-export interface DeleteTimelineMutationArgs {
-  id: string[];
-}
-
-// ====================================================
-// Documents
-// ====================================================
-
-export namespace GetAllTimeline {
-  export type Variables = {
-    pageInfo: PageInfoTimeline;
-    search?: Maybe<string>;
-    sort?: Maybe<SortTimeline>;
-    onlyUserFavorite?: Maybe<boolean>;
-    timelineType?: Maybe<TimelineType>;
-    status?: Maybe<TimelineStatus>;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-
-    getAllTimeline: GetAllTimeline;
-  };
-
-  export type GetAllTimeline = {
-    __typename?: 'ResponseTimelines';
-
-    totalCount: Maybe<number>;
-
-    defaultTimelineCount: Maybe<number>;
-
-    templateTimelineCount: Maybe<number>;
-
-    elasticTemplateTimelineCount: Maybe<number>;
-
-    customTemplateTimelineCount: Maybe<number>;
-
-    favoriteCount: Maybe<number>;
-
-    timeline: (Maybe<Timeline>)[];
-  };
-
-  export type Timeline = {
-    __typename?: 'TimelineResult';
-
-    savedObjectId: string;
-
-    description: Maybe<string>;
-
-    favorite: Maybe<Favorite[]>;
-
-    eventIdToNoteIds: Maybe<EventIdToNoteIds[]>;
-
-    excludedRowRendererIds: Maybe<RowRendererId[]>;
-
-    notes: Maybe<Notes[]>;
-
-    noteIds: Maybe<string[]>;
-
-    pinnedEventIds: Maybe<string[]>;
-
-    status: Maybe<TimelineStatus>;
-
-    title: Maybe<string>;
-
-    timelineType: Maybe<TimelineType>;
-
-    templateTimelineId: Maybe<string>;
-
-    templateTimelineVersion: Maybe<number>;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: string;
-  };
-
-  export type Favorite = {
-    __typename?: 'FavoriteTimelineResult';
-
-    fullName: Maybe<string>;
-
-    userName: Maybe<string>;
-
-    favoriteDate: Maybe<number>;
-  };
-
-  export type EventIdToNoteIds = {
-    __typename?: 'NoteResult';
-
-    eventId: Maybe<string>;
-
-    note: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    noteId: string;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    timelineVersion: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-
-  export type Notes = {
-    __typename?: 'NoteResult';
-
-    eventId: Maybe<string>;
-
-    note: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    timelineVersion: Maybe<string>;
-
-    noteId: string;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-}
-
-export namespace DeleteTimelineMutation {
-  export type Variables = {
-    id: string[];
-  };
-
-  export type Mutation = {
-    __typename?: 'Mutation';
-
-    deleteTimeline: boolean;
-  };
-}
-
-export namespace PersistTimelineFavoriteMutation {
-  export type Variables = {
-    timelineId?: Maybe<string>;
-    templateTimelineId?: Maybe<string>;
-    templateTimelineVersion?: Maybe<number>;
-    timelineType: TimelineType;
-  };
-
-  export type Mutation = {
-    __typename?: 'Mutation';
-
-    persistFavorite: PersistFavorite;
-  };
-
-  export type PersistFavorite = {
-    __typename?: 'ResponseFavoriteTimeline';
-
-    savedObjectId: string;
-
-    version: string;
-
-    favorite: Maybe<Favorite[]>;
-
-    templateTimelineId: Maybe<string>;
-
-    templateTimelineVersion: Maybe<number>;
-
-    timelineType: Maybe<TimelineType>;
-  };
-
-  export type Favorite = {
-    __typename?: 'FavoriteTimelineResult';
-
-    fullName: Maybe<string>;
-
-    userName: Maybe<string>;
-
-    favoriteDate: Maybe<number>;
-  };
-}
-
-export namespace PersistTimelineNoteMutation {
-  export type Variables = {
-    noteId?: Maybe<string>;
-    version?: Maybe<string>;
-    note: NoteInput;
-  };
-
-  export type Mutation = {
-    __typename?: 'Mutation';
-
-    persistNote: PersistNote;
-  };
-
-  export type PersistNote = {
-    __typename?: 'ResponseNote';
-
-    code: Maybe<number>;
-
-    message: Maybe<string>;
-
-    note: Note;
-  };
-
-  export type Note = {
-    __typename?: 'NoteResult';
-
-    eventId: Maybe<string>;
-
-    note: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    timelineVersion: Maybe<string>;
-
-    noteId: string;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-}
-
-export namespace GetOneTimeline {
-  export type Variables = {
-    id: string;
-    timelineType?: Maybe<TimelineType>;
-  };
-
-  export type Query = {
-    __typename?: 'Query';
-
-    getOneTimeline: GetOneTimeline;
-  };
-
-  export type GetOneTimeline = {
-    __typename?: 'TimelineResult';
-
-    savedObjectId: string;
-
-    columns: Maybe<Columns[]>;
-
-    dataProviders: Maybe<DataProviders[]>;
-
-    dateRange: Maybe<DateRange>;
-
-    description: Maybe<string>;
-
-    eqlOptions: Maybe<EqlOptions>;
-
-    eventType: Maybe<string>;
-
-    eventIdToNoteIds: Maybe<EventIdToNoteIds[]>;
-
-    excludedRowRendererIds: Maybe<RowRendererId[]>;
-
-    favorite: Maybe<Favorite[]>;
-
-    filters: Maybe<Filters[]>;
-
-    kqlMode: Maybe<string>;
-
-    kqlQuery: Maybe<KqlQuery>;
-
-    indexNames: Maybe<string[]>;
-
-    notes: Maybe<Notes[]>;
-
-    noteIds: Maybe<string[]>;
-
-    pinnedEventIds: Maybe<string[]>;
-
-    pinnedEventsSaveObject: Maybe<PinnedEventsSaveObject[]>;
-
-    status: Maybe<TimelineStatus>;
-
-    title: Maybe<string>;
-
-    timelineType: Maybe<TimelineType>;
-
-    templateTimelineId: Maybe<string>;
-
-    templateTimelineVersion: Maybe<number>;
-
-    savedQueryId: Maybe<string>;
-
-    sort: Maybe<ToAny>;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: string;
-  };
-
-  export type Columns = {
-    __typename?: 'ColumnHeaderResult';
-
-    aggregatable: Maybe<boolean>;
-
-    category: Maybe<string>;
-
-    columnHeaderType: Maybe<string>;
-
-    description: Maybe<string>;
-
-    example: Maybe<string>;
-
-    indexes: Maybe<string[]>;
-
-    id: Maybe<string>;
-
-    name: Maybe<string>;
-
-    searchable: Maybe<boolean>;
-
-    type: Maybe<string>;
-  };
-
-  export type DataProviders = {
-    __typename?: 'DataProviderResult';
-
-    id: Maybe<string>;
-
-    name: Maybe<string>;
-
-    enabled: Maybe<boolean>;
-
-    excluded: Maybe<boolean>;
-
-    kqlQuery: Maybe<string>;
-
-    type: Maybe<DataProviderType>;
-
-    queryMatch: Maybe<QueryMatch>;
-
-    and: Maybe<And[]>;
-  };
-
-  export type QueryMatch = {
-    __typename?: 'QueryMatchResult';
-
-    field: Maybe<string>;
-
-    displayField: Maybe<string>;
-
-    value: Maybe<string>;
-
-    displayValue: Maybe<string>;
-
-    operator: Maybe<string>;
-  };
-
-  export type And = {
-    __typename?: 'DataProviderResult';
-
-    id: Maybe<string>;
-
-    name: Maybe<string>;
-
-    enabled: Maybe<boolean>;
-
-    excluded: Maybe<boolean>;
-
-    kqlQuery: Maybe<string>;
-
-    type: Maybe<DataProviderType>;
-
-    queryMatch: Maybe<_QueryMatch>;
-  };
-
-  export type _QueryMatch = {
-    __typename?: 'QueryMatchResult';
-
-    field: Maybe<string>;
-
-    displayField: Maybe<string>;
-
-    value: Maybe<string>;
-
-    displayValue: Maybe<string>;
-
-    operator: Maybe<string>;
-  };
-
-  export type DateRange = {
-    __typename?: 'DateRangePickerResult';
-
-    start: Maybe<ToAny>;
-
-    end: Maybe<ToAny>;
-  };
-
-  export type EqlOptions = {
-    __typename?: 'EqlOptionsResult';
-
-    eventCategoryField: Maybe<string>;
-
-    tiebreakerField: Maybe<string>;
-
-    timestampField: Maybe<string>;
-
-    query: Maybe<string>;
-
-    size: Maybe<ToAny>;
-  };
-
-  export type EventIdToNoteIds = {
-    __typename?: 'NoteResult';
-
-    eventId: Maybe<string>;
-
-    note: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    noteId: string;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    timelineVersion: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-
-  export type Favorite = {
-    __typename?: 'FavoriteTimelineResult';
-
-    fullName: Maybe<string>;
-
-    userName: Maybe<string>;
-
-    favoriteDate: Maybe<number>;
-  };
-
-  export type Filters = {
-    __typename?: 'FilterTimelineResult';
-
-    meta: Maybe<Meta>;
-
-    query: Maybe<string>;
-
-    exists: Maybe<string>;
-
-    match_all: Maybe<string>;
-
-    missing: Maybe<string>;
-
-    range: Maybe<string>;
-
-    script: Maybe<string>;
-  };
-
-  export type Meta = {
-    __typename?: 'FilterMetaTimelineResult';
-
-    alias: Maybe<string>;
-
-    controlledBy: Maybe<string>;
-
-    disabled: Maybe<boolean>;
-
-    field: Maybe<string>;
-
-    formattedValue: Maybe<string>;
-
-    index: Maybe<string>;
-
-    key: Maybe<string>;
-
-    negate: Maybe<boolean>;
-
-    params: Maybe<string>;
-
-    type: Maybe<string>;
-
-    value: Maybe<string>;
-  };
-
-  export type KqlQuery = {
-    __typename?: 'SerializedFilterQueryResult';
-
-    filterQuery: Maybe<FilterQuery>;
-  };
-
-  export type FilterQuery = {
-    __typename?: 'SerializedKueryQueryResult';
-
-    kuery: Maybe<Kuery>;
-
-    serializedQuery: Maybe<string>;
-  };
-
-  export type Kuery = {
-    __typename?: 'KueryFilterQueryResult';
-
-    kind: Maybe<string>;
-
-    expression: Maybe<string>;
-  };
-
-  export type Notes = {
-    __typename?: 'NoteResult';
-
-    eventId: Maybe<string>;
-
-    note: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    timelineVersion: Maybe<string>;
-
-    noteId: string;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-
-  export type PinnedEventsSaveObject = {
-    __typename?: 'PinnedEvent';
-
-    pinnedEventId: string;
-
-    eventId: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-}
-
-export namespace PersistTimelineMutation {
-  export type Variables = {
-    timelineId?: Maybe<string>;
-    version?: Maybe<string>;
-    timeline: TimelineInput;
-  };
-
-  export type Mutation = {
-    __typename?: 'Mutation';
-
-    persistTimeline: PersistTimeline;
-  };
-
-  export type PersistTimeline = {
-    __typename?: 'ResponseTimeline';
-
-    code: Maybe<number>;
-
-    message: Maybe<string>;
-
-    timeline: Timeline;
-  };
-
-  export type Timeline = {
-    __typename?: 'TimelineResult';
-
-    savedObjectId: string;
-
-    version: string;
-
-    columns: Maybe<Columns[]>;
-
-    dataProviders: Maybe<DataProviders[]>;
-
-    description: Maybe<string>;
-
-    eventType: Maybe<string>;
-
-    excludedRowRendererIds: Maybe<RowRendererId[]>;
-
-    favorite: Maybe<Favorite[]>;
-
-    filters: Maybe<Filters[]>;
-
-    kqlMode: Maybe<string>;
-
-    kqlQuery: Maybe<KqlQuery>;
-
-    indexNames: Maybe<string[]>;
-
-    title: Maybe<string>;
-
-    dateRange: Maybe<DateRange>;
-
-    savedQueryId: Maybe<string>;
-
-    sort: Maybe<ToAny>;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-  };
-
-  export type Columns = {
-    __typename?: 'ColumnHeaderResult';
-
-    aggregatable: Maybe<boolean>;
-
-    category: Maybe<string>;
-
-    columnHeaderType: Maybe<string>;
-
-    description: Maybe<string>;
-
-    example: Maybe<string>;
-
-    indexes: Maybe<string[]>;
-
-    id: Maybe<string>;
-
-    name: Maybe<string>;
-
-    searchable: Maybe<boolean>;
-
-    type: Maybe<string>;
-  };
-
-  export type DataProviders = {
-    __typename?: 'DataProviderResult';
-
-    id: Maybe<string>;
-
-    name: Maybe<string>;
-
-    enabled: Maybe<boolean>;
-
-    excluded: Maybe<boolean>;
-
-    kqlQuery: Maybe<string>;
-
-    type: Maybe<DataProviderType>;
-
-    queryMatch: Maybe<QueryMatch>;
-
-    and: Maybe<And[]>;
-  };
-
-  export type QueryMatch = {
-    __typename?: 'QueryMatchResult';
-
-    field: Maybe<string>;
-
-    displayField: Maybe<string>;
-
-    value: Maybe<string>;
-
-    displayValue: Maybe<string>;
-
-    operator: Maybe<string>;
-  };
-
-  export type And = {
-    __typename?: 'DataProviderResult';
-
-    id: Maybe<string>;
-
-    name: Maybe<string>;
-
-    enabled: Maybe<boolean>;
-
-    excluded: Maybe<boolean>;
-
-    kqlQuery: Maybe<string>;
-
-    type: Maybe<DataProviderType>;
-
-    queryMatch: Maybe<_QueryMatch>;
-  };
-
-  export type _QueryMatch = {
-    __typename?: 'QueryMatchResult';
-
-    field: Maybe<string>;
-
-    displayField: Maybe<string>;
-
-    value: Maybe<string>;
-
-    displayValue: Maybe<string>;
-
-    operator: Maybe<string>;
-  };
-
-  export type Favorite = {
-    __typename?: 'FavoriteTimelineResult';
-
-    fullName: Maybe<string>;
-
-    userName: Maybe<string>;
-
-    favoriteDate: Maybe<number>;
-  };
-
-  export type Filters = {
-    __typename?: 'FilterTimelineResult';
-
-    meta: Maybe<Meta>;
-
-    query: Maybe<string>;
-
-    exists: Maybe<string>;
-
-    match_all: Maybe<string>;
-
-    missing: Maybe<string>;
-
-    range: Maybe<string>;
-
-    script: Maybe<string>;
-  };
-
-  export type Meta = {
-    __typename?: 'FilterMetaTimelineResult';
-
-    alias: Maybe<string>;
-
-    controlledBy: Maybe<string>;
-
-    disabled: Maybe<boolean>;
-
-    field: Maybe<string>;
-
-    formattedValue: Maybe<string>;
-
-    index: Maybe<string>;
-
-    key: Maybe<string>;
-
-    negate: Maybe<boolean>;
-
-    params: Maybe<string>;
-
-    type: Maybe<string>;
-
-    value: Maybe<string>;
-  };
-
-  export type KqlQuery = {
-    __typename?: 'SerializedFilterQueryResult';
-
-    filterQuery: Maybe<FilterQuery>;
-  };
-
-  export type FilterQuery = {
-    __typename?: 'SerializedKueryQueryResult';
-
-    kuery: Maybe<Kuery>;
-
-    serializedQuery: Maybe<string>;
-  };
-
-  export type Kuery = {
-    __typename?: 'KueryFilterQueryResult';
-
-    kind: Maybe<string>;
-
-    expression: Maybe<string>;
-  };
-
-  export type DateRange = {
-    __typename?: 'DateRangePickerResult';
-
-    start: Maybe<ToAny>;
-
-    end: Maybe<ToAny>;
-  };
-}
-
-export namespace PersistTimelinePinnedEventMutation {
-  export type Variables = {
-    pinnedEventId?: Maybe<string>;
-    eventId: string;
-    timelineId?: Maybe<string>;
-  };
-
-  export type Mutation = {
-    __typename?: 'Mutation';
-
-    persistPinnedEventOnTimeline: Maybe<PersistPinnedEventOnTimeline>;
-  };
-
-  export type PersistPinnedEventOnTimeline = {
-    __typename?: 'PinnedEvent';
-
-    pinnedEventId: string;
-
-    eventId: Maybe<string>;
-
-    timelineId: Maybe<string>;
-
-    timelineVersion: Maybe<string>;
-
-    created: Maybe<number>;
-
-    createdBy: Maybe<string>;
-
-    updated: Maybe<number>;
-
-    updatedBy: Maybe<string>;
-
-    version: Maybe<string>;
-  };
-}
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
index a63300738ebf09..8013208d02cc38 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
@@ -12,7 +12,6 @@ import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
@@ -29,22 +28,10 @@ describe('Authentication Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
index 613ef2c3366dca..0808238151e03e 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
@@ -7,11 +7,9 @@
 
 import { shallow } from 'enzyme';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -41,23 +39,11 @@ describe('Hosts Table', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
 
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
@@ -86,21 +72,19 @@ describe('Hosts Table', () => {
 
       beforeEach(() => {
         wrapper = mount(
-          <MockedProvider>
-            <TestProviders store={store}>
-              <HostsTable
-                id="hostsQuery"
-                isInspect={false}
-                loading={false}
-                data={mockData}
-                totalCount={0}
-                fakeTotalCount={-1}
-                showMorePagesIndicator={false}
-                loadPage={loadPage}
-                type={hostsModel.HostsType.page}
-              />
-            </TestProviders>
-          </MockedProvider>
+          <TestProviders store={store}>
+            <HostsTable
+              id="hostsQuery"
+              isInspect={false}
+              loading={false}
+              data={mockData}
+              totalCount={0}
+              fakeTotalCount={-1}
+              showMorePagesIndicator={false}
+              loadPage={loadPage}
+              type={hostsModel.HostsType.page}
+            />
+          </TestProviders>
         );
       });
       test('Initial value of the store', () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
index ddea55158d9fd5..4871cfcb069d2f 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
@@ -12,7 +12,6 @@ import { Router } from 'react-router-dom';
 import { Filter } from '../../../../../../src/plugins/data/common/es_query';
 import '../../common/mock/match_media';
 import {
-  apolloClientObservable,
   TestProviders,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
@@ -144,13 +143,7 @@ describe('Hosts - rendering', () => {
     });
     const myState: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
-    const myStore = createStore(
-      myState,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     const wrapper = mount(
       <TestProviders store={myStore}>
         <Router history={mockHistory}>
diff --git a/x-pack/plugins/security_solution/public/hosts/store/model.ts b/x-pack/plugins/security_solution/public/hosts/store/model.ts
index b610971f703058..2060d462067231 100644
--- a/x-pack/plugins/security_solution/public/hosts/store/model.ts
+++ b/x-pack/plugins/security_solution/public/hosts/store/model.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { HostsFields } from '../../../common/search_strategy/security_solution/hosts';
-import { Direction } from '../../graphql/types';
+import { Direction } from '../../../common/search_strategy';
+import { HostsFields } from '../../../common/search_strategy/security_solution';
 
 export enum HostsType {
   page = 'page',
diff --git a/x-pack/plugins/security_solution/public/lazy_application_dependencies.tsx b/x-pack/plugins/security_solution/public/lazy_application_dependencies.tsx
index 0c9c74f9ebc15c..536d1d084f0c5d 100644
--- a/x-pack/plugins/security_solution/public/lazy_application_dependencies.tsx
+++ b/x-pack/plugins/security_solution/public/lazy_application_dependencies.tsx
@@ -11,8 +11,7 @@
  */
 
 import { renderApp } from './app';
-import { composeLibs } from './common/lib/compose/kibana_compose';
 
 import { createStore, createInitialState } from './common/store';
 
-export { renderApp, composeLibs, createStore, createInitialState };
+export { renderApp, createStore, createInitialState };
diff --git a/x-pack/plugins/security_solution/public/network/components/details/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/details/index.test.tsx
index 514460ffb09700..ceb89db7b0f538 100644
--- a/x-pack/plugins/security_solution/public/network/components/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/details/index.test.tsx
@@ -9,10 +9,8 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import { ActionCreator } from 'typescript-fsa';
 
-import { FlowTarget } from '../../../graphql/types';
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -26,27 +24,16 @@ import { IpOverview } from './index';
 import { mockData } from './mock';
 import { mockAnomalies } from '../../../common/components/ml/mock';
 import { NarrowDateRange } from '../../../common/components/ml/types';
+import { FlowTarget } from '../../../../common/search_strategy';
 
 describe('IP Overview Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx
index 3bbc08d593fd3c..7b3f9e956c765f 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx
@@ -13,11 +13,11 @@ import { getRenderedFieldValue, PointToolTipContentComponent } from './point_too
 import { TestProviders } from '../../../../common/mock';
 import { getEmptyStringTag } from '../../../../common/components/empty_value';
 import { HostDetailsLink, NetworkDetailsLink } from '../../../../common/components/links';
-import { FlowTarget } from '../../../../graphql/types';
 import {
   TooltipProperty,
   ITooltipProperty,
 } from '../../../../../../maps/public/classes/tooltips/tooltip_property';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 describe('PointToolTipContent', () => {
   const mockFeatureProps: ITooltipProperty[] = [
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.tsx
index fb032d11ef98a5..0fa59c6fd9e42d 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/map_tool_tip/point_tool_tip_content.tsx
@@ -14,9 +14,9 @@ import {
 import { DescriptionListStyled } from '../../../../common/components/page';
 import { HostDetailsLink, NetworkDetailsLink } from '../../../../common/components/links';
 import { DefaultFieldRenderer } from '../../../../timelines/components/field_renderers/field_renderers';
-import { FlowTarget } from '../../../../graphql/types';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { ITooltipProperty } from '../../../../../../maps/public/classes/tooltips/tooltip_property';
+import { FlowTarget } from '../../../../../common/search_strategy';
 
 interface PointToolTipContentProps {
   contextId: string;
diff --git a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.test.tsx b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.test.tsx
index 49c0decbfe301b..d98db616c9cded 100644
--- a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.test.tsx
@@ -7,8 +7,7 @@
 
 import { mount, shallow } from 'enzyme';
 import React from 'react';
-
-import { FlowDirection } from '../../../graphql/types';
+import { FlowDirection } from '../../../../common/search_strategy';
 
 import { FlowDirectionSelect } from './flow_direction_select';
 
diff --git a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.tsx b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.tsx
index c434434f707deb..12fa1e6a0d00d1 100644
--- a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_direction_select.tsx
@@ -7,8 +7,7 @@
 
 import { EuiFilterButton, EuiFilterGroup } from '@elastic/eui';
 import React from 'react';
-
-import { FlowDirection } from '../../../graphql/types';
+import { FlowDirection } from '../../../../common/search_strategy';
 
 import * as i18n from './translations';
 
diff --git a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.test.tsx b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.test.tsx
index e8779a76626a54..918114f9e7196c 100644
--- a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.test.tsx
@@ -8,8 +8,7 @@
 import { mount, shallow } from 'enzyme';
 import { clone } from 'lodash/fp';
 import React from 'react';
-
-import { FlowDirection, FlowTarget } from '../../../graphql/types';
+import { FlowDirection, FlowTarget } from '../../../../common/search_strategy';
 
 import { FlowTargetSelect } from './flow_target_select';
 
diff --git a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.tsx b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.tsx
index 5d8f33e9d7b051..723378b970df83 100644
--- a/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/flow_controls/flow_target_select.tsx
@@ -7,8 +7,7 @@
 
 import { EuiSuperSelect } from '@elastic/eui';
 import React from 'react';
-
-import { FlowDirection, FlowTarget } from '../../../graphql/types';
+import { FlowTarget, FlowDirection } from '../../../../common/search_strategy';
 
 import * as i18n from './translations';
 
diff --git a/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.test.tsx
index b1e2874d3c77b7..8794d48b5aa13f 100644
--- a/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.test.tsx
@@ -12,7 +12,7 @@ import { MemoryRouter } from 'react-router-dom';
 import '../../../common/mock/match_media';
 import { TestProviders } from '../../../common/mock';
 import { FlowTargetSelectConnectedComponent } from './index';
-import { FlowTarget } from '../../../graphql/types';
+import { FlowTarget } from '../../../../common/search_strategy';
 
 describe('Flow Target Select Connected', () => {
   test('renders correctly against snapshot flowTarget source', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.tsx b/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.tsx
index c1568e2df21b8a..5fef9833c57e2e 100644
--- a/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/flow_target_select_connected/index.tsx
@@ -11,11 +11,11 @@ import React, { useCallback } from 'react';
 import { useHistory, useLocation } from 'react-router-dom';
 import styled from 'styled-components';
 
-import { FlowDirection, FlowTarget } from '../../../graphql/types';
 import * as i18nIp from '../details/translations';
 
 import { FlowTargetSelect } from '../flow_controls/flow_target_select';
 import { IpOverviewId } from '../../../timelines/components/field_renderers/field_renderers';
+import { FlowTarget, FlowDirection } from '../../../../common/search_strategy';
 
 const SelectTypeItem = styled(EuiFlexItem)`
   min-width: 180px;
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
index e88a7593c1a095..7f9c5b4672f9a1 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import {
-  apolloClientObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
@@ -33,22 +32,10 @@ describe('NetworkKpiComponent', () => {
   };
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
index a645396063bded..7ec18c078c73d7 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
@@ -8,12 +8,10 @@
 import { shallow } from 'enzyme';
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -31,23 +29,11 @@ describe('NetworkTopNFlow Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
@@ -75,21 +61,19 @@ describe('NetworkTopNFlow Table Component', () => {
   describe('Sorting', () => {
     test('when you click on the column header, you should show the sorting icon', () => {
       const wrapper = mount(
-        <MockedProvider>
-          <TestProviders store={store}>
-            <NetworkDnsTable
-              data={mockData.edges}
-              fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.pageInfo)}
-              id="dns"
-              isInspect={false}
-              loading={false}
-              loadPage={loadPage}
-              showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockData.pageInfo)}
-              totalCount={mockData.totalCount}
-              type={networkModel.NetworkType.page}
-            />
-          </TestProviders>
-        </MockedProvider>
+        <TestProviders store={store}>
+          <NetworkDnsTable
+            data={mockData.edges}
+            fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.pageInfo)}
+            id="dns"
+            isInspect={false}
+            loading={false}
+            loadPage={loadPage}
+            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockData.pageInfo)}
+            totalCount={mockData.totalCount}
+            type={networkModel.NetworkType.page}
+          />
+        </TestProviders>
       );
 
       expect(store.getState().network.page.queries!.dns.sort).toEqual({
diff --git a/x-pack/plugins/security_solution/public/network/components/network_dns_table/is_ptr_included.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_dns_table/is_ptr_included.test.tsx
index 870de5c36afad4..762cd4006002be 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_dns_table/is_ptr_included.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_dns_table/is_ptr_included.test.tsx
@@ -7,8 +7,7 @@
 
 import { mount, shallow } from 'enzyme';
 import React from 'react';
-
-import { FlowDirection } from '../../../graphql/types';
+import { FlowDirection } from '../../../../common/search_strategy';
 
 import { IsPtrIncluded } from './is_ptr_included';
 
diff --git a/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
index cbadb47c6d11ad..f7f75d9f0a365d 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
@@ -8,12 +8,10 @@
 import { shallow } from 'enzyme';
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -34,23 +32,11 @@ describe('NetworkHttp Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
@@ -78,21 +64,19 @@ describe('NetworkHttp Table Component', () => {
   describe('Sorting', () => {
     test('when you click on the column header, you should show the sorting icon', () => {
       const wrapper = mount(
-        <MockedProvider>
-          <TestProviders store={store}>
-            <NetworkHttpTable
-              data={mockData.edges}
-              fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.pageInfo)}
-              id="http"
-              isInspect={false}
-              loading={false}
-              loadPage={loadPage}
-              showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockData.pageInfo)}
-              totalCount={mockData.totalCount}
-              type={networkModel.NetworkType.page}
-            />
-          </TestProviders>
-        </MockedProvider>
+        <TestProviders store={store}>
+          <NetworkHttpTable
+            data={mockData.edges}
+            fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.pageInfo)}
+            id="http"
+            isInspect={false}
+            loading={false}
+            loadPage={loadPage}
+            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockData.pageInfo)}
+            totalCount={mockData.totalCount}
+            type={networkModel.NetworkType.page}
+          />
+        </TestProviders>
       );
 
       expect(store.getState().network.page.queries!.http.sort).toEqual({
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
index 8ea43d1b0c34f2..c9ce204a52538c 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
@@ -8,13 +8,11 @@
 import { shallow } from 'enzyme';
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
 import { FlowTargetSourceDest } from '../../../../common/search_strategy/security_solution/network';
 import {
-  apolloClientObservable,
   mockGlobalState,
   mockIndexPattern,
   TestProviders,
@@ -35,22 +33,10 @@ describe('NetworkTopCountries Table Component', () => {
   const mount = useMountAppended();
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
@@ -109,27 +95,25 @@ describe('NetworkTopCountries Table Component', () => {
   describe('Sorting on Table', () => {
     test('when you click on the column header, you should show the sorting icon', () => {
       const wrapper = mount(
-        <MockedProvider>
-          <TestProviders store={store}>
-            <NetworkTopCountriesTable
-              data={mockData.NetworkTopCountries.edges}
-              fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.NetworkTopCountries.pageInfo)}
-              flowTargeted={FlowTargetSourceDest.source}
-              id="topCountriesSource"
-              isInspect={false}
-              indexPattern={mockIndexPattern}
-              loading={false}
-              loadPage={loadPage}
-              showMorePagesIndicator={getOr(
-                false,
-                'showMorePagesIndicator',
-                mockData.NetworkTopCountries.pageInfo
-              )}
-              totalCount={mockData.NetworkTopCountries.totalCount}
-              type={networkModel.NetworkType.page}
-            />
-          </TestProviders>
-        </MockedProvider>
+        <TestProviders store={store}>
+          <NetworkTopCountriesTable
+            data={mockData.NetworkTopCountries.edges}
+            fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.NetworkTopCountries.pageInfo)}
+            flowTargeted={FlowTargetSourceDest.source}
+            id="topCountriesSource"
+            isInspect={false}
+            indexPattern={mockIndexPattern}
+            loading={false}
+            loadPage={loadPage}
+            showMorePagesIndicator={getOr(
+              false,
+              'showMorePagesIndicator',
+              mockData.NetworkTopCountries.pageInfo
+            )}
+            totalCount={mockData.NetworkTopCountries.totalCount}
+            type={networkModel.NetworkType.page}
+          />
+        </TestProviders>
       );
       expect(store.getState().network.page.queries.topCountriesSource.sort).toEqual({
         direction: 'desc',
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
index 5983efad32fe2b..a05277cd0513d4 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
@@ -8,13 +8,10 @@
 import { shallow } from 'enzyme';
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
-import { FlowTargetSourceDest } from '../../../graphql/types';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -26,6 +23,7 @@ import { createStore, State } from '../../../common/store';
 import { networkModel } from '../../store';
 import { NetworkTopNFlowTable } from '.';
 import { mockData } from './mock';
+import { FlowTargetSourceDest } from '../../../../common/search_strategy';
 
 jest.mock('../../../common/components/link_to');
 
@@ -34,23 +32,11 @@ describe('NetworkTopNFlow Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('rendering', () => {
@@ -100,22 +86,20 @@ describe('NetworkTopNFlow Table Component', () => {
   describe('Sorting on Table', () => {
     test('when you click on the column header, you should show the sorting icon', () => {
       const wrapper = mount(
-        <MockedProvider>
-          <TestProviders store={store}>
-            <NetworkTopNFlowTable
-              data={mockData.edges}
-              fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.pageInfo)}
-              flowTargeted={FlowTargetSourceDest.source}
-              id="topNFlowSource"
-              isInspect={false}
-              loading={false}
-              loadPage={loadPage}
-              showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockData.pageInfo)}
-              totalCount={mockData.totalCount}
-              type={networkModel.NetworkType.page}
-            />
-          </TestProviders>
-        </MockedProvider>
+        <TestProviders store={store}>
+          <NetworkTopNFlowTable
+            data={mockData.edges}
+            fakeTotalCount={getOr(50, 'fakeTotalCount', mockData.pageInfo)}
+            flowTargeted={FlowTargetSourceDest.source}
+            id="topNFlowSource"
+            isInspect={false}
+            loading={false}
+            loadPage={loadPage}
+            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockData.pageInfo)}
+            totalCount={mockData.totalCount}
+            type={networkModel.NetworkType.page}
+          />
+        </TestProviders>
       );
       expect(store.getState().network.page.queries.topNFlowSource.sort).toEqual({
         direction: 'desc',
diff --git a/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
index f93d6d276bc6e4..09b1afc5611b0a 100644
--- a/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
@@ -8,12 +8,10 @@
 import { shallow } from 'enzyme';
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -31,23 +29,11 @@ describe('Tls Table Component', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('Rendering', () => {
@@ -75,21 +61,19 @@ describe('Tls Table Component', () => {
   describe('Sorting on Table', () => {
     test('when you click on the column header, you should show the sorting icon', () => {
       const wrapper = mount(
-        <MockedProvider>
-          <TestProviders store={store}>
-            <TlsTable
-              data={mockTlsData.edges}
-              fakeTotalCount={getOr(50, 'fakeTotalCount', mockTlsData.pageInfo)}
-              id="tls"
-              isInspect={false}
-              loading={false}
-              loadPage={loadPage}
-              showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockTlsData.pageInfo)}
-              totalCount={1}
-              type={networkModel.NetworkType.details}
-            />
-          </TestProviders>
-        </MockedProvider>
+        <TestProviders store={store}>
+          <TlsTable
+            data={mockTlsData.edges}
+            fakeTotalCount={getOr(50, 'fakeTotalCount', mockTlsData.pageInfo)}
+            id="tls"
+            isInspect={false}
+            loading={false}
+            loadPage={loadPage}
+            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockTlsData.pageInfo)}
+            totalCount={1}
+            type={networkModel.NetworkType.details}
+          />
+        </TestProviders>
       );
       expect(store.getState().network.details.queries!.tls.sort).toEqual({
         direction: 'desc',
diff --git a/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
index 8fab7273530d27..e551dbb640751f 100644
--- a/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
@@ -8,13 +8,10 @@
 import { shallow } from 'enzyme';
 import { getOr } from 'lodash/fp';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
-import { FlowTarget } from '../../../graphql/types';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -27,29 +24,18 @@ import { networkModel } from '../../store';
 
 import { UsersTable } from '.';
 import { mockUsersData } from './mock';
+import { FlowTarget } from '../../../../common/search_strategy';
 
 describe('Users Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   describe('Rendering', () => {
@@ -78,26 +64,20 @@ describe('Users Table Component', () => {
   describe('Sorting on Table', () => {
     test('when you click on the column header, you should show the sorting icon', () => {
       const wrapper = mount(
-        <MockedProvider>
-          <TestProviders store={store}>
-            <UsersTable
-              data={mockUsersData.edges}
-              flowTarget={FlowTarget.source}
-              fakeTotalCount={getOr(50, 'fakeTotalCount', mockUsersData.pageInfo)}
-              id="user"
-              isInspect={false}
-              loading={false}
-              loadPage={loadPage}
-              showMorePagesIndicator={getOr(
-                false,
-                'showMorePagesIndicator',
-                mockUsersData.pageInfo
-              )}
-              totalCount={1}
-              type={networkModel.NetworkType.details}
-            />
-          </TestProviders>
-        </MockedProvider>
+        <TestProviders store={store}>
+          <UsersTable
+            data={mockUsersData.edges}
+            flowTarget={FlowTarget.source}
+            fakeTotalCount={getOr(50, 'fakeTotalCount', mockUsersData.pageInfo)}
+            id="user"
+            isInspect={false}
+            loading={false}
+            loadPage={loadPage}
+            showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', mockUsersData.pageInfo)}
+            totalCount={1}
+            type={networkModel.NetworkType.details}
+          />
+        </TestProviders>
       );
       expect(store.getState().network.details.queries!.users.sort).toEqual({
         direction: 'asc',
diff --git a/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx b/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx
index 77f6d4575d8f76..49a7064113c307 100644
--- a/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/tls/index.tsx
@@ -15,7 +15,6 @@ import { inputsModel } from '../../../common/store';
 import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
 import { useKibana } from '../../../common/lib/kibana';
 import { createFilter } from '../../../common/containers/helpers';
-import { PageInfoPaginated, FlowTargetSourceDest } from '../../../graphql/types';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
 import { networkModel, networkSelectors } from '../../store';
 import {
@@ -27,6 +26,7 @@ import { isCompleteResponse, isErrorResponse } from '../../../../../../../src/pl
 
 import * as i18n from './translations';
 import { getInspectResponse } from '../../../helpers';
+import { FlowTargetSourceDest, PageInfoPaginated } from '../../../../common/search_strategy';
 
 const ID = 'networkTlsQuery';
 
diff --git a/x-pack/plugins/security_solution/public/network/containers/users/index.tsx b/x-pack/plugins/security_solution/public/network/containers/users/index.tsx
index 515ef3b8644aba..e000981733eedb 100644
--- a/x-pack/plugins/security_solution/public/network/containers/users/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/users/index.tsx
@@ -16,7 +16,6 @@ import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
 import { inputsModel } from '../../../common/store';
 import { useKibana } from '../../../common/lib/kibana';
 import { createFilter } from '../../../common/containers/helpers';
-import { PageInfoPaginated } from '../../../graphql/types';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
 import { networkSelectors } from '../../store';
 import {
@@ -29,6 +28,7 @@ import { isCompleteResponse, isErrorResponse } from '../../../../../../../src/pl
 import * as i18n from './translations';
 import { getInspectResponse } from '../../../helpers';
 import { InspectResponse } from '../../../types';
+import { PageInfoPaginated } from '../../../../common/search_strategy';
 
 const ID = 'networkUsersQuery';
 
diff --git a/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx b/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx
index 84c4e4528a12e2..a9a97f6bac6521 100644
--- a/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx
@@ -11,9 +11,7 @@ import { Router, useParams } from 'react-router-dom';
 import '../../../common/mock/match_media';
 
 import { useSourcererScope } from '../../../common/containers/sourcerer';
-import { FlowTarget } from '../../../graphql/types';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -23,6 +21,7 @@ import {
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
 import { NetworkDetails } from './index';
+import { FlowTarget } from '../../../../common/search_strategy';
 
 jest.mock('@elastic/eui', () => {
   const original = jest.requireActual('@elastic/eui');
@@ -109,22 +108,10 @@ describe('Network Details', () => {
 
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   test('it renders', () => {
diff --git a/x-pack/plugins/security_solution/public/network/pages/details/index.tsx b/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
index 896eec39c125cf..4cccb536c08bbd 100644
--- a/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
@@ -11,7 +11,11 @@ import { useDispatch } from 'react-redux';
 import { useParams } from 'react-router-dom';
 
 import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
-import { FlowTarget, LastEventIndexKey } from '../../../../common/search_strategy';
+import {
+  FlowTarget,
+  FlowTargetSourceDest,
+  LastEventIndexKey,
+} from '../../../../common/search_strategy';
 import { useGlobalTime } from '../../../common/containers/use_global_time';
 import { FiltersGlobal } from '../../../common/components/filters_global';
 import { HeaderPage } from '../../../common/components/header_page';
@@ -26,7 +30,6 @@ import { IpOverview } from '../../components/details';
 import { SiemSearchBar } from '../../../common/components/search_bar';
 import { WrapperPage } from '../../../common/components/wrapper_page';
 import { useNetworkDetails } from '../../containers/details';
-import { FlowTargetSourceDest } from '../../../graphql/types';
 import { useKibana } from '../../../common/lib/kibana';
 import { decodeIpv6 } from '../../../common/lib/helpers';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
diff --git a/x-pack/plugins/security_solution/public/network/pages/index.tsx b/x-pack/plugins/security_solution/public/network/pages/index.tsx
index c82b9060729c64..ddc098823470a1 100644
--- a/x-pack/plugins/security_solution/public/network/pages/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/index.tsx
@@ -10,13 +10,13 @@ import { Route, Switch, RouteComponentProps, useHistory } from 'react-router-dom
 
 import { useMlCapabilities } from '../../common/components/ml/hooks/use_ml_capabilities';
 import { hasMlUserPermissions } from '../../../common/machine_learning/has_ml_user_permissions';
-import { FlowTarget } from '../../graphql/types';
 
 import { NetworkDetails } from './details';
 import { Network } from './network';
 import { getNetworkRoutePath } from './navigation';
 import { NetworkRouteType } from './navigation/types';
 import { MlNetworkConditionalContainer } from '../../common/components/ml/conditional_links/ml_network_conditional_container';
+import { FlowTarget } from '../../../common/search_strategy';
 
 type Props = Partial<RouteComponentProps<{}>> & { url: string };
 
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
index ece647e9710e09..862a4f1a56c12a 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
@@ -15,7 +15,6 @@ import { useSourcererScope } from '../../common/containers/sourcerer';
 import {
   TestProviders,
   mockGlobalState,
-  apolloClientObservable,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
   createSecuritySolutionStorageMock,
@@ -146,13 +145,7 @@ describe('Network page - rendering', () => {
     });
     const myState: State = mockGlobalState;
     const { storage } = createSecuritySolutionStorageMock();
-    const myStore = createStore(
-      myState,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     const wrapper = mount(
       <TestProviders store={myStore}>
         <Router history={mockHistory}>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
index 9199059b9790de..1295693db506f9 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
@@ -11,7 +11,6 @@ import React from 'react';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -63,23 +62,11 @@ describe('OverviewHost', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
     const myState = cloneDeep(state);
-    store = createStore(
-      myState,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   test('it renders the expected widget title', () => {
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
index ce3973e59d18b3..13a9b529fdf43b 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
@@ -11,7 +11,6 @@ import React from 'react';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -73,23 +72,11 @@ describe('OverviewNetwork', () => {
   const state: State = mockGlobalState;
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
     const myState = cloneDeep(state);
-    store = createStore(
-      myState,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   });
 
   test('it renders the expected widget title', () => {
diff --git a/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx b/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx
index 004e675cb35165..1d9b039e022589 100644
--- a/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/recent_timelines/index.tsx
@@ -5,14 +5,12 @@
  * 2.0.
  */
 
-import ApolloClient from 'apollo-client';
 import { EuiHorizontalRule, EuiText } from '@elastic/eui';
 import React, { useCallback, useMemo, useEffect } from 'react';
 import { useDispatch } from 'react-redux';
 
-import { TimelineType } from '../../../../common/types/timeline';
+import { SortFieldTimeline, TimelineType } from '../../../../common/types/timeline';
 import { useGetAllTimeline } from '../../../timelines/containers/all';
-import { SortFieldTimeline, Direction } from '../../../graphql/types';
 import {
   queryTimelineById,
   dispatchUpdateTimeline,
@@ -30,15 +28,15 @@ import { SecurityPageName } from '../../../app/types';
 import { APP_ID } from '../../../../common/constants';
 import { useFormatUrl } from '../../../common/components/link_to';
 import { LinkAnchor } from '../../../common/components/links';
+import { Direction } from '../../../../common/search_strategy';
 
 interface Props {
-  apolloClient: ApolloClient<{}>;
   filterBy: FilterMode;
 }
 
 const PAGE_SIZE = 3;
 
-const StatefulRecentTimelinesComponent: React.FC<Props> = ({ apolloClient, filterBy }) => {
+const StatefulRecentTimelinesComponent: React.FC<Props> = ({ filterBy }) => {
   const dispatch = useDispatch();
   const updateIsLoading = useCallback((payload) => dispatch(dispatchUpdateIsLoading(payload)), [
     dispatch,
@@ -50,14 +48,13 @@ const StatefulRecentTimelinesComponent: React.FC<Props> = ({ apolloClient, filte
   const onOpenTimeline: OnOpenTimeline = useCallback(
     ({ duplicate, timelineId }) => {
       queryTimelineById({
-        apolloClient,
         duplicate,
         timelineId,
         updateIsLoading,
         updateTimeline,
       });
     },
-    [apolloClient, updateIsLoading, updateTimeline]
+    [updateIsLoading, updateTimeline]
   );
 
   const goToTimelines = useCallback(
diff --git a/x-pack/plugins/security_solution/public/overview/components/sidebar/sidebar.tsx b/x-pack/plugins/security_solution/public/overview/components/sidebar/sidebar.tsx
index 9512a3e3c67c7e..cd88b8f44dc7bb 100644
--- a/x-pack/plugins/security_solution/public/overview/components/sidebar/sidebar.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/sidebar/sidebar.tsx
@@ -20,7 +20,6 @@ import { FilterMode as RecentCasesFilterMode } from '../recent_cases/types';
 import { DEFAULT_FILTER_OPTIONS } from '../../../cases/containers/use_get_cases';
 import { SidebarHeader } from '../../../common/components/sidebar_header';
 import { useCurrentUser } from '../../../common/lib/kibana';
-import { useApolloClient } from '../../../common/utils/apollo_context';
 
 import * as i18n from '../../pages/translations';
 
@@ -50,7 +49,6 @@ export const Sidebar = React.memo<{
     setRecentTimelinesFilterBy,
   }) => {
     const currentUser = useCurrentUser();
-    const apolloClient = useApolloClient();
     const recentCasesFilters = useMemo(
       () => (
         <RecentCasesFilters
@@ -98,10 +96,7 @@ export const Sidebar = React.memo<{
 
         <EuiFlexItem grow={false}>
           <SidebarHeader title={i18n.RECENT_TIMELINES}>{recentTimelinesFilters}</SidebarHeader>
-          <StatefulRecentTimelines
-            apolloClient={apolloClient!}
-            filterBy={recentTimelinesFilterBy}
-          />
+          <StatefulRecentTimelines filterBy={recentTimelinesFilterBy} />
         </EuiFlexItem>
 
         <Spacer />
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index 136df89558d531..23f3472b470b5a 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -177,10 +177,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { overview: subPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
 
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -200,10 +199,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { detections: subPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
 
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -223,9 +221,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { hosts: subPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -245,9 +242,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { network: subPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -267,9 +263,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { timelines: subPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -289,9 +284,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { cases: subPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -311,9 +305,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       mount: async (params: AppMountParameters) => {
         const [coreStart, startPlugins] = await core.getStartServices();
         const { management: managementSubPlugin } = await this.subPlugins();
-        const { renderApp, composeLibs } = await this.lazyApplicationDependencies();
+        const { renderApp } = await this.lazyApplicationDependencies();
         return renderApp({
-          ...composeLibs(coreStart),
           ...params,
           services: await startServices,
           store: await this.store(coreStart, startPlugins),
@@ -458,7 +451,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     if (!this._store) {
       const defaultIndicesName = coreStart.uiSettings.get(DEFAULT_INDEX_KEY);
       const [
-        { composeLibs, createStore, createInitialState },
+        { createStore, createInitialState },
         kibanaIndexPatterns,
         {
           detections: detectionsSubPlugin,
@@ -491,8 +484,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         signal = { name: null };
       }
 
-      const { apolloClient } = composeLibs(coreStart);
-      const appLibs: AppObservableLibs = { apolloClient, kibana: coreStart };
+      const appLibs: AppObservableLibs = { kibana: coreStart };
       const libs$ = new BehaviorSubject(appLibs);
 
       const detectionsStart = detectionsSubPlugin.start(this.storage);
@@ -534,7 +526,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
           ...timelinesStart.store.reducer,
           ...managementSubPluginStart.store.reducer,
         },
-        libs$.pipe(pluck('apolloClient')),
         libs$.pipe(pluck('kibana')),
         this.storage,
         [...(managementSubPluginStart.store.middleware ?? [])]
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
index f57ce42e7e0794..fdfeba2a2c9c33 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
@@ -11,7 +11,6 @@ import React from 'react';
 import '../../../common/mock/react_beautiful_dnd';
 
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -78,7 +77,6 @@ describe('Flyout', () => {
       const storeShowIsTrue = createStore(
         stateShowIsTrue,
         SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
         kibanaObservable,
         storage
       );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
index 4d1c9e8037455f..1222f168b2ae90 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
@@ -7,9 +7,12 @@
 
 import { cloneDeep, getOr, omit } from 'lodash/fp';
 import { Dispatch } from 'redux';
-import ApolloClient from 'apollo-client';
 
-import { mockTimelineResults, mockTimelineResult, mockTimelineModel } from '../../../common/mock';
+import {
+  mockTimelineResults,
+  mockTimelineModel,
+  mockGetOneTimelineResult,
+} from '../../../common/mock';
 import { timelineDefaults } from '../../store/timeline/defaults';
 import { setTimelineRangeDatePicker as dispatchSetTimelineRangeDatePicker } from '../../../common/store/inputs/actions';
 import {
@@ -47,6 +50,7 @@ import {
   mockTimeline as mockSelectedTimeline,
   mockTemplate as mockSelectedTemplate,
 } from './__mocks__';
+import { getTimeline } from '../../containers/api';
 
 jest.mock('../../../common/store/inputs/actions');
 jest.mock('../../../common/components/url_state/normalize_time_range.ts');
@@ -68,6 +72,8 @@ jest.mock('../../../common/utils/default_date_settings', () => {
   };
 });
 
+jest.mock('../../containers/api');
+
 describe('helpers', () => {
   let mockResults: OpenTimelineResult[];
 
@@ -1223,12 +1229,8 @@ describe('helpers', () => {
       const selectedTimeline = {
         ...mockSelectedTimeline,
       };
-      const apolloClient = {
-        query: (jest.fn().mockResolvedValue(selectedTimeline) as unknown) as ApolloClient<{}>,
-      };
       const onOpenTimeline = jest.fn();
       const args = {
-        apolloClient,
         duplicate: false,
         graphEventId: '',
         timelineId: '',
@@ -1240,6 +1242,7 @@ describe('helpers', () => {
       };
 
       beforeAll(async () => {
+        (getTimeline as jest.Mock).mockResolvedValue(selectedTimeline);
         await queryTimelineById<{}>((args as unknown) as QueryTimelineById<{}>);
       });
 
@@ -1255,7 +1258,7 @@ describe('helpers', () => {
       });
 
       test('get timeline by Id', () => {
-        expect(apolloClient.query).toHaveBeenCalled();
+        expect(getTimeline).toHaveBeenCalled();
       });
 
       test('Do not override daterange if TimelineStatus is active', () => {
@@ -1281,11 +1284,8 @@ describe('helpers', () => {
       const updateIsLoading = jest.fn();
       const updateTimeline = jest.fn().mockImplementation(() => jest.fn());
       const selectedTimeline = { ...mockSelectedTimeline };
-      const apolloClient = {
-        query: (jest.fn().mockResolvedValue(selectedTimeline) as unknown) as ApolloClient<{}>,
-      };
+
       const args = {
-        apolloClient,
         duplicate: false,
         graphEventId: '',
         timelineId: '',
@@ -1296,6 +1296,7 @@ describe('helpers', () => {
       };
 
       beforeAll(async () => {
+        (getTimeline as jest.Mock).mockResolvedValue(selectedTimeline);
         await queryTimelineById<{}>((args as unknown) as QueryTimelineById<{}>);
       });
 
@@ -1311,7 +1312,7 @@ describe('helpers', () => {
       });
 
       test('get timeline by Id', () => {
-        expect(apolloClient.query).toHaveBeenCalled();
+        expect(getTimeline).toHaveBeenCalled();
       });
 
       test('should not override daterange if TimelineStatus is active', () => {
@@ -1350,12 +1351,8 @@ describe('helpers', () => {
     describe('open an immutable template', () => {
       const updateIsLoading = jest.fn();
       const template = { ...mockSelectedTemplate };
-      const apolloClient = {
-        query: (jest.fn().mockResolvedValue(template) as unknown) as ApolloClient<{}>,
-      };
       const onOpenTimeline = jest.fn();
       const args = {
-        apolloClient,
         duplicate: false,
         graphEventId: '',
         timelineId: '',
@@ -1367,10 +1364,12 @@ describe('helpers', () => {
       };
 
       beforeAll(async () => {
+        (getTimeline as jest.Mock).mockResolvedValue(template);
         await queryTimelineById<{}>((args as unknown) as QueryTimelineById<{}>);
       });
 
       afterAll(() => {
+        (getTimeline as jest.Mock).mockReset();
         jest.clearAllMocks();
       });
 
@@ -1382,7 +1381,7 @@ describe('helpers', () => {
       });
 
       test('get timeline by Id', () => {
-        expect(apolloClient.query).toHaveBeenCalled();
+        expect(getTimeline).toHaveBeenCalled();
       });
 
       test('override daterange if TimelineStatus is immutable', () => {
@@ -1411,14 +1410,14 @@ describe('helpers', () => {
 
   describe('omitTypenameInTimeline', () => {
     test('it does not modify the passed in timeline if no __typename exists', () => {
-      const result = omitTypenameInTimeline(mockTimelineResult);
+      const result = omitTypenameInTimeline(mockGetOneTimelineResult);
 
-      expect(result).toEqual(mockTimelineResult);
+      expect(result).toEqual(mockGetOneTimelineResult);
     });
 
     test('it returns timeline with __typename removed when it exists', () => {
       const mockTimeline = {
-        ...mockTimelineResult,
+        ...mockGetOneTimelineResult,
         __typename: 'something, something',
       };
       const result = omitTypenameInTimeline(mockTimeline);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
index 68f4d70c018f8c..8c4eb2112640fd 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
@@ -5,23 +5,12 @@
  * 2.0.
  */
 
-import ApolloClient from 'apollo-client';
 import { set } from '@elastic/safer-lodash-set/fp';
 import { getOr, isEmpty } from 'lodash/fp';
 import { Action } from 'typescript-fsa';
 import uuid from 'uuid';
 import { Dispatch } from 'redux';
 import deepMerge from 'deepmerge';
-import { oneTimelineQuery } from '../../containers/one/index.gql_query';
-import {
-  TimelineResult,
-  GetOneTimeline,
-  NoteResult,
-  FilterTimelineResult,
-  ColumnHeaderResult,
-  PinnedEvent,
-  DataProviderResult,
-} from '../../../graphql/types';
 
 import {
   DataProviderType,
@@ -29,6 +18,10 @@ import {
   TimelineStatus,
   TimelineType,
   TimelineTabs,
+  TimelineResult,
+  ColumnHeaderResult,
+  FilterTimelineResult,
+  DataProviderResult,
 } from '../../../../common/types/timeline';
 
 import {
@@ -66,6 +59,9 @@ import {
   DEFAULT_FROM_MOMENT,
   DEFAULT_TO_MOMENT,
 } from '../../../common/utils/default_date_settings';
+import { getTimeline } from '../../containers/api';
+import { PinnedEvent } from '../../../../common/types/timeline/pinned_event';
+import { NoteResult } from '../../../../common/types/timeline/note';
 
 export const OPEN_TIMELINE_CLASS_NAME = 'open-timeline';
 
@@ -310,7 +306,6 @@ export const formatTimelineResultToModel = (
 
 export interface QueryTimelineById<TCache> {
   activeTimelineTab?: TimelineTabs;
-  apolloClient: ApolloClient<TCache> | ApolloClient<{}> | undefined;
   duplicate?: boolean;
   graphEventId?: string;
   timelineId: string;
@@ -329,7 +324,6 @@ export interface QueryTimelineById<TCache> {
 
 export const queryTimelineById = <TCache>({
   activeTimelineTab = TimelineTabs.query,
-  apolloClient,
   duplicate = false,
   graphEventId = '',
   timelineId,
@@ -340,51 +334,44 @@ export const queryTimelineById = <TCache>({
   updateTimeline,
 }: QueryTimelineById<TCache>) => {
   updateIsLoading({ id: TimelineId.active, isLoading: true });
-  if (apolloClient) {
-    apolloClient
-      .query<GetOneTimeline.Query, GetOneTimeline.Variables>({
-        query: oneTimelineQuery,
-        fetchPolicy: 'no-cache',
-        variables: { id: timelineId },
-      })
-      .then((result) => {
-        const timelineToOpen: TimelineResult = omitTypenameInTimeline(
-          getOr({}, 'data.getOneTimeline', result)
-        );
-
-        const { timeline, notes } = formatTimelineResultToModel(
-          timelineToOpen,
+  Promise.resolve(getTimeline(timelineId))
+    .then((result) => {
+      const timelineToOpen: TimelineResult = omitTypenameInTimeline(
+        getOr({}, 'data.getOneTimeline', result)
+      );
+
+      const { timeline, notes } = formatTimelineResultToModel(
+        timelineToOpen,
+        duplicate,
+        timelineType
+      );
+
+      if (onOpenTimeline != null) {
+        onOpenTimeline(timeline);
+      } else if (updateTimeline) {
+        const { from, to } = normalizeTimeRange({
+          from: getOr(null, 'dateRange.start', timeline),
+          to: getOr(null, 'dateRange.end', timeline),
+        });
+        updateTimeline({
           duplicate,
-          timelineType
-        );
-
-        if (onOpenTimeline != null) {
-          onOpenTimeline(timeline);
-        } else if (updateTimeline) {
-          const { from, to } = normalizeTimeRange({
-            from: getOr(null, 'dateRange.start', timeline),
-            to: getOr(null, 'dateRange.end', timeline),
-          });
-          updateTimeline({
-            duplicate,
-            from,
-            id: TimelineId.active,
-            notes,
-            timeline: {
-              ...timeline,
-              activeTab: activeTimelineTab,
-              graphEventId,
-              show: openTimeline,
-              dateRange: { start: from, end: to },
-            },
-            to,
-          })();
-        }
-      })
-      .finally(() => {
-        updateIsLoading({ id: TimelineId.active, isLoading: false });
-      });
-  }
+          from,
+          id: TimelineId.active,
+          notes,
+          timeline: {
+            ...timeline,
+            activeTab: activeTimelineTab,
+            graphEventId,
+            show: openTimeline,
+            dateRange: { start: from, end: to },
+          },
+          to,
+        })();
+      }
+    })
+    .finally(() => {
+      updateIsLoading({ id: TimelineId.active, isLoading: false });
+    });
 };
 
 export const dispatchUpdateTimeline = (dispatch: Dispatch): DispatchUpdateTimeline => ({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.test.tsx
index 872175de2c0559..c0b451a8755221 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.test.tsx
@@ -8,9 +8,8 @@
 /* eslint-disable react/display-name */
 
 import React from 'react';
-import { renderHook, act } from '@testing-library/react-hooks';
+import { renderHook } from '@testing-library/react-hooks';
 import { mount } from 'enzyme';
-import { MockedProvider } from 'react-apollo/test-utils';
 import { waitFor } from '@testing-library/react';
 import { useHistory, useParams } from 'react-router-dom';
 
@@ -20,14 +19,13 @@ import { SecurityPageName } from '../../../app/types';
 import { TimelineType } from '../../../../common/types/timeline';
 
 import { TestProviders, mockOpenTimelineQueryResults } from '../../../common/mock';
-import { getTimelineTabsUrl } from '../../../common/components/link_to';
 
 import { DEFAULT_SEARCH_RESULTS_PER_PAGE } from '../../pages/timelines_page';
 import { useGetAllTimeline, getAllTimeline } from '../../containers/all';
 
 import { useTimelineStatus } from './use_timeline_status';
 import { NotePreviews } from './note_previews';
-import { OPEN_TIMELINE_CLASS_NAME } from './helpers';
+import { OPEN_TIMELINE_CLASS_NAME, queryTimelineById } from './helpers';
 import { StatefulOpenTimeline } from '.';
 import { TimelineTabsStyle } from './types';
 import {
@@ -35,6 +33,7 @@ import {
   UseTimelineTypesArgs,
   UseTimelineTypesResult,
 } from './use_timeline_types';
+import { deleteTimelinesByIds } from '../../containers/api';
 
 jest.mock('react-router-dom', () => {
   const originalModule = jest.requireActual('react-router-dom');
@@ -80,6 +79,10 @@ jest.mock('./use_timeline_status', () => {
   };
 });
 
+jest.mock('../../containers/api', () => ({
+  deleteTimelinesByIds: jest.fn(),
+}));
+
 describe('StatefulOpenTimeline', () => {
   const title = 'All Timelines / Open Timelines';
   let mockHistory: History[];
@@ -94,12 +97,9 @@ describe('StatefulOpenTimeline', () => {
     (useHistory as jest.Mock).mockReturnValue(mockHistory);
     ((useGetAllTimeline as unknown) as jest.Mock).mockReturnValue({
       fetchAllTimeline: jest.fn(),
-      timelines: getAllTimeline(
-        '',
-        mockOpenTimelineQueryResults[0].result.data?.getAllTimeline?.timeline ?? []
-      ),
+      timelines: getAllTimeline('', mockOpenTimelineQueryResults.timeline ?? []),
       loading: false,
-      totalCount: mockOpenTimelineQueryResults[0].result.data.getAllTimeline.totalCount,
+      totalCount: mockOpenTimelineQueryResults.totalCount,
       refetch: jest.fn(),
     });
     ((useTimelineStatus as unknown) as jest.Mock).mockReturnValue({
@@ -112,23 +112,19 @@ describe('StatefulOpenTimeline', () => {
   });
 
   afterEach(() => {
-    (getTimelineTabsUrl as jest.Mock).mockClear();
-    (useParams as jest.Mock).mockClear();
-    (useHistory as jest.Mock).mockClear();
+    jest.clearAllMocks();
     mockHistory = [];
   });
 
   test('it has the expected initial state', () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <StatefulOpenTimeline
-            data-test-subj="stateful-timeline"
-            isModal={false}
-            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-            title={title}
-          />
-        </MockedProvider>
+        <StatefulOpenTimeline
+          data-test-subj="stateful-timeline"
+          isModal={false}
+          defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+          title={title}
+        />
       </TestProviders>
     );
 
@@ -175,7 +171,7 @@ describe('StatefulOpenTimeline', () => {
       expect(result.current.timelineType).toBe(TimelineType.template);
     });
 
-    test("should land on correct templates' tab after switching tab", () => {
+    test("should land on correct templates' tab after switching tab", async () => {
       (useParams as jest.Mock).mockReturnValue({
         tabName: TimelineType.template,
         pageName: SecurityPageName.timelines,
@@ -183,21 +179,20 @@ describe('StatefulOpenTimeline', () => {
 
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
-      wrapper
-        .find(`[data-test-subj="timeline-${TimelineTabsStyle.tab}-${TimelineType.template}"]`)
-        .first()
-        .simulate('click');
-      act(() => {
+      await waitFor(() => {
+        wrapper
+          .find(`[data-test-subj="timeline-${TimelineTabsStyle.tab}-${TimelineType.template}"]`)
+          .first()
+          .simulate('click');
+
         expect(history.length).toBeGreaterThan(0);
       });
     });
@@ -218,7 +213,7 @@ describe('StatefulOpenTimeline', () => {
       expect(result.current.timelineType).toBe(TimelineType.default);
     });
 
-    test('should not change url after switching filter', () => {
+    test('should not change url after switching filter', async () => {
       (useParams as jest.Mock).mockReturnValue({
         tabName: 'mockTabName',
         pageName: SecurityPageName.case,
@@ -226,58 +221,53 @@ describe('StatefulOpenTimeline', () => {
 
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={true}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={true}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
-      wrapper
-        .find(
-          `[data-test-subj="open-timeline-modal-body-${TimelineTabsStyle.filter}-${TimelineType.template}"]`
-        )
-        .first()
-        .simulate('click');
-      act(() => {
+      await waitFor(() => {
+        wrapper
+          .find(
+            `[data-test-subj="open-timeline-modal-body-${TimelineTabsStyle.filter}-${TimelineType.template}"]`
+          )
+          .first()
+          .simulate('click');
         expect(mockHistory.length).toEqual(0);
       });
     });
   });
 
   describe('#onQueryChange', () => {
-    test('it updates the query state with the expected trimmed value when the user enters a query', () => {
+    test('it updates the query state with the expected trimmed value when the user enters a query', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
-      wrapper
-        .find('[data-test-subj="search-bar"] input')
-        .simulate('keyup', { key: 'Enter', target: { value: '   abcd   ' } });
-      expect(wrapper.find('[data-test-subj="search-row"]').first().prop('query')).toEqual('abcd');
+      await waitFor(() => {
+        wrapper
+          .find('[data-test-subj="search-bar"] input')
+          .simulate('keyup', { key: 'Enter', target: { value: '   abcd   ' } });
+        expect(wrapper.find('[data-test-subj="search-row"]').first().prop('query')).toEqual('abcd');
+      });
     });
-
     test('it appends the word "with" to the Showing in Timelines message when the user enters a query', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -295,13 +285,11 @@ describe('StatefulOpenTimeline', () => {
     test('echos (renders) the query when the user enters a query', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -321,13 +309,11 @@ describe('StatefulOpenTimeline', () => {
     test('focuses the input when the component mounts', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -347,13 +333,11 @@ describe('StatefulOpenTimeline', () => {
 
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -381,41 +365,24 @@ describe('StatefulOpenTimeline', () => {
   });
 
   describe('#onDeleteSelected', () => {
-    // TODO - Have been skip because we need to re-implement the test as the component changed
-    test.skip('it invokes deleteTimelines with the selected timelines when the button is clicked', async () => {
-      const deleteTimelines = jest.fn();
-
+    test('it invokes deleteTimelines with the selected timelines when the button is clicked', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
+      wrapper.find('[data-test-subj="euiCollapsedItemActionsButton"]').first().simulate('click');
+      wrapper.find('[data-test-subj="delete-timeline"]').first().simulate('click');
+      wrapper.find('[data-test-subj="confirmModalConfirmButton"]').first().simulate('click');
 
       await waitFor(() => {
-        wrapper
-          .find('.euiCheckbox__input')
-          .first()
-          .simulate('change', { target: { checked: true } });
-
-        wrapper.find('[data-test-subj="delete-selected"]').first().simulate('click');
+        wrapper.update();
 
-        expect(deleteTimelines).toHaveBeenCalledWith([
-          'saved-timeline-11',
-          'saved-timeline-10',
-          'saved-timeline-9',
-          'saved-timeline-8',
-          'saved-timeline-6',
-          'saved-timeline-5',
-          'saved-timeline-4',
-          'saved-timeline-3',
-          'saved-timeline-2',
-        ]);
+        expect(deleteTimelinesByIds).toHaveBeenCalled();
       });
     });
   });
@@ -424,14 +391,12 @@ describe('StatefulOpenTimeline', () => {
     test('it updates the selection state when timelines are selected', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -455,14 +420,12 @@ describe('StatefulOpenTimeline', () => {
     test('it updates the sort state when the user clicks on a column to sort it', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -482,14 +445,12 @@ describe('StatefulOpenTimeline', () => {
     test('it updates the onlyFavorites state when the user clicks the Only Favorites button', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -509,14 +470,12 @@ describe('StatefulOpenTimeline', () => {
     test('it updates the itemIdToExpandedNotesRowMap state when the user clicks the expand notes button', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -538,11 +497,11 @@ describe('StatefulOpenTimeline', () => {
           '10849df0-7b44-11e9-a608-ab3d811609': (
             <NotePreviews
               notes={
-                mockOpenTimelineQueryResults[0].result.data!.getAllTimeline.timeline[0].notes !=
-                null
-                  ? mockOpenTimelineQueryResults[0].result.data!.getAllTimeline.timeline[0].notes.map(
-                      (note) => ({ ...note, savedObjectId: note.noteId })
-                    )
+                mockOpenTimelineQueryResults.timeline[0].notes != null
+                  ? mockOpenTimelineQueryResults.timeline[0].notes.map((note) => ({
+                      ...note,
+                      savedObjectId: note.noteId,
+                    }))
                   : []
               }
             />
@@ -554,14 +513,12 @@ describe('StatefulOpenTimeline', () => {
     test('it renders the expanded notes when the expand button is clicked', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -577,14 +534,12 @@ describe('StatefulOpenTimeline', () => {
     test('it has the expected initial state for openTimeline - templateTimelineFilter', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -594,14 +549,12 @@ describe('StatefulOpenTimeline', () => {
     test('it has the expected initial state for openTimelineModalBody - templateTimelineFilter', () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={true}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={true}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
 
@@ -619,14 +572,12 @@ describe('StatefulOpenTimeline', () => {
     test('when the user deletes selected timelines, resetSelectionState is invoked to clear the selection state', async () => {
       const wrapper = mount(
         <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <StatefulOpenTimeline
-              data-test-subj="stateful-timeline"
-              isModal={false}
-              defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-              title={title}
-            />
-          </MockedProvider>
+          <StatefulOpenTimeline
+            data-test-subj="stateful-timeline"
+            isModal={false}
+            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+            title={title}
+          />
         </TestProviders>
       );
       const getSelectedItem = (): [] =>
@@ -645,14 +596,12 @@ describe('StatefulOpenTimeline', () => {
   test('it renders the expected count of matching timelines when no query has been entered', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider addTypename={false}>
-          <StatefulOpenTimeline
-            data-test-subj="stateful-timeline"
-            isModal={false}
-            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-            title={title}
-          />
-        </MockedProvider>
+        <StatefulOpenTimeline
+          data-test-subj="stateful-timeline"
+          isModal={false}
+          defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+          title={title}
+        />
       </TestProviders>
     );
 
@@ -665,62 +614,51 @@ describe('StatefulOpenTimeline', () => {
     });
   });
 
-  // TODO - Have been skip because we need to re-implement the test as the component changed
-  test.skip('it invokes onOpenTimeline with the expected parameters when the hyperlink is clicked', async () => {
-    const onOpenTimeline = jest.fn();
-
+  test('it invokes onOpenTimeline with the expected parameters when the hyperlink is clicked', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <StatefulOpenTimeline
-            data-test-subj="stateful-timeline"
-            isModal={false}
-            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-            title={title}
-          />
-        </MockedProvider>
+        <StatefulOpenTimeline
+          data-test-subj="stateful-timeline"
+          defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+          isModal={false}
+          title={title}
+        />
       </TestProviders>
     );
 
     await waitFor(() => {
       wrapper
-        .find(
-          `[data-test-subj="title-${
-            mockOpenTimelineQueryResults[0].result.data!.getAllTimeline.timeline[0].savedObjectId
-          }"]`
-        )
+        .find(`[data-test-subj="title-${mockOpenTimelineQueryResults.timeline[0].savedObjectId}"]`)
         .first()
         .simulate('click');
 
-      expect(onOpenTimeline).toHaveBeenCalledWith({
-        duplicate: false,
-        timelineId: mockOpenTimelineQueryResults[0].result.data!.getAllTimeline.timeline[0]
-          .savedObjectId,
-      });
+      expect((queryTimelineById as jest.Mock).mock.calls[0][0].timelineId).toEqual(
+        mockOpenTimelineQueryResults.timeline[0].savedObjectId
+      );
+      expect((queryTimelineById as jest.Mock).mock.calls[0][0].duplicate).toEqual(false);
     });
   });
 
-  // TODO - Have been skip because we need to re-implement the test as the component changed
-  test.skip('it invokes onOpenTimeline with the expected params when the button is clicked', async () => {
-    const onOpenTimeline = jest.fn();
-
+  test('it invokes onOpenTimeline with the expected params when the button is clicked', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <StatefulOpenTimeline
-            data-test-subj="stateful-timeline"
-            isModal={false}
-            defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
-            title={title}
-          />
-        </MockedProvider>
+        <StatefulOpenTimeline
+          data-test-subj="stateful-timeline"
+          isModal={false}
+          defaultPageSize={DEFAULT_SEARCH_RESULTS_PER_PAGE}
+          title={title}
+        />
       </TestProviders>
     );
-
+    wrapper.find('[data-test-subj="euiCollapsedItemActionsButton"]').first().simulate('click');
+    wrapper.find('[data-test-subj="open-duplicate"]').first().simulate('click');
     await waitFor(() => {
-      wrapper.find('[data-test-subj="open-duplicate"]').first().simulate('click');
+      wrapper.update();
 
-      expect(onOpenTimeline).toBeCalledWith({ duplicate: true, timelineId: 'saved-timeline-11' });
+      expect((queryTimelineById as jest.Mock).mock.calls[0][0].timelineId).toEqual(
+        mockOpenTimelineQueryResults.timeline[0].savedObjectId
+      );
+      expect((queryTimelineById as jest.Mock).mock.calls[0][0].duplicate).toEqual(true);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
index 523c181dfb10f9..21e85fd3c5a4f8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
@@ -8,11 +8,9 @@
 import React, { useEffect, useState, useCallback, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
 
-import { DeleteTimelineMutation, SortFieldTimeline, Direction } from '../../../graphql/types';
 import { sourcererSelectors } from '../../../common/store';
 import { useShallowEqualSelector, useDeepEqualSelector } from '../../../common/hooks/use_selector';
-import { TimelineId } from '../../../../common/types/timeline';
-import { useApolloClient } from '../../../common/utils/apollo_context';
+import { SortFieldTimeline, TimelineId } from '../../../../common/types/timeline';
 import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineSelectors } from '../../../timelines/store/timeline';
 import {
@@ -20,7 +18,6 @@ import {
   updateIsLoading as dispatchUpdateIsLoading,
 } from '../../../timelines/store/timeline/actions';
 
-import { deleteTimelineMutation } from '../../containers/delete/persist.gql_query';
 import { useGetAllTimeline } from '../../containers/all';
 
 import { defaultHeaders } from '../timeline/body/column_headers/default_headers';
@@ -47,6 +44,8 @@ import {
 import { DEFAULT_SORT_FIELD, DEFAULT_SORT_DIRECTION } from './constants';
 import { useTimelineTypes } from './use_timeline_types';
 import { useTimelineStatus } from './use_timeline_status';
+import { deleteTimelinesByIds } from '../../containers/api';
+import { Direction } from '../../../../common/search_strategy';
 
 interface OwnProps<TCache = object> {
   /** Displays open timeline in modal */
@@ -84,7 +83,6 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
     setImportDataModalToggle,
     title,
   }) => {
-    const apolloClient = useApolloClient();
     const dispatch = useDispatch();
     /** Required by EuiTable for expandable rows: a map of `TimelineResult.savedObjectId` to rendered notes */
     const [itemIdToExpandedNotesRowMap, setItemIdToExpandedNotesRowMap] = useState<
@@ -214,17 +212,10 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
           );
         }
 
-        await apolloClient!.mutate<
-          DeleteTimelineMutation.Mutation,
-          DeleteTimelineMutation.Variables
-        >({
-          mutation: deleteTimelineMutation,
-          fetchPolicy: 'no-cache',
-          variables: { id: timelineIds },
-        });
+        await deleteTimelinesByIds(timelineIds);
         refetch();
       },
-      [apolloClient, dispatch, existingIndexNames, refetch, timelineSavedObjectId]
+      [dispatch, existingIndexNames, refetch, timelineSavedObjectId]
     );
 
     const onDeleteOneTimeline: OnDeleteOneTimeline = useCallback(
@@ -291,7 +282,6 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         }
 
         queryTimelineById({
-          apolloClient,
           duplicate,
           onOpenTimeline,
           timelineId,
@@ -301,7 +291,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         });
       },
       // eslint-disable-next-line react-hooks/exhaustive-deps
-      [apolloClient, updateIsLoading, updateTimeline]
+      [updateIsLoading, updateTimeline]
     );
 
     useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/index.test.tsx
index 936993931da27a..12da999c21fc88 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/index.test.tsx
@@ -7,7 +7,6 @@
 
 import { mount } from 'enzyme';
 import React, { ReactElement } from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 import { TestProviders } from '../../../../common/mock/test_providers';
 import { mockOpenTimelineQueryResults } from '../../../../common/mock/timeline_results';
@@ -16,9 +15,7 @@ import { useTimelineStatus } from '../use_timeline_status';
 import { OpenTimelineModal } from '.';
 
 jest.mock('../../../../common/lib/kibana');
-jest.mock('../../../../common/utils/apollo_context', () => ({
-  useApolloClient: () => ({}),
-}));
+
 jest.mock('../../../containers/all', () => {
   const originalModule = jest.requireActual('../../../containers/all');
   return {
@@ -53,13 +50,9 @@ describe('OpenTimelineModal', () => {
   beforeEach(() => {
     ((useGetAllTimeline as unknown) as jest.Mock).mockReturnValue({
       fetchAllTimeline: jest.fn(),
-      timelines: getAllTimeline(
-        '',
-        mockOpenTimelineQueryResults[0].result.data?.getAllTimeline?.timeline ?? []
-      ),
+      timelines: getAllTimeline('', mockOpenTimelineQueryResults.timeline ?? []),
       loading: false,
-      totalCount: mockOpenTimelineQueryResults[0].result.data.getAllTimeline.totalCount,
-      refetch: jest.fn(),
+      totalCount: mockOpenTimelineQueryResults.totalCount,
     });
     ((useTimelineStatus as unknown) as jest.Mock).mockReturnValue({
       timelineStatus: null,
@@ -76,9 +69,7 @@ describe('OpenTimelineModal', () => {
   test('it renders the expected modal', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OpenTimelineModal onClose={jest.fn()} />
-        </MockedProvider>
+        <OpenTimelineModal onClose={jest.fn()} />
       </TestProviders>
     );
 
@@ -90,9 +81,7 @@ describe('OpenTimelineModal', () => {
   test('it installs elastic prebuilt templates', async () => {
     const wrapper = mount(
       <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OpenTimelineModal onClose={jest.fn()} />
-        </MockedProvider>
+        <OpenTimelineModal onClose={jest.fn()} />
       </TestProviders>
     );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_button.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_button.test.tsx
index 62cdda6070b322..a902f4ea785c32 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_button.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline_modal/open_timeline_modal_button.test.tsx
@@ -7,24 +7,15 @@
 
 import { mount } from 'enzyme';
 import React from 'react';
-import { MockedProvider } from 'react-apollo/test-utils';
 
 import { waitFor } from '@testing-library/react';
-import { TestProviders } from '../../../../common/mock/test_providers';
-import { mockOpenTimelineQueryResults } from '../../../../common/mock/timeline_results';
 import * as i18n from '../translations';
 
 import { OpenTimelineModalButton } from './open_timeline_modal_button';
 
 describe('OpenTimelineModalButton', () => {
   test('it renders the expected button text', async () => {
-    const wrapper = mount(
-      <TestProviders>
-        <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-          <OpenTimelineModalButton onClick={jest.fn()} />
-        </MockedProvider>
-      </TestProviders>
-    );
+    const wrapper = mount(<OpenTimelineModalButton onClick={jest.fn()} />);
 
     await waitFor(() => {
       wrapper.update();
@@ -38,13 +29,7 @@ describe('OpenTimelineModalButton', () => {
   describe('onClick prop', () => {
     test('it invokes onClick function provided as a prop when the button is clicked', async () => {
       const onClick = jest.fn();
-      const wrapper = mount(
-        <TestProviders>
-          <MockedProvider mocks={mockOpenTimelineQueryResults} addTypename={false}>
-            <OpenTimelineModalButton onClick={onClick} />
-          </MockedProvider>
-        </TestProviders>
-      );
+      const wrapper = mount(<OpenTimelineModalButton onClick={onClick} />);
 
       await waitFor(() => {
         wrapper.find('[data-test-subj="open-timeline-button"]').first().simulate('click');
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts
index 47e1da2d240eaa..cddf4e8d71d603 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/types.ts
@@ -8,7 +8,7 @@
 import type React from 'react';
 import { AllTimelinesVariables } from '../../containers/all';
 import { TimelineModel } from '../../store/timeline/model';
-import { NoteResult } from '../../../graphql/types';
+import { NoteResult } from '../../../../common/types/timeline/note';
 import {
   TimelineTypeLiteral,
   TimelineTypeLiteralWithNull,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
index 86175c0e06ad2f..d1d5bffc6bd0aa 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
@@ -18,17 +18,12 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
 } from '@elastic/eui';
-import React, { useMemo, useState } from 'react';
+import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
 import { TimelineTabs } from '../../../../../common/types/timeline';
 import { BrowserFields } from '../../../../common/containers/source';
-import {
-  EventDetails,
-  EventsViewType,
-  EventView,
-  ThreatView,
-} from '../../../../common/components/event_details/event_details';
+import { EventDetails } from '../../../../common/components/event_details/event_details';
 import { TimelineEventsDetailsItem } from '../../../../../common/search_strategy/timeline';
 import { LineClamp } from '../../../../common/components/line_clamp';
 import * as i18n from './translations';
@@ -88,9 +83,6 @@ ExpandableEventTitle.displayName = 'ExpandableEventTitle';
 
 export const ExpandableEvent = React.memo<Props>(
   ({ browserFields, event, timelineId, timelineTabType, isAlert, loading, detailsData }) => {
-    const [eventView, setEventView] = useState<EventView>(EventsViewType.summaryView);
-    const [threatView, setThreatView] = useState<ThreatView>(EventsViewType.threatSummaryView);
-
     const message = useMemo(() => {
       if (detailsData) {
         const messageField = find({ category: 'base', field: 'message' }, detailsData) as
@@ -133,12 +125,8 @@ export const ExpandableEvent = React.memo<Props>(
             data={detailsData!}
             id={event.eventId!}
             isAlert={isAlert}
-            onThreatViewSelected={setThreatView}
-            onEventViewSelected={setEventView}
-            threatView={threatView}
             timelineId={timelineId}
             timelineTabType={timelineTabType}
-            eventView={eventView}
           />
         </StyledEuiFlexItem>
       </StyledFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx
index a9ab89359d0ae8..c2df8959c8c949 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 
 import '../../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -20,15 +19,6 @@ import {
 import { createStore, State } from '../../../../common/store';
 import { ExpandableHostDetails } from './expandable_host';
 
-jest.mock('react-apollo', () => {
-  const original = jest.requireActual('react-apollo');
-  return {
-    ...original,
-    // eslint-disable-next-line react/display-name
-    Query: () => <></>,
-  };
-});
-
 describe('Expandable Host Component', () => {
   const state: State = {
     ...mockGlobalState,
@@ -39,13 +29,7 @@ describe('Expandable Host Component', () => {
   };
 
   const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   const mockProps = {
     contextID: 'text-context',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx
index 15b2b33409707c..69676e58b77bdf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 
 import '../../../common/mock/match_media';
 import {
-  apolloClientObservable,
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
@@ -21,26 +20,12 @@ import { createStore, State } from '../../../common/store';
 import { DetailsPanel } from './index';
 import { TimelineExpandedDetail, TimelineTabs } from '../../../../common/types/timeline';
 import { FlowTarget } from '../../../../common/search_strategy/security_solution/network';
-jest.mock('react-apollo', () => {
-  const original = jest.requireActual('react-apollo');
-  return {
-    ...original,
-    // eslint-disable-next-line react/display-name
-    Query: () => <></>,
-  };
-});
 
 describe('Details Panel Component', () => {
   const state: State = { ...mockGlobalState };
 
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   const dataLessExpandedDetail = {
     [TimelineTabs.query]: {
@@ -89,13 +74,7 @@ describe('Details Panel Component', () => {
 
   describe('DetailsPanel: rendering', () => {
     beforeEach(() => {
-      store = createStore(
-        state,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     });
 
     test('it should not render the DetailsPanel if no expanded detail has been set in the reducer', () => {
@@ -123,13 +102,7 @@ describe('Details Panel Component', () => {
   describe('DetailsPanel:EventDetails: rendering', () => {
     beforeEach(() => {
       state.timeline.timelineById.test.expandedDetail = eventExpandedDetail;
-      store = createStore(
-        state,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     });
 
     test('it should render the Details Panel when the panelView is set and the associated params are set', () => {
@@ -167,13 +140,7 @@ describe('Details Panel Component', () => {
   describe('DetailsPanel:HostDetails: rendering', () => {
     beforeEach(() => {
       state.timeline.timelineById.test.expandedDetail = hostExpandedDetail;
-      store = createStore(
-        state,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     });
 
     test('it should render the Host Details view in the Details Panel when the panelView is hostDetail and the hostName is set', () => {
@@ -190,13 +157,7 @@ describe('Details Panel Component', () => {
   describe('DetailsPanel:NetworkDetails: rendering', () => {
     beforeEach(() => {
       state.timeline.timelineById.test.expandedDetail = networkExpandedDetail;
-      store = createStore(
-        state,
-        SUB_PLUGINS_REDUCER,
-        apolloClientObservable,
-        kibanaObservable,
-        storage
-      );
+      store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     });
 
     test('it should render the Network Details view in the Details Panel when the panelView is networkDetail and the ip is set', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/column_header.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/column_header.tsx
index 18ead2490dee34..7d203fab9e88ff 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/column_header.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/column_header.tsx
@@ -19,9 +19,9 @@ import {
   getDraggableFieldId,
 } from '../../../../../common/components/drag_and_drop/helpers';
 import { TimelineTabs } from '../../../../../../common/types/timeline';
+import { Direction } from '../../../../../../common/search_strategy';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { OnFilterChange } from '../../events';
-import { Direction } from '../../../../../graphql/types';
 import { ARIA_COLUMN_INDEX_OFFSET } from '../../helpers';
 import { EventsTh, EventsThContent, EventsHeadingHandle } from '../../styles';
 import { Sort } from '../sort';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/helpers.ts
index 85e1b52b5620bc..b52fa292413df4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/helpers.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { Direction } from '../../../../../../../common/search_strategy';
 import { assertUnreachable } from '../../../../../../../common/utility_types';
-import { Direction } from '../../../../../../graphql/types';
 import { ColumnHeaderOptions } from '../../../../../../timelines/store/timeline/model';
 import { Sort, SortDirection } from '../../sort';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/index.test.tsx
index bc4ba7fbf0ff59..b0198e60f3b9a1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/header/index.test.tsx
@@ -9,7 +9,6 @@ import { mount, shallow } from 'enzyme';
 import React from 'react';
 
 import { timelineActions } from '../../../../../store/timeline';
-import { Direction } from '../../../../../../graphql/types';
 import { TestProviders } from '../../../../../../common/mock';
 import { ColumnHeaderType } from '../../../../../store/timeline/model';
 import { Sort } from '../../sort';
@@ -18,6 +17,7 @@ import { defaultHeaders } from '../default_headers';
 
 import { HeaderComponent } from '.';
 import { getNewSortDirectionOnClick, getNextSortDirection, getSortDirection } from './helpers';
+import { Direction } from '../../../../../../../common/search_strategy';
 
 const mockDispatch = jest.fn();
 jest.mock('react-redux', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.test.tsx
index c76027e5ef78e4..e900458c655726 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/index.test.tsx
@@ -11,7 +11,6 @@ import React from 'react';
 import '../../../../../common/mock/match_media';
 import { DEFAULT_ACTIONS_COLUMN_WIDTH } from '../constants';
 import { defaultHeaders } from './default_headers';
-import { Direction } from '../../../../../graphql/types';
 import { mockBrowserFields } from '../../../../../common/containers/source/mock';
 import { Sort } from '../sort';
 import { TestProviders } from '../../../../../common/mock/test_providers';
@@ -21,6 +20,7 @@ import { ColumnHeadersComponent } from '.';
 import { cloneDeep } from 'lodash/fp';
 import { timelineActions } from '../../../../store/timeline';
 import { TimelineTabs } from '../../../../../../common/types/timeline';
+import { Direction } from '../../../../../../common/search_strategy';
 
 const mockDispatch = jest.fn();
 jest.mock('react-redux', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/index.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/index.ts
index 67cda060e90e4a..e7c69b9229d704 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/index.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { Direction } from '../../../../../graphql/types';
+import { Direction } from '../../../../../../common/search_strategy';
 import { ColumnId } from '../column_id';
 
 /** Specifies a column's sort direction */
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.test.tsx
index a08e47b5cadda4..56f98a6795cd1a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.test.tsx
@@ -7,8 +7,8 @@
 
 import { mount, shallow } from 'enzyme';
 import React from 'react';
+import { Direction } from '../../../../../../common/search_strategy';
 
-import { Direction } from '../../../../../graphql/types';
 import * as i18n from '../translations';
 
 import { getDirection, SortIndicator } from './sort_indicator';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.tsx
index c7d1a1f7b69572..6af29793f9373d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/sort/sort_indicator.tsx
@@ -8,11 +8,11 @@
 import { EuiIcon, EuiToolTip } from '@elastic/eui';
 import React from 'react';
 
-import { Direction } from '../../../../../graphql/types';
 import * as i18n from '../translations';
 import { SortNumber } from './sort_number';
 
 import { SortDirection } from '.';
+import { Direction } from '../../../../../../common/search_strategy';
 
 enum SortDirectionIndicatorEnum {
   SORT_UP = 'sortUp',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
index 2ea2a2e401c0f4..0f781b0958d02c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
@@ -9,7 +9,6 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
-import { Direction } from '../../../../graphql/types';
 import { DefaultCellRenderer } from '../cell_rendering/default_cell_renderer';
 import { defaultHeaders, mockTimelineData } from '../../../../common/mock';
 import '../../../../common/mock/match_media';
@@ -23,6 +22,7 @@ import { useTimelineEventsDetails } from '../../../containers/details/index';
 import { useSourcererScope } from '../../../../common/containers/sourcerer';
 import { mockSourcererScope } from '../../../../common/containers/sourcerer/mocks';
 import { PinnedTabContentComponent, Props as PinnedTabContentComponentProps } from '.';
+import { Direction } from '../../../../../common/search_strategy';
 
 jest.mock('../../../containers/index', () => ({
   useTimelineEvents: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
index 4333f48bc23793..165de178768f2a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/helpers.tsx
@@ -15,7 +15,6 @@ import { timelineActions, timelineSelectors } from '../../../../timelines/store/
 import { useShallowEqualSelector } from '../../../../common/hooks/use_selector';
 
 import * as i18n from './translations';
-import { TimelineInput } from '../../../store/timeline/actions';
 import { useCreateTimelineButton } from './use_create_timeline';
 import { timelineDefaults } from '../../../store/timeline/defaults';
 
@@ -25,8 +24,6 @@ const NotesCountBadge = (styled(EuiBadge)`
 
 NotesCountBadge.displayName = 'NotesCountBadge';
 
-export type SaveTimeline = (args: TimelineInput) => void;
-
 interface AddToFavoritesButtonProps {
   timelineId: string;
 }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
index aa667c0a8466c2..1cbf7587dd29b0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
@@ -11,7 +11,6 @@ import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import {
   mockGlobalState,
-  apolloClientObservable,
   SUB_PLUGINS_REDUCER,
   kibanaObservable,
   createSecuritySolutionStorageMock,
@@ -29,13 +28,7 @@ jest.mock('../../../../common/lib/kibana', () => {
 describe('NewTemplateTimeline', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const mockClosePopover = jest.fn();
   const mockTitle = 'NEW_TIMELINE';
   let wrapper: ReactWrapper;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
index ede473acbfb2ab..acae8c8c53cd02 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
@@ -9,7 +9,6 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
-import { Direction } from '../../../../graphql/types';
 import { DefaultCellRenderer } from '../cell_rendering/default_cell_renderer';
 import { defaultHeaders, mockTimelineData } from '../../../../common/mock';
 import '../../../../common/mock/match_media';
@@ -25,6 +24,7 @@ import { useTimelineEvents } from '../../../containers/index';
 import { useTimelineEventsDetails } from '../../../containers/details/index';
 import { useSourcererScope } from '../../../../common/containers/sourcerer';
 import { mockSourcererScope } from '../../../../common/containers/sourcerer/mocks';
+import { Direction } from '../../../../../common/search_strategy';
 
 jest.mock('../../../containers/index', () => ({
   useTimelineEvents: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx
index 3bca1c743db09d..44174009d01980 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.test.tsx
@@ -9,9 +9,9 @@ import { EuiSelectableProps } from '@elastic/eui';
 import React from 'react';
 import { shallow, ShallowWrapper, mount } from 'enzyme';
 
-import { TimelineType } from '../../../../../common/types/timeline';
-import { SortFieldTimeline, Direction } from '../../../../graphql/types';
+import { SortFieldTimeline, TimelineType } from '../../../../../common/types/timeline';
 import { SelectableTimeline, ORIGINAL_PAGE_SIZE } from './';
+import { Direction } from '../../../../../common/search_strategy';
 
 const mockFetchAllTimeline = jest.fn();
 jest.mock('../../../containers/all', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
index 7ccce80bbe9a4b..5692081c5ed3eb 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/selectable_timeline/index.tsx
@@ -23,15 +23,16 @@ import styled from 'styled-components';
 import {
   TimelineTypeLiteralWithNull,
   TimelineTypeLiteral,
+  SortFieldTimeline,
 } from '../../../../../common/types/timeline';
 
 import { useGetAllTimeline } from '../../../containers/all';
-import { SortFieldTimeline, Direction } from '../../../../graphql/types';
 import { isUntitled } from '../../open_timeline/helpers';
 import * as i18nTimeline from '../../open_timeline/translations';
 import { OpenTimelineResult } from '../../open_timeline/types';
 import { getEmptyTagValue } from '../../../../common/components/empty_value';
 import * as i18n from '../translations';
+import { Direction } from '../../../../../common/search_strategy';
 
 const MyEuiFlexItem = styled(EuiFlexItem)`
   display: inline-block;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts
deleted file mode 100644
index 59d8ce381446ac..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/containers/all/index.gql_query.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const allTimelinesQuery = gql`
-  query GetAllTimeline(
-    $pageInfo: PageInfoTimeline!
-    $search: String
-    $sort: SortTimeline
-    $onlyUserFavorite: Boolean
-    $timelineType: TimelineType
-    $status: TimelineStatus
-  ) {
-    getAllTimeline(
-      pageInfo: $pageInfo
-      search: $search
-      sort: $sort
-      onlyUserFavorite: $onlyUserFavorite
-      timelineType: $timelineType
-      status: $status
-    ) {
-      totalCount
-      defaultTimelineCount
-      templateTimelineCount
-      elasticTemplateTimelineCount
-      customTemplateTimelineCount
-      favoriteCount
-      timeline {
-        savedObjectId
-        description
-        favorite {
-          fullName
-          userName
-          favoriteDate
-        }
-        eventIdToNoteIds {
-          eventId
-          note
-          timelineId
-          noteId
-          created
-          createdBy
-          timelineVersion
-          updated
-          updatedBy
-          version
-        }
-        excludedRowRendererIds
-        notes {
-          eventId
-          note
-          timelineId
-          timelineVersion
-          noteId
-          created
-          createdBy
-          updated
-          updatedBy
-          version
-        }
-        noteIds
-        pinnedEventIds
-        status
-        title
-        timelineType
-        templateTimelineId
-        templateTimelineVersion
-        created
-        createdBy
-        updated
-        updatedBy
-        version
-      }
-    }
-  }
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx
index 82b41a95bd5371..4ba6fa8b22cd71 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/all/index.tsx
@@ -12,22 +12,19 @@ import { useDispatch } from 'react-redux';
 
 import { OpenTimelineResult } from '../../components/open_timeline/types';
 import { errorToToaster, useStateToaster } from '../../../common/components/toasters';
-import {
-  GetAllTimeline,
-  PageInfoTimeline,
-  SortTimeline,
-  TimelineResult,
-} from '../../../graphql/types';
 import { inputsActions } from '../../../common/store/inputs';
-import { useApolloClient } from '../../../common/utils/apollo_context';
 
-import { allTimelinesQuery } from './index.gql_query';
 import * as i18n from '../../pages/translations';
 import {
   TimelineType,
   TimelineTypeLiteralWithNull,
   TimelineStatusLiteralWithNull,
+  PageInfoTimeline,
+  TimelineResult,
+  SortTimeline,
+  GetAllTimelineVariables,
 } from '../../../../common/types/timeline';
+import { getAllTimelines } from '../api';
 
 export interface AllTimelinesArgs {
   fetchAllTimeline: ({
@@ -100,7 +97,6 @@ export const getAllTimeline = memoizeOne(
 
 export const useGetAllTimeline = (): AllTimelinesArgs => {
   const dispatch = useDispatch();
-  const apolloClient = useApolloClient();
   const [, dispatchToaster] = useStateToaster();
   const [allTimelines, setAllTimelines] = useState<Omit<AllTimelinesArgs, 'fetchAllTimeline'>>({
     loading: false,
@@ -127,64 +123,49 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
 
       const fetchData = async () => {
         try {
-          if (apolloClient != null) {
-            setAllTimelines((prevState) => ({
-              ...prevState,
-              loading: true,
-            }));
+          setAllTimelines((prevState) => ({
+            ...prevState,
+            loading: true,
+          }));
 
-            const variables: GetAllTimeline.Variables = {
-              onlyUserFavorite,
-              pageInfo,
-              search,
-              sort,
-              status,
-              timelineType,
-            };
-            const response = await apolloClient.query<
-              GetAllTimeline.Query,
-              GetAllTimeline.Variables
-            >({
-              query: allTimelinesQuery,
-              fetchPolicy: 'network-only',
-              variables,
-              context: {
-                fetchOptions: {
-                  abortSignal: abortCtrl.signal,
-                },
-              },
-            });
-            const getAllTimelineResponse = response?.data?.getAllTimeline;
-            const totalCount = getAllTimelineResponse?.totalCount ?? 0;
-            const timelines = getAllTimelineResponse?.timeline ?? [];
-            const customTemplateTimelineCount =
-              getAllTimelineResponse?.customTemplateTimelineCount ?? 0;
-            const defaultTimelineCount = getAllTimelineResponse?.defaultTimelineCount ?? 0;
-            const elasticTemplateTimelineCount =
-              getAllTimelineResponse?.elasticTemplateTimelineCount ?? 0;
-            const templateTimelineCount = getAllTimelineResponse?.templateTimelineCount ?? 0;
-            const favoriteCount = getAllTimelineResponse?.favoriteCount ?? 0;
-            if (!didCancel) {
-              dispatch(
-                inputsActions.setQuery({
-                  inputId: 'global',
-                  id: ALL_TIMELINE_QUERY_ID,
-                  loading: false,
-                  refetch: fetchData,
-                  inspect: null,
-                })
-              );
-              setAllTimelines({
+          const variables: GetAllTimelineVariables = {
+            onlyUserFavorite,
+            pageInfo,
+            search,
+            sort,
+            status,
+            timelineType,
+          };
+          const getAllTimelineResponse = await getAllTimelines(variables, abortCtrl.signal);
+          const totalCount = getAllTimelineResponse?.totalCount ?? 0;
+          const timelines = getAllTimelineResponse?.timeline ?? [];
+          const customTemplateTimelineCount =
+            getAllTimelineResponse?.customTemplateTimelineCount ?? 0;
+          const defaultTimelineCount = getAllTimelineResponse?.defaultTimelineCount ?? 0;
+          const elasticTemplateTimelineCount =
+            getAllTimelineResponse?.elasticTemplateTimelineCount ?? 0;
+          const templateTimelineCount = getAllTimelineResponse?.templateTimelineCount ?? 0;
+          const favoriteCount = getAllTimelineResponse?.favoriteCount ?? 0;
+          if (!didCancel) {
+            dispatch(
+              inputsActions.setQuery({
+                inputId: 'global',
+                id: ALL_TIMELINE_QUERY_ID,
                 loading: false,
-                totalCount,
-                timelines: getAllTimeline(JSON.stringify(variables), timelines as TimelineResult[]),
-                customTemplateTimelineCount,
-                defaultTimelineCount,
-                elasticTemplateTimelineCount,
-                templateTimelineCount,
-                favoriteCount,
-              });
-            }
+                refetch: fetchData,
+                inspect: null,
+              })
+            );
+            setAllTimelines({
+              loading: false,
+              totalCount,
+              timelines: getAllTimeline(JSON.stringify(variables), timelines as TimelineResult[]),
+              customTemplateTimelineCount,
+              defaultTimelineCount,
+              elasticTemplateTimelineCount,
+              templateTimelineCount,
+              favoriteCount,
+            });
           }
         } catch (error) {
           if (!didCancel) {
@@ -212,7 +193,7 @@ export const useGetAllTimeline = (): AllTimelinesArgs => {
         abortCtrl.abort();
       };
     },
-    [apolloClient, dispatch, dispatchToaster]
+    [dispatch, dispatchToaster]
   );
 
   useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/api.ts b/x-pack/plugins/security_solution/public/timelines/containers/api.ts
index 01a85f6309c3f1..a6c2126f95e8de 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/api.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/api.ts
@@ -21,14 +21,23 @@ import {
   TimelineErrorResponse,
   ImportTimelineResultSchema,
   importTimelineResultSchema,
+  ResponseFavoriteTimeline,
+  AllTimelinesResponse,
+  SingleTimelineResponse,
+  allTimelinesResponse,
+  responseFavoriteTimeline,
+  GetTimelinesArgs,
+  SingleTimelineResponseType,
+  TimelineType,
 } from '../../../common/types/timeline';
-import { TimelineInput, TimelineType } from '../../graphql/types';
 import {
   TIMELINE_URL,
   TIMELINE_DRAFT_URL,
   TIMELINE_IMPORT_URL,
   TIMELINE_EXPORT_URL,
   TIMELINE_PREPACKAGED_URL,
+  TIMELINES_URL,
+  TIMELINE_FAVORITE_URL,
 } from '../../../common/constants';
 
 import { KibanaServices } from '../../common/lib/kibana';
@@ -39,6 +48,7 @@ import {
   ImportDataProps,
   ImportDataResponse,
 } from '../../detections/containers/detection_engine/rules';
+import { TimelineInput } from '../../../common/search_strategy';
 
 interface RequestPostTimeline {
   timeline: TimelineInput;
@@ -52,12 +62,24 @@ interface RequestPatchTimeline<T = string> extends RequestPostTimeline {
 
 type RequestPersistTimeline = RequestPostTimeline & Partial<RequestPatchTimeline<null | string>>;
 
-const decodeTimelineResponse = (respTimeline?: TimelineResponse) =>
+const decodeTimelineResponse = (respTimeline?: TimelineResponse | TimelineErrorResponse) =>
   pipe(
     TimelineResponseType.decode(respTimeline),
     fold(throwErrors(createToasterPlainError), identity)
   );
 
+const decodeSingleTimelineResponse = (respTimeline?: SingleTimelineResponse) =>
+  pipe(
+    SingleTimelineResponseType.decode(respTimeline),
+    fold(throwErrors(createToasterPlainError), identity)
+  );
+
+const decodeAllTimelinesResponse = (respTimeline: AllTimelinesResponse) =>
+  pipe(
+    allTimelinesResponse.decode(respTimeline),
+    fold(throwErrors(createToasterPlainError), identity)
+  );
+
 const decodeTimelineErrorResponse = (respTimeline?: TimelineErrorResponse) =>
   pipe(
     TimelineErrorResponseType.decode(respTimeline),
@@ -70,10 +92,25 @@ const decodePrepackedTimelineResponse = (respTimeline?: ImportTimelineResultSche
     fold(throwErrors(createToasterPlainError), identity)
   );
 
-const postTimeline = async ({ timeline }: RequestPostTimeline): Promise<TimelineResponse> => {
+const decodeResponseFavoriteTimeline = (respTimeline?: ResponseFavoriteTimeline) =>
+  pipe(
+    responseFavoriteTimeline.decode(respTimeline),
+    fold(throwErrors(createToasterPlainError), identity)
+  );
+
+const postTimeline = async ({
+  timeline,
+}: RequestPostTimeline): Promise<TimelineResponse | TimelineErrorResponse> => {
+  let requestBody;
+  try {
+    requestBody = JSON.stringify({ timeline });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
+
   const response = await KibanaServices.get().http.post<TimelineResponse>(TIMELINE_URL, {
     method: 'POST',
-    body: JSON.stringify({ timeline }),
+    body: requestBody,
   });
 
   return decodeTimelineResponse(response);
@@ -85,10 +122,16 @@ const patchTimeline = async ({
   version,
 }: RequestPatchTimeline): Promise<TimelineResponse | TimelineErrorResponse> => {
   let response = null;
+  let requestBody = null;
+  try {
+    requestBody = JSON.stringify({ timeline, timelineId, version });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
   try {
     response = await KibanaServices.get().http.patch<TimelineResponse>(TIMELINE_URL, {
       method: 'PATCH',
-      body: JSON.stringify({ timeline, timelineId, version }),
+      body: requestBody,
     });
   } catch (err) {
     // For Future developer
@@ -106,12 +149,13 @@ export const persistTimeline = async ({
 }: RequestPersistTimeline): Promise<TimelineResponse | TimelineErrorResponse> => {
   try {
     if (isEmpty(timelineId) && timeline.status === TimelineStatus.draft && timeline) {
-      const draftTimeline = await cleanDraftTimeline({
+      const temp: TimelineResponse | TimelineErrorResponse = await cleanDraftTimeline({
         timelineType: timeline.timelineType!,
         templateTimelineId: timeline.templateTimelineId ?? undefined,
         templateTimelineVersion: timeline.templateTimelineVersion ?? undefined,
       });
 
+      const draftTimeline = decodeTimelineResponse(temp);
       const templateTimelineInfo =
         timeline.timelineType! === TimelineType.template
           ? {
@@ -182,11 +226,16 @@ export const exportSelectedTimeline: ExportSelectedData = ({
   filename = `timelines_export.ndjson`,
   ids = [],
   signal,
-}): Promise<Blob> => {
-  const body = ids.length > 0 ? JSON.stringify({ ids }) : undefined;
+}): Promise<Blob | TimelineErrorResponse> => {
+  let requestBody;
+  try {
+    requestBody = ids.length > 0 ? JSON.stringify({ ids }) : undefined;
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
   return KibanaServices.get().http.fetch<Blob>(`${TIMELINE_EXPORT_URL}`, {
     method: 'POST',
-    body,
+    body: requestBody,
     query: {
       file_name: filename,
     },
@@ -216,7 +265,8 @@ export const cleanDraftTimeline = async ({
   timelineType: TimelineType;
   templateTimelineId?: string;
   templateTimelineVersion?: number;
-}): Promise<TimelineResponse> => {
+}): Promise<TimelineResponse | TimelineErrorResponse> => {
+  let requestBody;
   const templateTimelineInfo =
     timelineType === TimelineType.template
       ? {
@@ -224,11 +274,16 @@ export const cleanDraftTimeline = async ({
           templateTimelineVersion,
         }
       : {};
-  const response = await KibanaServices.get().http.post<TimelineResponse>(TIMELINE_DRAFT_URL, {
-    body: JSON.stringify({
+  try {
+    requestBody = JSON.stringify({
       timelineType,
       ...templateTimelineInfo,
-    }),
+    });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
+  const response = await KibanaServices.get().http.post<TimelineResponse>(TIMELINE_DRAFT_URL, {
+    body: requestBody,
   });
 
   return decodeTimelineResponse(response);
@@ -242,3 +297,94 @@ export const installPrepackedTimelines = async (): Promise<ImportTimelineResultS
 
   return decodePrepackedTimelineResponse(response);
 };
+
+export const getTimeline = async (id: string) => {
+  const response = await KibanaServices.get().http.get<SingleTimelineResponse>(TIMELINE_URL, {
+    query: {
+      id,
+    },
+  });
+
+  return decodeSingleTimelineResponse(response);
+};
+
+export const getTimelineTemplate = async (templateTimelineId: string) => {
+  const response = await KibanaServices.get().http.get<SingleTimelineResponse>(TIMELINE_URL, {
+    query: {
+      template_timeline_id: templateTimelineId,
+    },
+  });
+
+  return decodeSingleTimelineResponse(response);
+};
+
+export const getAllTimelines = async (args: GetTimelinesArgs, abortSignal: AbortSignal) => {
+  const response = await KibanaServices.get().http.fetch<AllTimelinesResponse>(TIMELINES_URL, {
+    method: 'GET',
+    query: {
+      ...(args.onlyUserFavorite ? { only_user_favorite: args.onlyUserFavorite } : {}),
+      ...(args?.pageInfo?.pageSize ? { page_size: args.pageInfo.pageSize } : {}),
+      ...(args?.pageInfo?.pageIndex ? { page_index: args.pageInfo.pageIndex } : {}),
+      ...(args.search ? { search: args.search } : {}),
+      ...(args?.sort?.sortField ? { sort_field: args?.sort?.sortField } : {}),
+      ...(args?.sort?.sortOrder ? { sort_order: args?.sort?.sortOrder } : {}),
+      ...(args.status ? { status: args.status } : {}),
+      ...(args.timelineType ? { timeline_type: args.timelineType } : {}),
+    },
+    signal: abortSignal,
+  });
+
+  return decodeAllTimelinesResponse(response);
+};
+
+export const persistFavorite = async ({
+  timelineId,
+  templateTimelineId,
+  templateTimelineVersion,
+  timelineType,
+}: {
+  timelineId?: string | null;
+  templateTimelineId?: string | null;
+  templateTimelineVersion?: number | null;
+  timelineType: TimelineType;
+}) => {
+  let requestBody;
+
+  try {
+    requestBody = JSON.stringify({
+      timelineId,
+      templateTimelineId,
+      templateTimelineVersion,
+      timelineType,
+    });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
+
+  const response = await KibanaServices.get().http.patch<ResponseFavoriteTimeline>(
+    TIMELINE_FAVORITE_URL,
+    {
+      method: 'PATCH',
+      body: requestBody,
+    }
+  );
+
+  return decodeResponseFavoriteTimeline(response);
+};
+
+export const deleteTimelinesByIds = async (savedObjectIds: string[]) => {
+  let requestBody;
+
+  try {
+    requestBody = JSON.stringify({
+      savedObjectIds,
+    });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
+  const response = await KibanaServices.get().http.delete<boolean>(TIMELINE_URL, {
+    method: 'DELETE',
+    body: requestBody,
+  });
+  return response;
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/favorite/persist.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/favorite/persist.gql_query.ts
deleted file mode 100644
index f0e31b43af038d..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/containers/favorite/persist.gql_query.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const persistTimelineFavoriteMutation = gql`
-  mutation PersistTimelineFavoriteMutation(
-    $timelineId: ID
-    $templateTimelineId: String
-    $templateTimelineVersion: Int
-    $timelineType: TimelineType!
-  ) {
-    persistFavorite(
-      timelineId: $timelineId
-      templateTimelineId: $templateTimelineId
-      templateTimelineVersion: $templateTimelineVersion
-      timelineType: $timelineType
-    ) {
-      savedObjectId
-      version
-      favorite {
-        fullName
-        userName
-        favoriteDate
-      }
-      templateTimelineId
-      templateTimelineVersion
-      timelineType
-    }
-  }
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
index 5f464b5ed943f8..83b511f95bc2a0 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
@@ -16,7 +16,6 @@ import { isCompleteResponse, isErrorResponse } from '../../../../../../src/plugi
 import { inputsModel, KueryFilterQueryKind } from '../../common/store';
 import { useKibana } from '../../common/lib/kibana';
 import { createFilter } from '../../common/containers/helpers';
-import { DocValueFields } from '../../common/containers/query_template';
 import { timelineActions } from '../../timelines/store/timeline';
 import { detectionsTimelineIds, skipQueryForDetectionsPage } from './helpers';
 import { getInspectResponse } from '../../helpers';
@@ -29,6 +28,7 @@ import {
   TimelineEdges,
   TimelineItem,
   TimelineRequestSortField,
+  DocValueFields,
 } from '../../../common/search_strategy';
 import { InspectResponse } from '../../types';
 import * as i18n from './translations';
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/notes/api.ts b/x-pack/plugins/security_solution/public/timelines/containers/notes/api.ts
new file mode 100644
index 00000000000000..53c54f915cb8ab
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/notes/api.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { NOTE_URL } from '../../../../common/constants';
+import { NoteSavedObject, SavedNote } from '../../../../common/types/timeline/note';
+import { KibanaServices } from '../../../common/lib/kibana';
+
+export const persistNote = async ({
+  note,
+  noteId,
+  version,
+  overrideOwner,
+}: {
+  note: SavedNote;
+  noteId?: string | null;
+  version?: string | null;
+  overrideOwner?: boolean;
+}) => {
+  let requestBody;
+
+  try {
+    requestBody = JSON.stringify({ noteId, version, note, overrideOwner });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
+  const response = await KibanaServices.get().http.patch<NoteSavedObject[]>(NOTE_URL, {
+    method: 'PATCH',
+    body: requestBody,
+  });
+  return response;
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/notes/persist.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/notes/persist.gql_query.ts
deleted file mode 100644
index 5fa0d213cbd895..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/containers/notes/persist.gql_query.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const persistTimelineNoteMutation = gql`
-  mutation PersistTimelineNoteMutation($noteId: ID, $version: String, $note: NoteInput!) {
-    persistNote(noteId: $noteId, version: $version, note: $note) {
-      code
-      message
-      note {
-        eventId
-        note
-        timelineId
-        timelineVersion
-        noteId
-        created
-        createdBy
-        updated
-        updatedBy
-        version
-      }
-    }
-  }
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/one/index.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/one/index.gql_query.ts
deleted file mode 100644
index 97bae5717c7d63..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/containers/one/index.gql_query.ts
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const oneTimelineQuery = gql`
-  query GetOneTimeline($id: ID!, $timelineType: TimelineType) {
-    getOneTimeline(id: $id, timelineType: $timelineType) {
-      savedObjectId
-      columns {
-        aggregatable
-        category
-        columnHeaderType
-        description
-        example
-        indexes
-        id
-        name
-        searchable
-        type
-      }
-      dataProviders {
-        id
-        name
-        enabled
-        excluded
-        kqlQuery
-        type
-        queryMatch {
-          field
-          displayField
-          value
-          displayValue
-          operator
-        }
-        and {
-          id
-          name
-          enabled
-          excluded
-          kqlQuery
-          type
-          queryMatch {
-            field
-            displayField
-            value
-            displayValue
-            operator
-          }
-        }
-      }
-      dateRange {
-        start
-        end
-      }
-      description
-      eqlOptions {
-        eventCategoryField
-        tiebreakerField
-        timestampField
-        query
-        size
-      }
-      eventType
-      eventIdToNoteIds {
-        eventId
-        note
-        timelineId
-        noteId
-        created
-        createdBy
-        timelineVersion
-        updated
-        updatedBy
-        version
-      }
-      excludedRowRendererIds
-      favorite {
-        fullName
-        userName
-        favoriteDate
-      }
-      filters {
-        meta {
-          alias
-          controlledBy
-          disabled
-          field
-          formattedValue
-          index
-          key
-          negate
-          params
-          type
-          value
-        }
-        query
-        exists
-        match_all
-        missing
-        range
-        script
-      }
-      kqlMode
-      kqlQuery {
-        filterQuery {
-          kuery {
-            kind
-            expression
-          }
-          serializedQuery
-        }
-      }
-      indexNames
-      notes {
-        eventId
-        note
-        timelineId
-        timelineVersion
-        noteId
-        created
-        createdBy
-        updated
-        updatedBy
-        version
-      }
-      noteIds
-      pinnedEventIds
-      pinnedEventsSaveObject {
-        pinnedEventId
-        eventId
-        timelineId
-        created
-        createdBy
-        updated
-        updatedBy
-        version
-      }
-      status
-      title
-      timelineType
-      templateTimelineId
-      templateTimelineVersion
-      savedQueryId
-      sort
-      created
-      createdBy
-      updated
-      updatedBy
-      version
-    }
-  }
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/persist.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/persist.gql_query.ts
deleted file mode 100644
index ef050d806a9f24..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/containers/persist.gql_query.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const persistTimelineMutation = gql`
-  mutation PersistTimelineMutation($timelineId: ID, $version: String, $timeline: TimelineInput!) {
-    persistTimeline(id: $timelineId, version: $version, timeline: $timeline) {
-      code
-      message
-      timeline {
-        savedObjectId
-        version
-        columns {
-          aggregatable
-          category
-          columnHeaderType
-          description
-          example
-          indexes
-          id
-          name
-          searchable
-          type
-        }
-        dataProviders {
-          id
-          name
-          enabled
-          excluded
-          kqlQuery
-          type
-          queryMatch {
-            field
-            displayField
-            value
-            displayValue
-            operator
-          }
-          and {
-            id
-            name
-            enabled
-            excluded
-            kqlQuery
-            type
-            queryMatch {
-              field
-              displayField
-              value
-              displayValue
-              operator
-            }
-          }
-        }
-        description
-        eventType
-        excludedRowRendererIds
-        favorite {
-          fullName
-          userName
-          favoriteDate
-        }
-        filters {
-          meta {
-            alias
-            controlledBy
-            disabled
-            field
-            formattedValue
-            index
-            key
-            negate
-            params
-            type
-            value
-          }
-          query
-          exists
-          match_all
-          missing
-          range
-          script
-        }
-        kqlMode
-        kqlQuery {
-          filterQuery {
-            kuery {
-              kind
-              expression
-            }
-            serializedQuery
-          }
-        }
-        indexNames
-        title
-        dateRange {
-          start
-          end
-        }
-        savedQueryId
-        sort
-        created
-        createdBy
-        updated
-        updatedBy
-      }
-    }
-  }
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/pinned_event/api.ts b/x-pack/plugins/security_solution/public/timelines/containers/pinned_event/api.ts
new file mode 100644
index 00000000000000..c43a16df090627
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/pinned_event/api.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { PINNED_EVENT_URL } from '../../../../common/constants';
+import { PinnedEvent } from '../../../../common/types/timeline/pinned_event';
+import { KibanaServices } from '../../../common/lib/kibana';
+
+export const persistPinnedEvent = async ({
+  eventId,
+  pinnedEventId,
+  timelineId,
+}: {
+  eventId: string;
+  pinnedEventId?: string | null;
+  timelineId?: string | null;
+}) => {
+  let requestBody;
+  try {
+    requestBody = JSON.stringify({ eventId, pinnedEventId, timelineId });
+  } catch (err) {
+    return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(err)}`));
+  }
+  const response = await KibanaServices.get().http.patch<PinnedEvent | null>(PINNED_EVENT_URL, {
+    method: 'PATCH',
+    body: requestBody,
+  });
+  return response;
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/pinned_event/persist.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/pinned_event/persist.gql_query.ts
deleted file mode 100644
index 5ac2e367a7ab4f..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/containers/pinned_event/persist.gql_query.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const persistTimelinePinnedEventMutation = gql`
-  mutation PersistTimelinePinnedEventMutation($pinnedEventId: ID, $eventId: ID!, $timelineId: ID) {
-    persistPinnedEventOnTimeline(
-      pinnedEventId: $pinnedEventId
-      eventId: $eventId
-      timelineId: $timelineId
-    ) {
-      pinnedEventId
-      eventId
-      timelineId
-      timelineVersion
-      created
-      createdBy
-      updated
-      updatedBy
-      version
-    }
-  }
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts
index df79ff1d2b309f..7e76f6035f8b53 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts
@@ -7,10 +7,10 @@
 
 import { TimelineType, TimelineStatus, TimelineTabs } from '../../../../common/types/timeline';
 
-import { Direction } from '../../../graphql/types';
 import { defaultHeaders } from '../../components/timeline/body/column_headers/default_headers';
 import { normalizeTimeRange } from '../../../common/components/url_state/normalize_time_range';
 import { SubsetTimelineModel, TimelineModel } from './model';
+import { Direction } from '../../../../common/search_strategy';
 
 // normalizeTimeRange uses getTimeRangeSettings which cannot be used outside Kibana context if the uiSettings is not false
 const { from: start, to: end } = normalizeTimeRange({ from: '', to: '' }, false);
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts
index 0bc1c5d57fa333..c8e8e00caf5300 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts
@@ -6,8 +6,8 @@
  */
 
 import { Filter, esFilters } from '../../../../../../../src/plugins/data/public';
+import { Direction } from '../../../../common/search_strategy';
 import { TimelineType, TimelineStatus, TimelineTabs } from '../../../../common/types/timeline';
-import { Direction } from '../../../graphql/types';
 import { convertTimelineAsInput } from './epic';
 import { TimelineModel } from './model';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
index ac510401fc1867..30d09da2f736da 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
@@ -35,14 +35,14 @@ import {
   Filter,
   MatchAllFilter,
 } from '../../../../../../.../../../src/plugins/data/public';
-import { TimelineStatus, TimelineErrorResponse } from '../../../../common/types/timeline';
-import { inputsModel } from '../../../common/store/inputs';
 import {
+  TimelineStatus,
+  TimelineErrorResponse,
   TimelineType,
-  TimelineInput,
   ResponseTimeline,
   TimelineResult,
-} from '../../../graphql/types';
+} from '../../../../common/types/timeline';
+import { inputsModel } from '../../../common/store/inputs';
 import { addError } from '../../../common/store/app/actions';
 
 import { persistTimeline } from '../../containers/api';
@@ -89,6 +89,7 @@ import { isNotNull } from './helpers';
 import { dispatcherTimelinePersistQueue } from './epic_dispatcher_timeline_persistence_queue';
 import { myEpicTimelineId } from './my_epic_timeline_id';
 import { ActionTimeline, TimelineEpicDependencies } from './types';
+import { TimelineInput } from '../../../../common/search_strategy';
 
 const timelineActionsType = [
   applyKqlFilterQuery.type,
@@ -133,7 +134,6 @@ export const createTimelineEpic = <State>(): Epic<
     selectNotesByIdSelector,
     timelineByIdSelector,
     timelineTimeRangeSelector,
-    apolloClient$,
     kibana$,
   }
 ) => {
@@ -195,8 +195,8 @@ export const createTimelineEpic = <State>(): Epic<
     ),
     dispatcherTimelinePersistQueue.pipe(
       delay(500),
-      withLatestFrom(timeline$, apolloClient$, notes$, timelineTimeRange$),
-      concatMap(([objAction, timeline, apolloClient, notes, timelineTimeRange]) => {
+      withLatestFrom(timeline$, notes$, timelineTimeRange$),
+      concatMap(([objAction, timeline, notes, timelineTimeRange]) => {
         const action: ActionTimeline = get('action', objAction);
         const timelineId = myEpicTimelineId.getTimelineId();
         const version = myEpicTimelineId.getTimelineVersion();
@@ -205,7 +205,6 @@ export const createTimelineEpic = <State>(): Epic<
 
         if (timelineNoteActionsType.includes(action.type)) {
           return epicPersistNote(
-            apolloClient,
             action,
             timeline,
             notes,
@@ -215,17 +214,9 @@ export const createTimelineEpic = <State>(): Epic<
             allTimelineQuery$
           );
         } else if (timelinePinnedEventActionsType.includes(action.type)) {
-          return epicPersistPinnedEvent(
-            apolloClient,
-            action,
-            timeline,
-            action$,
-            timeline$,
-            allTimelineQuery$
-          );
+          return epicPersistPinnedEvent(action, timeline, action$, timeline$, allTimelineQuery$);
         } else if (timelineFavoriteActionsType.includes(action.type)) {
           return epicPersistTimelineFavorite(
-            apolloClient,
             action,
             timeline,
             action$,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_favorite.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_favorite.ts
index 0e1ebf6b246e2f..ae314f54715cd2 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_favorite.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_favorite.ts
@@ -5,16 +5,12 @@
  * 2.0.
  */
 
-import { NormalizedCacheObject } from 'apollo-cache-inmemory';
-import { ApolloClient } from 'apollo-client';
 import { get } from 'lodash/fp';
 import { Action } from 'redux';
 import { Epic } from 'redux-observable';
 import { from, Observable, empty } from 'rxjs';
 import { filter, mergeMap, withLatestFrom, startWith, takeUntil } from 'rxjs/operators';
 
-import { persistTimelineFavoriteMutation } from '../../containers/favorite/persist.gql_query';
-import { PersistTimelineFavoriteMutation, ResponseFavoriteTimeline } from '../../../graphql/types';
 import { addError } from '../../../common/store/app/actions';
 import {
   endTimelineSaving,
@@ -24,16 +20,15 @@ import {
   showCallOutUnauthorizedMsg,
 } from './actions';
 import { dispatcherTimelinePersistQueue } from './epic_dispatcher_timeline_persistence_queue';
-import { refetchQueries } from './refetch_queries';
 import { myEpicTimelineId } from './my_epic_timeline_id';
 import { ActionTimeline, TimelineById } from './types';
 import { inputsModel } from '../../../common/store/inputs';
-import { TimelineType } from '../../../../common/types/timeline';
+import { ResponseFavoriteTimeline, TimelineType } from '../../../../common/types/timeline';
+import { persistFavorite } from '../../containers/api';
 
 export const timelineFavoriteActionsType = [updateIsFavorite.type];
 
 export const epicPersistTimelineFavorite = (
-  apolloClient: ApolloClient<NormalizedCacheObject>,
   action: ActionTimeline,
   timeline: TimelineById,
   action$: Observable<Action>,
@@ -42,19 +37,11 @@ export const epicPersistTimelineFavorite = (
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ): Observable<any> =>
   from(
-    apolloClient.mutate<
-      PersistTimelineFavoriteMutation.Mutation,
-      PersistTimelineFavoriteMutation.Variables
-    >({
-      mutation: persistTimelineFavoriteMutation,
-      fetchPolicy: 'no-cache',
-      variables: {
-        timelineId: myEpicTimelineId.getTimelineId(),
-        templateTimelineId: timeline[action.payload.id].templateTimelineId,
-        templateTimelineVersion: timeline[action.payload.id].templateTimelineVersion,
-        timelineType: timeline[action.payload.id].timelineType ?? TimelineType.default,
-      },
-      refetchQueries,
+    persistFavorite({
+      timelineId: myEpicTimelineId.getTimelineId(),
+      templateTimelineId: timeline[action.payload.id].templateTimelineId,
+      templateTimelineVersion: timeline[action.payload.id].templateTimelineVersion,
+      timelineType: timeline[action.payload.id].timelineType ?? TimelineType.default,
     })
   ).pipe(
     withLatestFrom(timeline$, allTimelineQuery$),
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
index 0b70ba8991686c..01bc589393d2e0 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
@@ -14,7 +14,6 @@ import '../../../common/mock/match_media';
 import {
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
-  apolloClientObservable,
   TestProviders,
   defaultHeaders,
   createSecuritySolutionStorageMock,
@@ -38,11 +37,11 @@ import {
 import { defaultRowRenderers } from '../../components/timeline/body/renderers';
 import { mockDataProviders } from '../../components/timeline/data_providers/mock/mock_data_providers';
 import { Sort } from '../../components/timeline/body/sort';
-import { Direction } from '../../../graphql/types';
 
 import { addTimelineInStorage } from '../../containers/local_storage';
 import { isPageTimeline } from './epic_local_storage';
 import { TimelineId, TimelineStatus, TimelineTabs } from '../../../../common/types/timeline';
+import { Direction } from '../../../../common/search_strategy';
 
 jest.mock('../../containers/local_storage');
 
@@ -51,13 +50,7 @@ const addTimelineInStorageMock = addTimelineInStorage as jest.Mock;
 describe('epicLocalStorage', () => {
   const state: State = mockGlobalState;
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(
-    state,
-    SUB_PLUGINS_REDUCER,
-    apolloClientObservable,
-    kibanaObservable,
-    storage
-  );
+  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   let props = {} as QueryTabContentComponentProps;
   const sort: Sort[] = [
@@ -71,13 +64,7 @@ describe('epicLocalStorage', () => {
   const endDate = '2018-03-24T03:33:52.253Z';
 
   beforeEach(() => {
-    store = createStore(
-      state,
-      SUB_PLUGINS_REDUCER,
-      apolloClientObservable,
-      kibanaObservable,
-      storage
-    );
+    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     props = {
       columns: defaultHeaders,
       dataProviders: mockDataProviders,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_note.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_note.ts
index a2d64deb4c66c1..974bd9d998c0a0 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_note.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_note.ts
@@ -5,16 +5,12 @@
  * 2.0.
  */
 
-import { ApolloClient } from 'apollo-client';
-import { NormalizedCacheObject } from 'apollo-cache-inmemory';
 import { get } from 'lodash/fp';
 import { Action } from 'redux';
 import { Epic } from 'redux-observable';
 import { from, empty, Observable } from 'rxjs';
 import { filter, mergeMap, switchMap, withLatestFrom, startWith, takeUntil } from 'rxjs/operators';
 
-import { persistTimelineNoteMutation } from '../../../timelines/containers/notes/persist.gql_query';
-import { PersistTimelineNoteMutation, ResponseNote } from '../../../graphql/types';
 import { updateNote, addError } from '../../../common/store/app/actions';
 import { NotesById } from '../../../common/store/app/model';
 import { inputsModel } from '../../../common/store/inputs';
@@ -28,14 +24,14 @@ import {
   showCallOutUnauthorizedMsg,
 } from './actions';
 import { myEpicTimelineId } from './my_epic_timeline_id';
-import { refetchQueries } from './refetch_queries';
 import { dispatcherTimelinePersistQueue } from './epic_dispatcher_timeline_persistence_queue';
 import { ActionTimeline, TimelineById } from './types';
+import { persistNote } from '../../containers/notes/api';
+import { ResponseNote } from '../../../../common/types/timeline/note';
 
 export const timelineNoteActionsType = [addNote.type, addNoteToEvent.type];
 
 export const epicPersistNote = (
-  apolloClient: ApolloClient<NormalizedCacheObject>,
   action: ActionTimeline,
   timeline: TimelineById,
   notes: NotesById,
@@ -46,22 +42,14 @@ export const epicPersistNote = (
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ): Observable<any> =>
   from(
-    apolloClient.mutate<
-      PersistTimelineNoteMutation.Mutation,
-      PersistTimelineNoteMutation.Variables
-    >({
-      mutation: persistTimelineNoteMutation,
-      fetchPolicy: 'no-cache',
-      variables: {
-        noteId: null,
-        version: null,
-        note: {
-          eventId: action.payload.eventId,
-          note: getNote(action.payload.noteId, notes),
-          timelineId: myEpicTimelineId.getTimelineId(),
-        },
+    persistNote({
+      noteId: null,
+      version: null,
+      note: {
+        eventId: action.payload.eventId,
+        note: getNote(action.payload.noteId, notes),
+        timelineId: myEpicTimelineId.getTimelineId(),
       },
-      refetchQueries,
     })
   ).pipe(
     withLatestFrom(timeline$, notes$, allTimelineQuery$),
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_pinned_event.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_pinned_event.ts
index bd5cf879d47efc..c6c348615af276 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_pinned_event.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_pinned_event.ts
@@ -5,19 +5,15 @@
  * 2.0.
  */
 
-import { NormalizedCacheObject } from 'apollo-cache-inmemory';
-import { ApolloClient } from 'apollo-client';
 import { get, omit } from 'lodash/fp';
 import { Action } from 'redux';
 import { Epic } from 'redux-observable';
 import { from, Observable, empty } from 'rxjs';
 import { filter, mergeMap, startWith, withLatestFrom, takeUntil } from 'rxjs/operators';
 
-import { persistTimelinePinnedEventMutation } from '../../../timelines/containers/pinned_event/persist.gql_query';
-import { PersistTimelinePinnedEventMutation, PinnedEvent } from '../../../graphql/types';
 import { addError } from '../../../common/store/app/actions';
 import { inputsModel } from '../../../common/store/inputs';
-
+import { PinnedEvent } from '../../../../common/types/timeline/pinned_event';
 import {
   pinEvent,
   endTimelineSaving,
@@ -27,14 +23,13 @@ import {
   showCallOutUnauthorizedMsg,
 } from './actions';
 import { myEpicTimelineId } from './my_epic_timeline_id';
-import { refetchQueries } from './refetch_queries';
 import { dispatcherTimelinePersistQueue } from './epic_dispatcher_timeline_persistence_queue';
 import { ActionTimeline, TimelineById } from './types';
+import { persistPinnedEvent } from '../../containers/pinned_event/api';
 
 export const timelinePinnedEventActionsType = [pinEvent.type, unPinEvent.type];
 
 export const epicPersistPinnedEvent = (
-  apolloClient: ApolloClient<NormalizedCacheObject>,
   action: ActionTimeline,
   timeline: TimelineById,
   action$: Observable<Action>,
@@ -43,22 +38,13 @@ export const epicPersistPinnedEvent = (
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ): Observable<any> =>
   from(
-    apolloClient.mutate<
-      PersistTimelinePinnedEventMutation.Mutation,
-      PersistTimelinePinnedEventMutation.Variables
-    >({
-      mutation: persistTimelinePinnedEventMutation,
-      fetchPolicy: 'no-cache',
-      variables: {
-        pinnedEventId:
-          timeline[action.payload.id].pinnedEventsSaveObject[action.payload.eventId] != null
-            ? timeline[action.payload.id].pinnedEventsSaveObject[action.payload.eventId]
-                .pinnedEventId
-            : null,
-        eventId: action.payload.eventId,
-        timelineId: myEpicTimelineId.getTimelineId(),
-      },
-      refetchQueries,
+    persistPinnedEvent({
+      pinnedEventId:
+        timeline[action.payload.id].pinnedEventsSaveObject[action.payload.eventId] != null
+          ? timeline[action.payload.id].pinnedEventsSaveObject[action.payload.eventId].pinnedEventId
+          : null,
+      eventId: action.payload.eventId,
+      timelineId: myEpicTimelineId.getTimelineId(),
     })
   ).pipe(
     withLatestFrom(timeline$, allTimelineQuery$),
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
index a899994ad4aab9..faece61cf9b7ec 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
@@ -9,7 +9,6 @@ import { Filter, IFieldSubType } from '../../../../../../../src/plugins/data/pub
 
 import { DataProvider } from '../../components/timeline/data_providers/data_provider';
 import { Sort } from '../../components/timeline/body/sort';
-import { PinnedEvent } from '../../../graphql/types';
 import {
   EqlOptionsSelected,
   TimelineNonEcsData,
@@ -23,6 +22,7 @@ import type {
   RowRendererId,
   TimelineTabs,
 } from '../../../../common/types/timeline';
+import { PinnedEvent } from '../../../../common/types/timeline/pinned_event';
 
 export const DEFAULT_PAGE_COUNT = 2; // Eui Pager will not render unless this is a minimum of 2 pages
 export type KqlMode = 'filter' | 'search';
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
index e464637c469f86..d467747346b8b1 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
@@ -22,7 +22,6 @@ import {
 import { defaultColumnHeaderType } from '../../../timelines/components/timeline/body/column_headers/default_headers';
 import { DEFAULT_COLUMN_MIN_WIDTH } from '../../../timelines/components/timeline/body/constants';
 import { getColumnWidthFromType } from '../../../timelines/components/timeline/body/column_headers/helpers';
-import { Direction } from '../../../graphql/types';
 import { defaultHeaders } from '../../../common/mock';
 
 import {
@@ -49,6 +48,7 @@ import {
 import { ColumnHeaderOptions, TimelineModel } from './model';
 import { timelineDefaults } from './defaults';
 import { TimelineById } from './types';
+import { Direction } from '../../../../common/search_strategy';
 
 jest.mock('../../../common/components/url_state/normalize_time_range.ts');
 jest.mock('../../../common/utils/default_date_settings', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/refetch_queries.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/refetch_queries.ts
deleted file mode 100644
index 962b809caf884a..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/refetch_queries.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { allTimelinesQuery } from '../../../timelines/containers/all/index.gql_query';
-import { Direction } from '../../../graphql/types';
-import { DEFAULT_SORT_FIELD } from '../../../timelines/components/open_timeline/constants';
-
-export const refetchQueries = [
-  {
-    query: allTimelinesQuery,
-    variables: {
-      search: '',
-      pageInfo: {
-        pageIndex: 1,
-        pageSize: 10,
-      },
-      sort: { sortField: DEFAULT_SORT_FIELD, sortOrder: Direction.desc },
-      onlyUserFavorite: false,
-    },
-  },
-];
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
index d227c496610c35..d4a96d036bd5f0 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
@@ -9,7 +9,6 @@ import { Action } from 'redux';
 import { Observable } from 'rxjs';
 
 import { Storage } from '../../../../../../../src/plugins/kibana_utils/public';
-import { AppApolloClient } from '../../../common/lib/lib';
 import { inputsModel } from '../../../common/store/inputs';
 import { NotesById } from '../../../common/store/app/model';
 
@@ -56,7 +55,6 @@ export interface TimelineEpicDependencies<State> {
   timelineTimeRangeSelector: (state: State) => inputsModel.TimeRange;
   selectAllTimelineQuery: () => (state: State, id: string) => inputsModel.GlobalQuery;
   selectNotesByIdSelector: (state: State) => NotesById;
-  apolloClient$: Observable<AppApolloClient>;
   kibana$: Observable<CoreStart>;
   storage: Storage;
 }
diff --git a/x-pack/plugins/security_solution/public/types.ts b/x-pack/plugins/security_solution/public/types.ts
index e88077679e1b62..7b9cd2f6e1db59 100644
--- a/x-pack/plugins/security_solution/public/types.ts
+++ b/x-pack/plugins/security_solution/public/types.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { AppFrontendLibs } from './common/lib/lib';
 import { CoreStart } from '../../../../src/core/public';
 import { HomePublicPluginSetup } from '../../../../src/plugins/home/public';
 import { DataPublicPluginStart } from '../../../../src/plugins/data/public';
@@ -71,7 +70,7 @@ export interface PluginSetup {
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface PluginStart {}
 
-export interface AppObservableLibs extends AppFrontendLibs {
+export interface AppObservableLibs {
   kibana: CoreStart;
 }
 
diff --git a/x-pack/plugins/security_solution/scripts/combined_schema.ts b/x-pack/plugins/security_solution/scripts/combined_schema.ts
deleted file mode 100644
index d6b401f58c8539..00000000000000
--- a/x-pack/plugins/security_solution/scripts/combined_schema.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { buildSchemaFromTypeDefinitions } from 'graphql-tools';
-
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { schemas as serverSchemas } from '../server/graphql';
-
-export const schemas = [...serverSchemas];
-
-// this default export is used to feed the combined types to the gql-gen tool
-// which generates the corresponding typescript types
-// eslint-disable-next-line import/no-default-export
-export default buildSchemaFromTypeDefinitions(schemas);
diff --git a/x-pack/plugins/security_solution/scripts/generate_types_from_graphql.js b/x-pack/plugins/security_solution/scripts/generate_types_from_graphql.js
deleted file mode 100644
index 3d371333eea8ef..00000000000000
--- a/x-pack/plugins/security_solution/scripts/generate_types_from_graphql.js
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-require('../../../../src/setup_node_env');
-
-const { join, resolve } = require('path');
-// eslint-disable-next-line import/no-extraneous-dependencies, import/no-unresolved
-const { generate } = require('graphql-code-generator');
-
-const GRAPHQL_GLOBS = [
-  join('public', '**', '*.gql_query.ts{,x}'),
-  join('common', 'graphql', '**', '*.gql_query.ts{,x}'),
-];
-const OUTPUT_INTROSPECTION_PATH = resolve('public', 'graphql', 'introspection.json');
-const OUTPUT_CLIENT_TYPES_PATH = resolve('public', 'graphql', 'types.ts');
-const OUTPUT_SERVER_TYPES_PATH = resolve('server', 'graphql', 'types.ts');
-const SCHEMA_PATH = resolve(__dirname, 'combined_schema.ts');
-
-async function main() {
-  await generate(
-    {
-      schema: SCHEMA_PATH,
-      overwrite: true,
-      generates: {
-        [OUTPUT_INTROSPECTION_PATH]: {
-          documents: GRAPHQL_GLOBS,
-          primitives: {
-            String: 'string',
-            Int: 'number',
-            Float: 'number',
-            Boolean: 'boolean',
-            ID: 'string',
-          },
-          config: {
-            namingConvention: {
-              typeNames: 'change-case#pascalCase',
-              enumValues: 'keep',
-            },
-            contextType: 'SiemContext',
-            scalars: {
-              ToStringArray: 'string[] | string',
-              ToNumberArray: 'number[] | number',
-              ToDateArray: 'string[] | string',
-              ToBooleanArray: 'boolean[] | boolean',
-              Date: 'string',
-            },
-          },
-          plugins: ['introspection'],
-        },
-        [OUTPUT_CLIENT_TYPES_PATH]: {
-          documents: GRAPHQL_GLOBS,
-          primitives: {
-            String: 'string',
-            Int: 'number',
-            Float: 'number',
-            Boolean: 'boolean',
-            ID: 'string',
-          },
-          config: {
-            avoidOptionals: false,
-            namingConvention: {
-              typeNames: 'change-case#pascalCase',
-              enumValues: 'keep',
-            },
-            contextType: 'SiemContext',
-            scalars: {
-              ToStringArray: 'string[]',
-              ToNumberArray: 'number[]',
-              ToDateArray: 'string[]',
-              ToBooleanArray: 'boolean[]',
-              Date: 'string',
-            },
-          },
-          plugins: [
-            {
-              add: `/* tslint:disable */
-                    /* eslint-disable */
-                    /*
-                    * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-                    * or more contributor license agreements. Licensed under the Elastic License
-                    * 2.0; you may not use this file except in compliance with the Elastic License
-                    * 2.0.
-                    */
-                  `,
-            },
-            'typescript-common',
-            'typescript-server',
-            'typescript-client',
-          ],
-        },
-        [OUTPUT_SERVER_TYPES_PATH]: {
-          primitives: {
-            String: 'string',
-            Int: 'number',
-            Float: 'number',
-            Boolean: 'boolean',
-            ID: 'string',
-          },
-          config: {
-            avoidOptionals: false,
-            namingConvention: {
-              typeNames: 'change-case#pascalCase',
-              enumValues: 'keep',
-            },
-            contextType: 'SiemContext',
-            scalars: {
-              ToStringArray: 'string[] | string',
-              ToNumberArray: 'number[] | number',
-              ToDateArray: 'string[] | string',
-              ToBooleanArray: 'boolean[] | boolean',
-              Date: 'string',
-            },
-          },
-          plugins: [
-            {
-              add: `
-                /* tslint:disable */
-                /* eslint-disable */
-                /*
-                * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-                * or more contributor license agreements. Licensed under the Elastic License
-                * 2.0; you may not use this file except in compliance with the Elastic License
-                * 2.0.
-                */
-
-                import { SiemContext } from '../lib/types';
-                `,
-            },
-            'typescript-common',
-            'typescript-server',
-            'typescript-resolvers',
-          ],
-        },
-      },
-    },
-    true
-  );
-}
-
-if (require.main === module) {
-  main();
-}
diff --git a/x-pack/plugins/security_solution/server/graphql/ecs/index.ts b/x-pack/plugins/security_solution/server/graphql/ecs/index.ts
deleted file mode 100644
index 2c534d979a9256..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/ecs/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { ecsSchema } from './schema.gql';
-export { createScalarToStringArrayValueResolvers } from './resolvers';
diff --git a/x-pack/plugins/security_solution/server/graphql/ecs/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/ecs/resolvers.ts
deleted file mode 100644
index de9daf1178ad2c..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/ecs/resolvers.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLScalarType, Kind } from 'graphql';
-import { isBoolean, isNumber, isObject } from 'lodash/fp';
-
-/*
- *  serialize: gets invoked when serializing the result to send it back to a client.
- *
- *  parseValue: gets invoked to parse client input that was passed through variables.
- *
- *  parseLiteral: gets invoked to parse client input that was passed inline in the query.
- */
-
-export const toStringArrayScalar = new GraphQLScalarType({
-  name: 'StringArray',
-  description: 'Represents value in detail item from the timeline who wants to more than one type',
-  serialize(value): string[] | null {
-    if (value == null) {
-      return null;
-    } else if (Array.isArray(value)) {
-      return convertArrayToString(value) as string[];
-    } else if (isBoolean(value) || isNumber(value) || isObject(value)) {
-      return [convertToString(value)];
-    }
-    return [value];
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.INT:
-        return parseInt(ast.value, 10);
-      case Kind.FLOAT:
-        return parseFloat(ast.value);
-      case Kind.STRING:
-        return ast.value;
-      case Kind.LIST:
-        return ast.values;
-      case Kind.OBJECT:
-        return ast.fields;
-    }
-    return null;
-  },
-});
-export const toStringArrayNoNullableScalar = new GraphQLScalarType({
-  name: 'StringArray',
-  description: 'Represents value in detail item from the timeline who wants to more than one type',
-  serialize(value): string[] | undefined {
-    if (value == null) {
-      return undefined;
-    } else if (Array.isArray(value)) {
-      return convertArrayToString(value) as string[];
-    } else if (isBoolean(value) || isNumber(value) || isObject(value)) {
-      return [convertToString(value)];
-    }
-    return [value];
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.INT:
-        return parseInt(ast.value, 10);
-      case Kind.FLOAT:
-        return parseFloat(ast.value);
-      case Kind.STRING:
-        return ast.value;
-      case Kind.LIST:
-        return ast.values;
-      case Kind.OBJECT:
-        return ast.fields;
-    }
-    return undefined;
-  },
-});
-export const createScalarToStringArrayValueResolvers = () => ({
-  ToStringArray: toStringArrayScalar,
-  ToStringArrayNoNullable: toStringArrayNoNullableScalar,
-});
-
-const convertToString = (value: object | number | boolean | string): string => {
-  if (isObject(value)) {
-    try {
-      return JSON.stringify(value);
-    } catch (_) {
-      return 'Invalid Object';
-    }
-  }
-  return value.toString();
-};
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const convertArrayToString = (values: any[]): string[] | string => {
-  if (Array.isArray(values)) {
-    return values
-      .filter((item) => item != null)
-      .map((item) => convertArrayToString(item)) as string[];
-  }
-  return convertToString(values);
-};
diff --git a/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
deleted file mode 100644
index 3ae501c5a167df..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts
+++ /dev/null
@@ -1,468 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const ecsSchema = gql`
-  scalar ToStringArray
-  scalar ToStringArrayNoNullable
-
-  type EventEcsFields {
-    action: ToStringArray
-    category: ToStringArray
-    code: ToStringArray
-    created: ToDateArray
-    dataset: ToStringArray
-    duration: ToNumberArray
-    end: ToDateArray
-    hash: ToStringArray
-    id: ToStringArray
-    kind: ToStringArray
-    module: ToStringArray
-    original: ToStringArray
-    outcome: ToStringArray
-    risk_score: ToNumberArray
-    risk_score_norm: ToNumberArray
-    severity: ToNumberArray
-    start: ToDateArray
-    timezone: ToStringArray
-    type: ToStringArray
-  }
-
-  type Location {
-    lon: ToNumberArray
-    lat: ToNumberArray
-  }
-
-  type GeoEcsFields {
-    city_name: ToStringArray
-    continent_name: ToStringArray
-    country_iso_code: ToStringArray
-    country_name: ToStringArray
-    location: Location
-    region_iso_code: ToStringArray
-    region_name: ToStringArray
-  }
-
-  type PrimarySecondary {
-    primary: ToStringArray
-    secondary: ToStringArray
-    type: ToStringArray
-  }
-
-  type Summary {
-    actor: PrimarySecondary
-    object: PrimarySecondary
-    how: ToStringArray
-    message_type: ToStringArray
-    sequence: ToStringArray
-  }
-
-  type AgentEcsField {
-    type: ToStringArray
-  }
-
-  type AuditdData {
-    acct: ToStringArray
-    terminal: ToStringArray
-    op: ToStringArray
-  }
-
-  type AuditdEcsFields {
-    result: ToStringArray
-    session: ToStringArray
-    data: AuditdData
-    summary: Summary
-    sequence: ToStringArray
-  }
-
-  type OsEcsFields {
-    platform: ToStringArray
-    name: ToStringArray
-    full: ToStringArray
-    family: ToStringArray
-    version: ToStringArray
-    kernel: ToStringArray
-  }
-
-  type HostEcsFields {
-    architecture: ToStringArray
-    id: ToStringArray
-    ip: ToStringArray
-    mac: ToStringArray
-    name: ToStringArray
-    os: OsEcsFields
-    type: ToStringArray
-  }
-
-  type Thread {
-    id: ToNumberArray
-    start: ToStringArray
-  }
-
-  type ProcessHashData {
-    md5: ToStringArray
-    sha1: ToStringArray
-    sha256: ToStringArray
-  }
-
-  type ProcessEcsFields {
-    hash: ProcessHashData
-    pid: ToNumberArray
-    name: ToStringArray
-    ppid: ToNumberArray
-    args: ToStringArray
-    entity_id: ToStringArray
-    executable: ToStringArray
-    title: ToStringArray
-    thread: Thread
-    working_directory: ToStringArray
-  }
-
-  type SourceEcsFields {
-    bytes: ToNumberArray
-    ip: ToStringArray
-    port: ToNumberArray
-    domain: ToStringArray
-    geo: GeoEcsFields
-    packets: ToNumberArray
-  }
-
-  type DestinationEcsFields {
-    bytes: ToNumberArray
-    ip: ToStringArray
-    port: ToNumberArray
-    domain: ToStringArray
-    geo: GeoEcsFields
-    packets: ToNumberArray
-  }
-
-  type DnsQuestionData {
-    name: ToStringArray
-    type: ToStringArray
-  }
-
-  type DnsEcsFields {
-    question: DnsQuestionData
-    resolved_ip: ToStringArray
-    response_code: ToStringArray
-  }
-
-  type EndgameEcsFields {
-    exit_code: ToNumberArray
-    file_name: ToStringArray
-    file_path: ToStringArray
-    logon_type: ToNumberArray
-    parent_process_name: ToStringArray
-    pid: ToNumberArray
-    process_name: ToStringArray
-    subject_domain_name: ToStringArray
-    subject_logon_id: ToStringArray
-    subject_user_name: ToStringArray
-    target_domain_name: ToStringArray
-    target_logon_id: ToStringArray
-    target_user_name: ToStringArray
-  }
-
-  type SuricataAlertData {
-    signature: ToStringArray
-    signature_id: ToNumberArray
-  }
-
-  type SuricataEveData {
-    alert: SuricataAlertData
-    flow_id: ToNumberArray
-    proto: ToStringArray
-  }
-
-  type SuricataEcsFields {
-    eve: SuricataEveData
-  }
-
-  type TlsJa3Data {
-    hash: ToStringArray
-  }
-
-  type FingerprintData {
-    sha1: ToStringArray
-  }
-
-  type TlsClientCertificateData {
-    fingerprint: FingerprintData
-  }
-
-  type TlsServerCertificateData {
-    fingerprint: FingerprintData
-  }
-
-  type TlsFingerprintsData {
-    ja3: TlsJa3Data
-  }
-
-  type TlsEcsFields {
-    client_certificate: TlsClientCertificateData
-    fingerprints: TlsFingerprintsData
-    server_certificate: TlsServerCertificateData
-  }
-
-  type ZeekConnectionData {
-    local_resp: ToBooleanArray
-    local_orig: ToBooleanArray
-    missed_bytes: ToNumberArray
-    state: ToStringArray
-    history: ToStringArray
-  }
-
-  type ZeekNoticeData {
-    suppress_for: ToNumberArray
-    msg: ToStringArray
-    note: ToStringArray
-    sub: ToStringArray
-    dst: ToStringArray
-    dropped: ToBooleanArray
-    peer_descr: ToStringArray
-  }
-
-  type ZeekDnsData {
-    AA: ToBooleanArray
-    qclass_name: ToStringArray
-    RD: ToBooleanArray
-    qtype_name: ToStringArray
-    rejected: ToBooleanArray
-    qtype: ToStringArray
-    query: ToStringArray
-    trans_id: ToNumberArray
-    qclass: ToStringArray
-    RA: ToBooleanArray
-    TC: ToBooleanArray
-  }
-
-  type FileFields {
-    name: ToStringArray
-    path: ToStringArray
-    target_path: ToStringArray
-    extension: ToStringArray
-    type: ToStringArray
-    device: ToStringArray
-    inode: ToStringArray
-    uid: ToStringArray
-    owner: ToStringArray
-    gid: ToStringArray
-    group: ToStringArray
-    mode: ToStringArray
-    size: ToNumberArray
-    mtime: ToDateArray
-    ctime: ToDateArray
-  }
-
-  type ZeekHttpData {
-    resp_mime_types: ToStringArray
-    trans_depth: ToStringArray
-    status_msg: ToStringArray
-    resp_fuids: ToStringArray
-    tags: ToStringArray
-  }
-
-  type HttpBodyData {
-    content: ToStringArray
-    bytes: ToNumberArray
-  }
-
-  type HttpRequestData {
-    method: ToStringArray
-    body: HttpBodyData
-    referrer: ToStringArray
-    bytes: ToNumberArray
-  }
-
-  type HttpResponseData {
-    status_code: ToNumberArray
-    body: HttpBodyData
-    bytes: ToNumberArray
-  }
-
-  type HttpEcsFields {
-    version: ToStringArray
-    request: HttpRequestData
-    response: HttpResponseData
-  }
-
-  type UrlEcsFields {
-    domain: ToStringArray
-    original: ToStringArray
-    username: ToStringArray
-    password: ToStringArray
-  }
-
-  type ZeekFileData {
-    session_ids: ToStringArray
-    timedout: ToBooleanArray
-    local_orig: ToBooleanArray
-    tx_host: ToStringArray
-    source: ToStringArray
-    is_orig: ToBooleanArray
-    overflow_bytes: ToNumberArray
-    sha1: ToStringArray
-    duration: ToNumberArray
-    depth: ToNumberArray
-    analyzers: ToStringArray
-    mime_type: ToStringArray
-    rx_host: ToStringArray
-    total_bytes: ToNumberArray
-    fuid: ToStringArray
-    seen_bytes: ToNumberArray
-    missing_bytes: ToNumberArray
-    md5: ToStringArray
-  }
-
-  type ZeekSslData {
-    cipher: ToStringArray
-    established: ToBooleanArray
-    resumed: ToBooleanArray
-    version: ToStringArray
-  }
-
-  type ZeekEcsFields {
-    session_id: ToStringArray
-    connection: ZeekConnectionData
-    notice: ZeekNoticeData
-    dns: ZeekDnsData
-    http: ZeekHttpData
-    files: ZeekFileData
-    ssl: ZeekSslData
-  }
-
-  type UserEcsFields {
-    domain: ToStringArray
-    id: ToStringArray
-    name: ToStringArray
-    full_name: ToStringArray
-    email: ToStringArray
-    hash: ToStringArray
-    group: ToStringArray
-  }
-
-  type WinlogEcsFields {
-    event_id: ToNumberArray
-  }
-
-  type NetworkEcsField {
-    bytes: ToNumberArray
-    community_id: ToStringArray
-    direction: ToStringArray
-    packets: ToNumberArray
-    protocol: ToStringArray
-    transport: ToStringArray
-  }
-
-  type PackageEcsFields {
-    arch: ToStringArray
-    entity_id: ToStringArray
-    name: ToStringArray
-    size: ToNumberArray
-    summary: ToStringArray
-    version: ToStringArray
-  }
-
-  type AuditEcsFields {
-    package: PackageEcsFields
-  }
-
-  type SshEcsFields {
-    method: ToStringArray
-    signature: ToStringArray
-  }
-
-  type AuthEcsFields {
-    ssh: SshEcsFields
-  }
-
-  type SystemEcsField {
-    audit: AuditEcsFields
-    auth: AuthEcsFields
-  }
-
-  type RuleField {
-    id: ToStringArray
-    rule_id: ToStringArray
-    false_positives: [String!]!
-    saved_id: ToStringArray
-    timeline_id: ToStringArray
-    timeline_title: ToStringArray
-    max_signals: ToNumberArray
-    risk_score: ToStringArray
-    output_index: ToStringArray
-    description: ToStringArray
-    from: ToStringArray
-    immutable: ToBooleanArray
-    index: ToStringArray
-    interval: ToStringArray
-    language: ToStringArray
-    query: ToStringArray
-    references: ToStringArray
-    severity: ToStringArray
-    tags: ToStringArray
-    threat: ToAny
-    type: ToStringArray
-    size: ToStringArray
-    to: ToStringArray
-    enabled: ToBooleanArray
-    filters: ToAny
-    created_at: ToStringArray
-    updated_at: ToStringArray
-    created_by: ToStringArray
-    updated_by: ToStringArray
-    version: ToStringArray
-    note: ToStringArray
-    threshold: ToAny
-    exceptions_list: ToAny
-  }
-
-  type SignalField {
-    rule: RuleField
-    original_time: ToStringArray
-    status: ToStringArray
-  }
-
-  type RuleEcsField {
-    reference: ToStringArray
-  }
-
-  type ECS {
-    _id: String!
-    _index: String
-    agent: AgentEcsField
-    auditd: AuditdEcsFields
-    destination: DestinationEcsFields
-    dns: DnsEcsFields
-    endgame: EndgameEcsFields
-    event: EventEcsFields
-    geo: GeoEcsFields
-    host: HostEcsFields
-    network: NetworkEcsField
-    rule: RuleEcsField
-    signal: SignalField
-    source: SourceEcsFields
-    suricata: SuricataEcsFields
-    tls: TlsEcsFields
-    zeek: ZeekEcsFields
-    http: HttpEcsFields
-    url: UrlEcsFields
-    timestamp: Date
-    message: ToStringArray
-    user: UserEcsFields
-    winlog: WinlogEcsFields
-    process: ProcessEcsFields
-    file: FileFields
-    system: SystemEcsField
-  }
-
-  type EcsEdges {
-    node: ECS!
-    cursor: CursorType!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/hosts/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/hosts/schema.gql.ts
deleted file mode 100644
index c3a5c4e3b23cf1..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/hosts/schema.gql.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const hostsSchema = gql`
-  type OsFields {
-    platform: String
-    name: String
-    full: String
-    family: String
-    version: String
-    kernel: String
-  }
-
-  type HostFields {
-    architecture: String
-    id: String
-    ip: [String]
-    mac: [String]
-    name: String
-    os: OsFields
-    type: String
-  }
-
-  type AgentFields {
-    id: String
-  }
-
-  type CloudInstance {
-    id: [String]
-  }
-
-  type CloudMachine {
-    type: [String]
-  }
-
-  type CloudFields {
-    instance: CloudInstance
-    machine: CloudMachine
-    provider: [String]
-    region: [String]
-  }
-
-  enum HostPolicyResponseActionStatus {
-    success
-    failure
-    warning
-    unsupported
-  }
-
-  type EndpointFields {
-    endpointPolicy: String
-    sensorVersion: String
-    policyStatus: HostPolicyResponseActionStatus
-  }
-
-  type HostItem {
-    _id: String
-    agent: AgentFields
-    cloud: CloudFields
-    endpoint: EndpointFields
-    host: HostEcsFields
-    inspect: Inspect
-    lastSeen: Date
-  }
-
-  type HostsEdges {
-    node: HostItem!
-    cursor: CursorType!
-  }
-
-  type HostsData {
-    edges: [HostsEdges!]!
-    totalCount: Float!
-    pageInfo: PageInfoPaginated!
-    inspect: Inspect
-  }
-
-  type FirstLastSeenHost {
-    inspect: Inspect
-    firstSeen: Date
-    lastSeen: Date
-  }
-
-  enum HostsFields {
-    hostName
-    lastSeen
-  }
-
-  input HostsSortField {
-    field: HostsFields!
-    direction: Direction!
-  }
-
-  extend type Source {
-    "Gets Hosts based on timerange and specified criteria, or all events in the timerange if no criteria is specified"
-    Hosts(
-      id: String
-      timerange: TimerangeInput!
-      pagination: PaginationInputPaginated!
-      sort: HostsSortField!
-      filterQuery: String
-      defaultIndex: [String!]!
-      docValueFields: [docValueFieldsInput!]!
-    ): HostsData!
-    HostOverview(
-      id: String
-      hostName: String!
-      timerange: TimerangeInput!
-      defaultIndex: [String!]!
-    ): HostItem!
-    HostFirstLastSeen(
-      id: String
-      hostName: String!
-      defaultIndex: [String!]!
-      docValueFields: [docValueFieldsInput!]!
-    ): FirstLastSeenHost!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/index.ts b/x-pack/plugins/security_solution/server/graphql/index.ts
deleted file mode 100644
index ba3a1371f1829b..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/index.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { rootSchema } from '../../common/graphql/root';
-import { sharedSchema } from '../../common/graphql/shared';
-
-import { ecsSchema } from './ecs';
-import { dateSchema } from './scalar_date';
-import { noteSchema } from './note';
-import { pinnedEventSchema } from './pinned_event';
-import { toAnySchema } from './scalar_to_any';
-import { toBooleanSchema } from './scalar_to_boolean_array';
-import { toDateSchema } from './scalar_to_date_array';
-import { toNumberSchema } from './scalar_to_number_array';
-import { sourceStatusSchema } from './source_status';
-import { sourcesSchema } from './sources';
-import { timelineSchema } from './timeline';
-export const schemas = [
-  ecsSchema,
-  dateSchema,
-  toAnySchema,
-  toNumberSchema,
-  toDateSchema,
-  toBooleanSchema,
-  noteSchema,
-  pinnedEventSchema,
-  rootSchema,
-  sourcesSchema,
-  sourceStatusSchema,
-  sharedSchema,
-  timelineSchema,
-];
diff --git a/x-pack/plugins/security_solution/server/graphql/note/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/note/resolvers.ts
deleted file mode 100644
index 383522bc06bdd7..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/note/resolvers.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { AppResolverWithFields, AppResolverOf } from '../../lib/framework';
-import { MutationResolvers, QueryResolvers } from '../types';
-import { Notes } from '../../lib/timeline/saved_object/notes';
-
-export type QueryNoteResolver = AppResolverOf<QueryResolvers.GetNoteResolver>;
-
-export type QueryAllNoteResolver = AppResolverWithFields<
-  QueryResolvers.GetAllNotesResolver,
-  'totalCount' | 'Note'
->;
-
-export type QueryNotesByTimelineIdResolver = AppResolverOf<QueryResolvers.GetNotesByTimelineIdResolver>;
-
-export type QueryNotesByEventIdResolver = AppResolverOf<QueryResolvers.GetNotesByEventIdResolver>;
-
-export type MutationNoteResolver = AppResolverOf<
-  MutationResolvers.PersistNoteResolver<QueryNoteResolver>
->;
-
-export type MutationDeleteNoteResolver = AppResolverOf<MutationResolvers.DeleteNoteResolver>;
-
-export type MutationDeleteNoteByTimelineIdResolver = AppResolverOf<MutationResolvers.DeleteNoteByTimelineIdResolver>;
-
-interface NoteResolversDeps {
-  note: Notes;
-}
-
-export const createNoteResolvers = (
-  libs: NoteResolversDeps
-): {
-  Query: {
-    getNote: QueryNoteResolver;
-    getAllNotes: QueryAllNoteResolver;
-    getNotesByEventId: QueryNotesByEventIdResolver;
-    getNotesByTimelineId: QueryNotesByTimelineIdResolver;
-  };
-  Mutation: {
-    deleteNote: MutationDeleteNoteResolver;
-    deleteNoteByTimelineId: MutationDeleteNoteByTimelineIdResolver;
-    persistNote: MutationNoteResolver;
-  };
-} => ({
-  Query: {
-    async getNote(root, args, { req }) {
-      return libs.note.getNote(req, args.id);
-    },
-    async getAllNotes(root, args, { req }) {
-      return libs.note.getAllNotes(
-        req,
-        args.pageInfo || null,
-        args.search || null,
-        args.sort || null
-      );
-    },
-    async getNotesByEventId(root, args, { req }) {
-      return libs.note.getNotesByEventId(req, args.eventId);
-    },
-    async getNotesByTimelineId(root, args, { req }) {
-      return libs.note.getNotesByTimelineId(req, args.timelineId);
-    },
-  },
-  Mutation: {
-    async deleteNote(root, args, { req }) {
-      await libs.note.deleteNote(req, args.id);
-
-      return true;
-    },
-    async deleteNoteByTimelineId(root, args, { req }) {
-      await libs.note.deleteNoteByTimelineId(req, args.timelineId);
-
-      return true;
-    },
-    async persistNote(root, args, { req }) {
-      return libs.note.persistNote(
-        req,
-        args.noteId || null,
-        args.version || null,
-        {
-          ...args.note,
-          timelineId: args.note.timelineId || null,
-        },
-        true
-      );
-    },
-  },
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/note/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/note/schema.gql.ts
deleted file mode 100644
index bd791b734ff247..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/note/schema.gql.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-const note = `
-  eventId: String
-  note: String
-  timelineId: String
-`;
-
-export const noteSchema = gql`
-  ###############
-  #### INPUT ####
-  ###############
-
-  input NoteInput {
-    ${note}
-  }
-
-  input PageInfoNote {
-    pageIndex: Float!
-    pageSize: Float!
-  }
-
-  enum SortFieldNote {
-    updatedBy
-    updated
-  }
-  
-  input SortNote {
-    sortField: SortFieldNote!
-    sortOrder: Direction!
-  }
-
-  ###############
-  #### QUERY ####
-  ###############
-  type NoteResult {
-    ${note}
-    noteId: String!
-    created: Float
-    createdBy: String
-    timelineVersion: String
-    updated: Float
-    updatedBy: String
-    version: String
-  }
-
-  type ResponseNote {
-    code: Float
-    message: String
-    note: NoteResult!
-  }
-
-  type ResponseNotes {
-    notes: [NoteResult!]!
-    totalCount: Float
-  }
-
-  #########################
-  ####  Mutation/Query ####
-  #########################
-
-  extend type Query {
-    getNote(id: ID!): NoteResult!
-    getNotesByTimelineId(timelineId: ID!): [NoteResult!]!
-    getNotesByEventId(eventId: ID!): [NoteResult!]!
-    getAllNotes(pageInfo: PageInfoNote, search: String, sort: SortNote): ResponseNotes!
-  }
-
-  extend type Mutation {
-    "Persists a note"
-    persistNote(noteId: ID, version: String, note: NoteInput!): ResponseNote!
-    deleteNote(id: [ID!]!):Boolean
-    deleteNoteByTimelineId(timelineId: ID!, version: String):Boolean
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/pinned_event/index.ts b/x-pack/plugins/security_solution/server/graphql/pinned_event/index.ts
deleted file mode 100644
index b1018025b3d73a..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/pinned_event/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createPinnedEventResolvers } from './resolvers';
-export { pinnedEventSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/pinned_event/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/pinned_event/resolvers.ts
deleted file mode 100644
index de1a40d9118c7c..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/pinned_event/resolvers.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { AppResolverOf } from '../../lib/framework';
-import { MutationResolvers, QueryResolvers } from '../types';
-import { PinnedEvent } from '../../lib/timeline/saved_object/pinned_events';
-
-export type QueryAllPinnedEventsByTimelineIdResolver = AppResolverOf<QueryResolvers.GetAllPinnedEventsByTimelineIdResolver>;
-
-export type MutationPinnedEventResolver = AppResolverOf<MutationResolvers.PersistPinnedEventOnTimelineResolver>;
-
-export type MutationDeletePinnedEventOnTimelineResolver = AppResolverOf<MutationResolvers.DeletePinnedEventOnTimelineResolver>;
-
-export type MutationDeleteAllPinnedEventsOnTimelineResolver = AppResolverOf<MutationResolvers.DeleteAllPinnedEventsOnTimelineResolver>;
-
-interface TimelineResolversDeps {
-  pinnedEvent: PinnedEvent;
-}
-
-export const createPinnedEventResolvers = (
-  libs: TimelineResolversDeps
-): {
-  Query: {
-    getAllPinnedEventsByTimelineId: QueryAllPinnedEventsByTimelineIdResolver;
-  };
-  Mutation: {
-    persistPinnedEventOnTimeline: MutationPinnedEventResolver;
-    deletePinnedEventOnTimeline: MutationDeletePinnedEventOnTimelineResolver;
-    deleteAllPinnedEventsOnTimeline: MutationDeleteAllPinnedEventsOnTimelineResolver;
-  };
-} => ({
-  Query: {
-    async getAllPinnedEventsByTimelineId(root, args, { req }) {
-      return libs.pinnedEvent.getAllPinnedEventsByTimelineId(req, args.timelineId);
-    },
-  },
-  Mutation: {
-    async persistPinnedEventOnTimeline(root, args, { req }) {
-      return libs.pinnedEvent.persistPinnedEventOnTimeline(
-        req,
-        args.pinnedEventId || null,
-        args.eventId,
-        args.timelineId || null
-      );
-    },
-    async deletePinnedEventOnTimeline(root, args, { req }) {
-      await libs.pinnedEvent.deletePinnedEventOnTimeline(req, args.id);
-      return true;
-    },
-    async deleteAllPinnedEventsOnTimeline(root, args, { req }) {
-      await libs.pinnedEvent.deleteAllPinnedEventsOnTimeline(req, args.timelineId);
-      return true;
-    },
-  },
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/pinned_event/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/pinned_event/schema.gql.ts
deleted file mode 100644
index 2e1cb29cf9d78e..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/pinned_event/schema.gql.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const pinnedEventSchema = gql`
-  #########################
-  ####  Mutation/Query ####
-  #########################
-
-  type PinnedEvent {
-    code: Float
-    message: String
-    pinnedEventId: ID!
-    eventId: ID
-    timelineId: ID
-    timelineVersion: String
-    created: Float
-    createdBy: String
-    updated: Float
-    updatedBy: String
-    version: String
-  }
-
-  extend type Query {
-    getAllPinnedEventsByTimelineId(timelineId: ID!): [PinnedEvent!]!
-  }
-
-  extend type Mutation {
-    "Persists a pinned event in a timeline"
-    persistPinnedEventOnTimeline(pinnedEventId: ID, eventId: ID!, timelineId: ID): PinnedEvent
-    "Remove a pinned events in a timeline"
-    deletePinnedEventOnTimeline(id: [ID!]!): Boolean!
-    "Remove all pinned events in a timeline"
-    deleteAllPinnedEventsOnTimeline(timelineId: ID!): Boolean!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_date/resolvers.test.ts b/x-pack/plugins/security_solution/server/graphql/scalar_date/resolvers.test.ts
deleted file mode 100644
index 4c421af5601804..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_date/resolvers.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { IntValueNode, StringValueNode } from 'graphql';
-
-import { dateScalar } from './resolvers';
-
-describe('Test ScalarDate Resolver', () => {
-  describe('#serialize', () => {
-    test('Make sure that an epoch date number is serialized', () => {
-      const date = dateScalar.serialize(1514782800000);
-      expect(date).toEqual('2018-01-01T05:00:00.000Z');
-    });
-
-    test('Make sure that a date string is serialized', () => {
-      const date = dateScalar.serialize('2018-01-01T05:00:00.000Z');
-      expect(date).toEqual('2018-01-01T05:00:00.000Z');
-    });
-  });
-
-  describe('#parseValue', () => {
-    test('Make sure that an epoch date number passes through parseValue', () => {
-      const date = dateScalar.parseValue(1514782800000);
-      expect(date).toEqual(1514782800000);
-    });
-
-    test('Make sure that a date string passes through parseValue', () => {
-      const date = dateScalar.parseValue('2018-01-01T05:00:00.000Z');
-      expect(date).toEqual('2018-01-01T05:00:00.000Z');
-    });
-  });
-
-  describe('#parseLiteral', () => {
-    test('Make sure that an epoch date string passes through parseLiteral', () => {
-      const valueNode: IntValueNode = {
-        kind: 'IntValue',
-        value: '1514782800000',
-      };
-      const date = dateScalar.parseLiteral(valueNode);
-      expect(date).toEqual(1514782800000);
-    });
-
-    test('Make sure that a date string passes through parseLiteral', () => {
-      const valueNode: StringValueNode = {
-        kind: 'StringValue',
-        value: '2018-01-01T05:00:00.000Z',
-      };
-      const date = dateScalar.parseLiteral(valueNode);
-      expect(date).toEqual('2018-01-01T05:00:00.000Z');
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_date/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/scalar_date/resolvers.ts
deleted file mode 100644
index fe55cc949af486..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_date/resolvers.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLScalarType, Kind } from 'graphql';
-
-export const dateScalar = new GraphQLScalarType({
-  name: 'Date',
-  description:
-    'Represents a Date for either an ES formatted date string or epoch string ISO8601 formatted',
-  serialize(value): string {
-    return Number.isNaN(Date.parse(value)) ? new Date(value).toISOString() : value;
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.INT:
-        return parseInt(ast.value, 10);
-      case Kind.STRING:
-        return ast.value;
-    }
-    return null;
-  },
-});
-
-export const createScalarDateResolvers = () => ({
-  Date: dateScalar,
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_any/index.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_any/index.ts
deleted file mode 100644
index 0a26a1a59816a2..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_any/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createScalarToAnyValueResolvers } from './resolvers';
-export { toAnySchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_any/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_any/resolvers.ts
deleted file mode 100644
index 37903617989e66..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_any/resolvers.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { isObject } from 'lodash/fp';
-import { GraphQLScalarType, Kind } from 'graphql';
-
-/*
- *  serialize: gets invoked when serializing the result to send it back to a client.
- *
- *  parseValue: gets invoked to parse client input that was passed through variables.
- *
- *  parseLiteral: gets invoked to parse client input that was passed inline in the query.
- */
-
-export const toAnyScalar = new GraphQLScalarType({
-  name: 'Any',
-  description: 'Represents any type',
-  serialize(value): unknown {
-    if (value == null) {
-      return null;
-    }
-    try {
-      const maybeObj = JSON.parse(value);
-      if (isObject(maybeObj)) {
-        return maybeObj;
-      } else {
-        return value;
-      }
-    } catch (e) {
-      return value;
-    }
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.BOOLEAN:
-        return ast.value;
-      case Kind.INT:
-        return ast.value;
-      case Kind.FLOAT:
-        return ast.value;
-      case Kind.STRING:
-        return ast.value;
-      case Kind.LIST:
-        return ast.values;
-      case Kind.OBJECT:
-        return ast.fields;
-    }
-    return null;
-  },
-});
-
-export const createScalarToAnyValueResolvers = () => ({
-  ToAny: toAnyScalar,
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/index.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/index.ts
deleted file mode 100644
index df362871fd5a6a..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createScalarToBooleanArrayValueResolvers } from './resolvers';
-export { toBooleanSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/resolvers.test.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/resolvers.test.ts
deleted file mode 100644
index 247ed3a0d0911f..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/resolvers.test.ts
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { toBooleanArrayScalar } from './resolvers';
-
-describe('Test ToBooleanArray Scalar Resolver', () => {
-  describe('#serialize', () => {
-    test('Test Null Boolean', () => {
-      expect(toBooleanArrayScalar.serialize(null)).toEqual(null);
-    });
-
-    test('Test Undefined Boolean', () => {
-      expect(toBooleanArrayScalar.serialize(undefined)).toEqual(null);
-    });
-
-    test('Test NaN Number', () => {
-      expect(toBooleanArrayScalar.serialize(NaN)).toEqual([false]);
-    });
-
-    test('Test Basic false Boolean', () => {
-      expect(toBooleanArrayScalar.serialize(false)).toEqual([false]);
-    });
-
-    test('Test Basic true Boolean', () => {
-      expect(toBooleanArrayScalar.serialize(true)).toEqual([true]);
-    });
-
-    test('Test Basic false Boolean string', () => {
-      expect(toBooleanArrayScalar.serialize('false')).toEqual([false]);
-    });
-
-    test('Test Basic true Boolean string', () => {
-      expect(toBooleanArrayScalar.serialize('true')).toEqual([true]);
-    });
-
-    test('Test Basic true Boolean string with weird letters', () => {
-      expect(toBooleanArrayScalar.serialize('tRuE')).toEqual([true]);
-    });
-
-    test('Test Basic true Boolean string with just the letter T', () => {
-      expect(toBooleanArrayScalar.serialize('T')).toEqual([true]);
-    });
-
-    test('Test Basic true Boolean string with just the letter t', () => {
-      expect(toBooleanArrayScalar.serialize('t')).toEqual([true]);
-    });
-
-    test('Test string with gibberish returning false', () => {
-      expect(toBooleanArrayScalar.serialize('some gibberish')).toEqual([false]);
-    });
-
-    test('Test Basic false Boolean in array', () => {
-      expect(toBooleanArrayScalar.serialize([false])).toEqual([false]);
-    });
-
-    test('Test Basic true Boolean in array', () => {
-      expect(toBooleanArrayScalar.serialize([true])).toEqual([true]);
-    });
-
-    test('Test Basic false Boolean string in array', () => {
-      expect(toBooleanArrayScalar.serialize(['false'])).toEqual([false]);
-    });
-
-    test('Test Basic true Boolean string in array', () => {
-      expect(toBooleanArrayScalar.serialize(['true'])).toEqual([true]);
-    });
-
-    test('Test number with 0 returning false', () => {
-      expect(toBooleanArrayScalar.serialize(0)).toEqual([false]);
-    });
-
-    test('Test number with 1 returning returning true', () => {
-      expect(toBooleanArrayScalar.serialize(1)).toEqual([true]);
-    });
-
-    test('Test array with 0 and 1 returning true and false', () => {
-      expect(toBooleanArrayScalar.serialize([0, 1, 1, 0, 1])).toEqual([
-        false,
-        true,
-        true,
-        false,
-        true,
-      ]);
-    });
-
-    test('Test Simple Object returning false', () => {
-      expect(toBooleanArrayScalar.serialize({})).toEqual([false]);
-    });
-
-    test('Test Simple Circular Reference returning false', () => {
-      const circularReference = { myself: {} };
-      circularReference.myself = circularReference;
-      expect(toBooleanArrayScalar.serialize(circularReference)).toEqual([false]);
-    });
-
-    test('Test Array of Strings with some numbers, a null, and some text and a boolean', () => {
-      expect(
-        toBooleanArrayScalar.serialize([
-          5,
-          'you',
-          '1',
-          'he',
-          '20',
-          'we',
-          null,
-          '22',
-          'they',
-          'True',
-          'T',
-          't',
-        ])
-      ).toEqual([true, false, false, false, false, false, false, false, true, true, true]);
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/resolvers.ts
deleted file mode 100644
index b1aefd3188ef62..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/resolvers.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLScalarType, Kind } from 'graphql';
-import { isNumber, isObject, isString } from 'lodash/fp';
-
-/*
- *  serialize: gets invoked when serializing the result to send it back to a client.
- *
- *  parseValue: gets invoked to parse client input that was passed through variables.
- *
- *  parseLiteral: gets invoked to parse client input that was passed inline in the query.
- */
-
-export const toBooleanArrayScalar = new GraphQLScalarType({
-  name: 'BooleanArray',
-  description: 'Represents value in detail item from the timeline who wants to more than one type',
-  serialize(value): boolean[] | null {
-    if (value == null) {
-      return null;
-    } else if (Array.isArray(value)) {
-      return convertArrayToBoolean(value) as boolean[];
-    } else if (isString(value) || isObject(value) || isNumber(value)) {
-      return [convertToBoolean(value)];
-    }
-    return [value];
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.BOOLEAN:
-        return ast.value;
-      case Kind.INT:
-        return ast.value;
-      case Kind.FLOAT:
-        return ast.value;
-      case Kind.STRING:
-        return ast.value;
-      case Kind.LIST:
-        return ast.values;
-      case Kind.OBJECT:
-        return ast.fields;
-    }
-    return null;
-  },
-});
-
-export const createScalarToBooleanArrayValueResolvers = () => ({
-  ToBooleanArray: toBooleanArrayScalar,
-});
-
-const convertToBoolean = (value: object | number | boolean | string): boolean => {
-  if (isObject(value)) {
-    return false;
-  } else if (isString(value)) {
-    return value.toLowerCase() === 'true' || value.toLowerCase() === 't' ? true : false;
-  } else {
-    return Boolean(value);
-  }
-};
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const convertArrayToBoolean = (values: any[]): boolean[] | boolean => {
-  if (Array.isArray(values)) {
-    return values
-      .filter((item) => item != null)
-      .map((item) => convertArrayToBoolean(item)) as boolean[];
-  }
-  return convertToBoolean(values);
-};
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/schema.gql.ts
deleted file mode 100644
index d8717ebfdee020..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_boolean_array/schema.gql.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const toBooleanSchema = gql`
-  scalar ToBooleanArray
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/index.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/index.ts
deleted file mode 100644
index 53b8c2c4caa0c5..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createScalarToDateArrayValueResolvers } from './resolvers';
-export { toDateSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/resolvers.test.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/resolvers.test.ts
deleted file mode 100644
index 109fbb9e420056..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/resolvers.test.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { toDateArrayScalar } from './resolvers';
-
-describe('Test ToDateArray Scalar Resolver', () => {
-  describe('#serialize', () => {
-    test('Test Null Number', () => {
-      expect(toDateArrayScalar.serialize(null)).toEqual(null);
-    });
-
-    test('Test Undefined Number', () => {
-      expect(toDateArrayScalar.serialize(undefined)).toEqual(null);
-    });
-
-    test('Test NaN Number', () => {
-      expect(toDateArrayScalar.serialize(NaN)).toEqual([NaN]);
-    });
-
-    test('Test Basic Date String', () => {
-      expect(toDateArrayScalar.serialize('2019-04-16T03:14:13.704Z')).toEqual([
-        '2019-04-16T03:14:13.704Z',
-      ]);
-    });
-
-    test('Test Basic Date Number as String', () => {
-      expect(toDateArrayScalar.serialize('1555384642768')).toEqual(['2019-04-16T03:17:22.768Z']);
-    });
-
-    test('Test Basic Date String in an array', () => {
-      expect(toDateArrayScalar.serialize(['2019-04-16T03:14:13.704Z'])).toEqual([
-        '2019-04-16T03:14:13.704Z',
-      ]);
-    });
-
-    test('Test Two Basic Date Strings in an array', () => {
-      expect(
-        toDateArrayScalar.serialize(['2019-04-16T03:14:13.704Z', '2019-05-16T03:14:13.704Z'])
-      ).toEqual(['2019-04-16T03:14:13.704Z', '2019-05-16T03:14:13.704Z']);
-    });
-
-    test('Test Basic Numbers in an array', () => {
-      expect(toDateArrayScalar.serialize([1555384642768, 1555384453704])).toEqual([
-        '2019-04-16T03:17:22.768Z',
-        '2019-04-16T03:14:13.704Z',
-      ]);
-    });
-
-    test('Mix of Basic Numbers and strings in an array', () => {
-      expect(
-        toDateArrayScalar.serialize([1555384642768, '2019-05-16T03:14:13.704Z', 1555384453704])
-      ).toEqual([
-        '2019-04-16T03:17:22.768Z',
-        '2019-05-16T03:14:13.704Z',
-        '2019-04-16T03:14:13.704Z',
-      ]);
-    });
-
-    test('Test Simple Object', () => {
-      expect(toDateArrayScalar.serialize({})).toEqual(['invalid date']);
-    });
-
-    test('Test Simple Circular Reference', () => {
-      const circularReference = { myself: {} };
-      circularReference.myself = circularReference;
-      expect(toDateArrayScalar.serialize(circularReference)).toEqual(['invalid date']);
-    });
-
-    test('Test Array of Strings with some numbers, a null, and some text', () => {
-      expect(
-        toDateArrayScalar.serialize([
-          '1555384453704',
-          'you',
-          1555384642768,
-          'he',
-          'we',
-          null,
-          'they',
-        ])
-      ).toEqual([
-        '2019-04-16T03:14:13.704Z',
-        'you',
-        '2019-04-16T03:17:22.768Z',
-        'he',
-        'we',
-        'they',
-      ]);
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/resolvers.ts
deleted file mode 100644
index 532e520e4045e0..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_date_array/resolvers.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLScalarType, Kind } from 'graphql';
-import { isBoolean, isNumber, isObject, isString } from 'lodash/fp';
-
-/*
- *  serialize: gets invoked when serializing the result to send it back to a client.
- *
- *  parseValue: gets invoked to parse client input that was passed through variables.
- *
- *  parseLiteral: gets invoked to parse client input that was passed inline in the query.
- */
-
-export const toDateArrayScalar = new GraphQLScalarType({
-  name: 'DateArray',
-  description: 'Represents value in detail item from the timeline who wants to more than one type',
-  serialize(value): string[] | null {
-    if (value == null) {
-      return null;
-    } else if (Array.isArray(value)) {
-      return convertArrayToDate(value) as string[];
-    } else if (isBoolean(value) || isString(value) || isObject(value)) {
-      return [convertToDate(value)];
-    }
-    return [value];
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.INT:
-        return parseInt(ast.value, 10);
-      case Kind.STRING:
-        return ast.value;
-    }
-    return null;
-  },
-});
-
-export const createScalarToDateArrayValueResolvers = () => ({
-  ToDateArray: toDateArrayScalar,
-});
-
-const convertToDate = (value: object | number | boolean | string): string => {
-  if (isNumber(value)) {
-    return new Date(value).toISOString();
-  } else if (isObject(value)) {
-    return 'invalid date';
-  } else if (isString(value) && !isNaN(+value)) {
-    return new Date(+value).toISOString();
-  } else {
-    return String(value);
-  }
-};
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const convertArrayToDate = (values: any[]): string[] | string => {
-  if (Array.isArray(values)) {
-    return values
-      .filter((item) => item != null)
-      .map((item) => convertArrayToDate(item)) as string[];
-  }
-  return convertToDate(values);
-};
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/index.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/index.ts
deleted file mode 100644
index 070c09181c2c53..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createScalarToNumberArrayValueResolvers } from './resolvers';
-export { toNumberSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/resolvers.test.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/resolvers.test.ts
deleted file mode 100644
index a37ae25ec5e04f..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/resolvers.test.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { toNumberArrayScalar } from './resolvers';
-
-describe('Test ToNumberArray Scalar Resolver', () => {
-  describe('#serialize', () => {
-    test('Test Null Number', () => {
-      expect(toNumberArrayScalar.serialize(null)).toEqual(null);
-    });
-
-    test('Test Undefined Number', () => {
-      expect(toNumberArrayScalar.serialize(undefined)).toEqual(null);
-    });
-
-    test('Test NaN Number', () => {
-      expect(toNumberArrayScalar.serialize(NaN)).toEqual([NaN]);
-    });
-
-    test('Test Basic Number', () => {
-      expect(toNumberArrayScalar.serialize(5)).toEqual([5]);
-    });
-
-    test('Test Basic Number in an array', () => {
-      expect(toNumberArrayScalar.serialize([5])).toEqual([5]);
-    });
-
-    test('Test Two Basic Numbers in an array', () => {
-      expect(toNumberArrayScalar.serialize([5, 3])).toEqual([5, 3]);
-    });
-
-    test('Test Basic String', () => {
-      expect(toNumberArrayScalar.serialize('33')).toEqual([33]);
-    });
-
-    test('Test Two Basic Strings in an array', () => {
-      expect(toNumberArrayScalar.serialize(['33', '44'])).toEqual([33, 44]);
-    });
-
-    test('Test Two Basic Strings and a piece of text in an array', () => {
-      expect(toNumberArrayScalar.serialize(['33', 'orange', '44'])).toEqual([33, NaN, 44]);
-    });
-
-    test('Test Basic Object to return NaN', () => {
-      expect(toNumberArrayScalar.serialize({ hello: 'test' })).toEqual([NaN]);
-    });
-
-    test('Test more complicated Object to return NaN', () => {
-      expect(
-        toNumberArrayScalar.serialize({
-          hello: 'test',
-          me: 40,
-          you: ['32', '34', null],
-          others: [{ age: 78, name: 'unknown', lucky: true }],
-          isNull: null,
-        })
-      ).toEqual([NaN]);
-    });
-
-    test('Test Array of Strings with some numbers, a null, and some text', () => {
-      expect(
-        toNumberArrayScalar.serialize(['5', 'you', '3', 'he', '20', 'we', null, '22', 'they'])
-      ).toEqual([5, NaN, 3, NaN, 20, NaN, 22, NaN]);
-    });
-
-    test('Test Simple Circular Reference', () => {
-      const circularReference = { myself: {} };
-      circularReference.myself = circularReference;
-      expect(toNumberArrayScalar.serialize(circularReference)).toEqual([NaN]);
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/resolvers.ts
deleted file mode 100644
index 9ec6de45ae48b8..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/resolvers.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLScalarType, Kind } from 'graphql';
-import { isBoolean, isNumber, isObject, isString } from 'lodash/fp';
-
-/*
- *  serialize: gets invoked when serializing the result to send it back to a client.
- *
- *  parseValue: gets invoked to parse client input that was passed through variables.
- *
- *  parseLiteral: gets invoked to parse client input that was passed inline in the query.
- */
-
-export const toNumberArrayScalar = new GraphQLScalarType({
-  name: 'NumberArray',
-  description: 'Represents value in detail item from the timeline who wants to more than one type',
-  serialize(value): number[] | null {
-    if (value == null) {
-      return null;
-    } else if (Array.isArray(value)) {
-      return convertArrayToNumber(value) as number[];
-    } else if (isBoolean(value) || isString(value) || isObject(value)) {
-      return [convertToNumber(value)];
-    }
-    return [value];
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.INT:
-        return ast.value;
-      case Kind.FLOAT:
-        return ast.value;
-      case Kind.STRING:
-        return parseFloat(ast.value);
-      case Kind.LIST:
-        return ast.values;
-      case Kind.OBJECT:
-        return ast.fields;
-    }
-    return null;
-  },
-});
-
-export const createScalarToNumberArrayValueResolvers = () => ({
-  ToNumberArray: toNumberArrayScalar,
-});
-
-const convertToNumber = (value: object | number | boolean | string): number => {
-  if (isNumber(value)) {
-    return value;
-  } else if (isString(value)) {
-    return parseFloat(value);
-  } else {
-    return NaN;
-  }
-};
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const convertArrayToNumber = (values: any[]): number[] | number => {
-  if (Array.isArray(values)) {
-    return values
-      .filter((item) => item != null)
-      .map((item) => convertArrayToNumber(item)) as number[];
-  }
-  return convertToNumber(values);
-};
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/schema.gql.ts
deleted file mode 100644
index 514af67f109e6b..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_number_array/schema.gql.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const toNumberSchema = gql`
-  scalar ToNumberArray
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/source_status/index.ts b/x-pack/plugins/security_solution/server/graphql/source_status/index.ts
deleted file mode 100644
index fef667075145aa..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/source_status/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createSourceStatusResolvers } from './resolvers';
-export { sourceStatusSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/source_status/resolvers.test.ts b/x-pack/plugins/security_solution/server/graphql/source_status/resolvers.test.ts
deleted file mode 100644
index 86c641dfb13b6a..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/source_status/resolvers.test.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { filterIndexes } from './resolvers';
-
-describe('resolvers', () => {
-  test('it should filter single index that has an empty string', () => {
-    const emptyArray = filterIndexes(['']);
-    expect(emptyArray).toEqual([]);
-  });
-
-  test('it should filter single index that has blanks within it', () => {
-    const emptyArray = filterIndexes(['   ']);
-    expect(emptyArray).toEqual([]);
-  });
-
-  test('it should filter indexes that has an empty string and a valid index', () => {
-    const emptyArray = filterIndexes(['', 'valid-index']);
-    expect(emptyArray).toEqual(['valid-index']);
-  });
-
-  test('it should filter indexes that have blanks within them and a valid index', () => {
-    const emptyArray = filterIndexes(['   ', 'valid-index']);
-    expect(emptyArray).toEqual(['valid-index']);
-  });
-
-  test('it should filter single index that has _all within it', () => {
-    const emptyArray = filterIndexes(['_all']);
-    expect(emptyArray).toEqual([]);
-  });
-
-  test('it should filter single index that has _all within it surrounded by spaces', () => {
-    const emptyArray = filterIndexes(['  _all  ']);
-    expect(emptyArray).toEqual([]);
-  });
-
-  test('it should filter indexes that _all within them and a valid index', () => {
-    const emptyArray = filterIndexes(['_all', 'valid-index']);
-    expect(emptyArray).toEqual(['valid-index']);
-  });
-
-  test('it should filter indexes that _all surrounded with spaces within them and a valid index', () => {
-    const emptyArray = filterIndexes(['  _all   ', 'valid-index']);
-    expect(emptyArray).toEqual(['valid-index']);
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/source_status/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/source_status/resolvers.ts
deleted file mode 100644
index 038f981a2f3893..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/source_status/resolvers.ts
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLScalarType, Kind } from 'graphql';
-import { SourceStatusResolvers } from '../../graphql/types';
-import { AppResolverOf, ChildResolverOf } from '../../lib/framework';
-import { IndexFields } from '../../lib/index_fields';
-import { SourceStatus } from '../../lib/source_status';
-import { QuerySourceResolver } from '../sources/resolvers';
-import { IFieldSubType } from '../../../../../../src/plugins/data/common/index_patterns/types';
-
-export type SourceStatusIndicesExistResolver = ChildResolverOf<
-  AppResolverOf<SourceStatusResolvers.IndicesExistResolver>,
-  QuerySourceResolver
->;
-
-export type SourceStatusIndexFieldsResolver = ChildResolverOf<
-  AppResolverOf<SourceStatusResolvers.IndexFieldsResolver>,
-  QuerySourceResolver
->;
-
-export const createSourceStatusResolvers = (libs: {
-  sourceStatus: SourceStatus;
-  fields: IndexFields;
-}): {
-  SourceStatus: {
-    indicesExist: SourceStatusIndicesExistResolver;
-    indexFields: SourceStatusIndexFieldsResolver;
-  };
-} => ({
-  SourceStatus: {
-    async indicesExist(_, args, { req }) {
-      const indexes = filterIndexes(args.defaultIndex);
-      if (indexes.length !== 0) {
-        return libs.sourceStatus.hasIndices(req, indexes);
-      } else {
-        return false;
-      }
-    },
-    async indexFields(_, args, { req }) {
-      const indexes = filterIndexes(args.defaultIndex);
-      if (indexes.length !== 0) {
-        return libs.fields.getFields(req, indexes);
-      } else {
-        return [];
-      }
-    },
-  },
-});
-
-/**
- * Given a set of indexes this will remove anything that is:
- *   - blank or empty strings are removed as not valid indexes
- *   - _all is removed as that is not a valid index
- * @param indexes Indexes with invalid values removed
- */
-export const filterIndexes = (indexes: string[]): string[] =>
-  indexes.filter((index) => index.trim() !== '' && index.trim() !== '_all');
-
-export const toIFieldSubTypeNonNullableScalar = new GraphQLScalarType({
-  name: 'IFieldSubType',
-  description: 'Represents value in index pattern field item',
-  serialize(value): IFieldSubType | undefined {
-    if (value == null) {
-      return undefined;
-    }
-
-    return {
-      multi: value.multi ?? undefined,
-      nested: value.nested ?? undefined,
-    };
-  },
-  parseValue(value) {
-    return value;
-  },
-  parseLiteral(ast) {
-    switch (ast.kind) {
-      case Kind.INT:
-        return undefined;
-      case Kind.FLOAT:
-        return undefined;
-      case Kind.STRING:
-        return undefined;
-      case Kind.LIST:
-        return undefined;
-      case Kind.OBJECT:
-        return ast;
-    }
-    return undefined;
-  },
-});
-
-export const createScalarToIFieldSubTypeNonNullableScalarResolvers = () => ({
-  ToIFieldSubTypeNonNullable: toIFieldSubTypeNonNullableScalar,
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/source_status/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/source_status/schema.gql.ts
deleted file mode 100644
index c1fd7b24e6dcb5..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/source_status/schema.gql.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const sourceStatusSchema = gql`
-  scalar ToIFieldSubTypeNonNullable
-
-  "A descriptor of a field in an index"
-  type IndexField {
-    "Where the field belong"
-    category: String!
-    "Example of field's value"
-    example: String
-    "whether the field's belong to an alias index"
-    indexes: [String]!
-    "The name of the field"
-    name: String!
-    "The type of the field's values as recognized by Kibana"
-    type: String!
-    "Whether the field's values can be efficiently searched for"
-    searchable: Boolean!
-    "Whether the field's values can be aggregated"
-    aggregatable: Boolean!
-    "Description of the field"
-    description: String
-    format: String
-    "the elastic type as mapped in the index"
-    esTypes: ToStringArrayNoNullable
-    subType: ToIFieldSubTypeNonNullable
-  }
-
-  extend type SourceStatus {
-    "Whether the configured alias or wildcard pattern resolve to any auditbeat indices"
-    indicesExist(defaultIndex: [String!]!): Boolean!
-    "The list of fields defined in the index mappings"
-    indexFields(defaultIndex: [String!]!): [String!]!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/sources/index.ts b/x-pack/plugins/security_solution/server/graphql/sources/index.ts
deleted file mode 100644
index 583918fa014c70..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/sources/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createSourcesResolvers } from './resolvers';
-export { sourcesSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/sources/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/sources/resolvers.ts
deleted file mode 100644
index 8ae30c17560f09..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/sources/resolvers.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { QueryResolvers, SourceResolvers } from '../../graphql/types';
-import {
-  AppResolverOf,
-  AppResolverWithFields,
-  ChildResolverOf,
-  ResultOf,
-} from '../../lib/framework';
-import { SourceStatus } from '../../lib/source_status';
-import { Sources } from '../../lib/sources';
-
-export type QuerySourceResolver = AppResolverWithFields<
-  QueryResolvers.SourceResolver,
-  'id' | 'configuration'
->;
-
-export type QueryAllSourcesResolver = AppResolverWithFields<
-  QueryResolvers.AllSourcesResolver,
-  'id' | 'configuration'
->;
-
-export type SourceStatusResolver = ChildResolverOf<
-  AppResolverOf<SourceResolvers.StatusResolver<ResultOf<QuerySourceResolver>>>,
-  QuerySourceResolver
->;
-
-export interface SourcesResolversDeps {
-  sources: Sources;
-  sourceStatus: SourceStatus;
-}
-
-export const createSourcesResolvers = (
-  libs: SourcesResolversDeps
-): {
-  Query: {
-    source: QuerySourceResolver;
-    allSources: QueryAllSourcesResolver;
-  };
-  Source: {
-    status: SourceStatusResolver;
-  };
-} => ({
-  Query: {
-    async source(root, args) {
-      const requestedSourceConfiguration = await libs.sources.getConfiguration(args.id);
-
-      return {
-        id: args.id,
-        configuration: requestedSourceConfiguration,
-      };
-    },
-    async allSources() {
-      const sourceConfigurations = await libs.sources.getAllConfigurations();
-
-      return Object.entries(sourceConfigurations).map(([sourceName, sourceConfiguration]) => ({
-        id: sourceName,
-        configuration: sourceConfiguration,
-      }));
-    },
-  },
-  Source: {
-    async status(source) {
-      return source;
-    },
-  },
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/sources/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/sources/schema.gql.ts
deleted file mode 100644
index 6b5b12a1e92a41..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/sources/schema.gql.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-export const sourcesSchema = gql`
-  extend type Query {
-    "Get a security data source by id"
-    source("The id of the source" id: ID!): Source!
-    "Get a list of all security data sources"
-    allSources: [Source!]!
-  }
-
-  type Source {
-    "The id of the source"
-    id: ID!
-    "The raw configuration of the source"
-    configuration: SourceConfiguration!
-    "The status of the source"
-    status: SourceStatus!
-  }
-
-  "The status of an infrastructure data source"
-  type SourceStatus
-
-  "A set of configuration options for a security data source"
-  type SourceConfiguration {
-    "The field mapping to use for this source"
-    fields: SourceFields!
-  }
-
-  "A mapping of semantic fields to their document counterparts"
-  type SourceFields {
-    "The field to identify a container by"
-    container: String!
-    "The fields to identify a host by"
-    host: String!
-    "The fields that may contain the log event message. The first field found win."
-    message: [String!]!
-    "The field to identify a pod by"
-    pod: String!
-    "The field to use as a tiebreaker for log events that have identical timestamps"
-    tiebreaker: String!
-    "The field to use as a timestamp for metrics and logs"
-    timestamp: String!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/index.ts b/x-pack/plugins/security_solution/server/graphql/timeline/index.ts
deleted file mode 100644
index ef78a0e8b8bdd4..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/timeline/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createTimelineResolvers } from './resolvers';
-export { timelineSchema } from './schema.gql';
diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts
deleted file mode 100644
index 8aa08eda959230..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { AppResolverWithFields, AppResolverOf } from '../../lib/framework';
-import { MutationResolvers, QueryResolvers } from '../types';
-import { Timeline } from '../../lib/timeline/saved_object/timelines';
-import { TimelineType } from '../../../common/types/timeline';
-
-export type QueryTimelineResolver = AppResolverOf<QueryResolvers.GetOneTimelineResolver>;
-
-export type QueryAllTimelineResolver = AppResolverWithFields<
-  QueryResolvers.GetAllTimelineResolver,
-  'totalCount' | 'timeline'
->;
-
-export type MutationTimelineResolver = AppResolverOf<
-  MutationResolvers.PersistTimelineResolver<QueryTimelineResolver>
->;
-
-export type MutationDeleteTimelineResolver = AppResolverOf<MutationResolvers.DeleteTimelineResolver>;
-
-export type MutationFavoriteResolver = AppResolverOf<MutationResolvers.PersistFavoriteResolver>;
-
-interface TimelineResolversDeps {
-  timeline: Timeline;
-}
-
-export const createTimelineResolvers = (
-  libs: TimelineResolversDeps
-): {
-  Query: {
-    getOneTimeline: QueryTimelineResolver;
-    getAllTimeline: QueryAllTimelineResolver;
-  };
-  Mutation: {
-    deleteTimeline: MutationDeleteTimelineResolver;
-    persistTimeline: MutationTimelineResolver;
-    persistFavorite: MutationFavoriteResolver;
-  };
-} => ({
-  Query: {
-    async getOneTimeline(root, args, { req }) {
-      return libs.timeline.getTimeline(req, args.id, args.timelineType);
-    },
-    async getAllTimeline(root, args, { req }) {
-      return libs.timeline.getAllTimeline(
-        req,
-        args.onlyUserFavorite || null,
-        args.pageInfo,
-        args.search || null,
-        args.sort || null,
-        args.status || null,
-        args.timelineType || null
-      );
-    },
-  },
-  Mutation: {
-    async deleteTimeline(root, args, { req }) {
-      await libs.timeline.deleteTimeline(req, args.id);
-
-      return true;
-    },
-    async persistFavorite(root, args, { req }) {
-      return libs.timeline.persistFavorite(
-        req,
-        args.timelineId || null,
-        args.templateTimelineId || null,
-        args.templateTimelineVersion || null,
-        args.timelineType || TimelineType.default
-      );
-    },
-    async persistTimeline(root, args, { req }) {
-      return libs.timeline.persistTimeline(
-        req,
-        args.id || null,
-        args.version || null,
-        args.timeline
-      );
-    },
-  },
-});
diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts
deleted file mode 100644
index 98e7103e612247..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts
+++ /dev/null
@@ -1,352 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import gql from 'graphql-tag';
-
-const columnHeader = `
-  aggregatable: Boolean
-  category: String
-  columnHeaderType: String
-  description: String
-  example: String
-  indexes: [String!]
-  id: String
-  name: String
-  placeholder: String
-  searchable: Boolean
-  type: String
-`;
-
-const eqlOptions = `
-  eventCategoryField: String
-  tiebreakerField: String
-  timestampField: String
-  query: String
-  size: ToAny
-`;
-
-const queryMatch = `
-  field: String
-  displayField: String
-  value: String
-  displayValue: String
-  operator: String
-`;
-
-const kueryFilterQuery = `
-  kind: String
-  expression: String
-`;
-
-const dateRange = `
-  start: ToAny
-  end: ToAny
-`;
-
-const favoriteTimeline = `
-  fullName: String
-  userName: String
-  favoriteDate: Float
-`;
-
-const sortTimeline = `
-  columnId: String
-  sortDirection: String
-`;
-
-const filtersMetaTimeline = `
-  alias: String
-  controlledBy: String
-  disabled: Boolean
-  field: String
-  formattedValue: String
-  index: String
-  key: String
-  negate: Boolean
-  params: String
-  type: String
-  value: String
-`;
-
-export const timelineSchema = gql`
-  ###############
-  #### INPUT ####
-  ###############
-
-  input ColumnHeaderInput {
-    ${columnHeader}
-  }
-
-  input QueryMatchInput {
-    ${queryMatch}
-  }
-
-  input DataProviderInput {
-    id: String
-    name: String
-    enabled: Boolean
-    excluded: Boolean
-    kqlQuery: String
-    queryMatch: QueryMatchInput
-    and: [DataProviderInput!]
-    type: DataProviderType
-  }
-
-  enum DataProviderType {
-    default
-    template
-  }
-
-  input KueryFilterQueryInput {
-    ${kueryFilterQuery}
-  }
-
-  input SerializedKueryQueryInput {
-    kuery: KueryFilterQueryInput
-    serializedQuery: String
-  }
-
-  input SerializedFilterQueryInput {
-    filterQuery: SerializedKueryQueryInput
-  }
-
-  input DateRangePickerInput {
-    ${dateRange}
-  }
-
-  input FavoriteTimelineInput {
-    ${favoriteTimeline}
-  }
-
-  input SortTimelineInput {
-    ${sortTimeline}
-  }
-
-  input FilterMetaTimelineInput {
-    ${filtersMetaTimeline}
-  }
-
-  input EqlOptionsInput {
-    ${eqlOptions}
-  }
-
-  input FilterTimelineInput {
-    exists: String
-    meta: FilterMetaTimelineInput
-    match_all: String
-    missing: String
-    query: String
-    range: String
-    script: String
-  }
-
-  enum TimelineType {
-    default
-    template
-  }
-
-  enum TimelineStatus {
-    active
-    draft
-    immutable
-  }
-
-  enum RowRendererId {
-    alerts
-    auditd
-    auditd_file
-    library
-    netflow
-    plain
-    registry
-    suricata
-    system
-    system_dns
-    system_endgame_process
-    system_file
-    system_fim
-    system_security_event
-    system_socket
-    threat_match
-    zeek
-  }
-
-  input TimelineInput {
-    columns: [ColumnHeaderInput!]
-    dataProviders: [DataProviderInput!]
-    description: String
-    eqlOptions: EqlOptionsInput
-    eventType: String
-    excludedRowRendererIds: [RowRendererId!]
-    filters: [FilterTimelineInput!]
-    kqlMode: String
-    kqlQuery: SerializedFilterQueryInput
-    indexNames: [String!]
-    title: String
-    templateTimelineId: String
-    templateTimelineVersion: Int
-    timelineType: TimelineType
-    dateRange: DateRangePickerInput
-    savedQueryId: String
-    sort: [SortTimelineInput!]
-    status: TimelineStatus
-  }
-
-  input PageInfoTimeline {
-    pageIndex: Float!
-    pageSize: Float!
-  }
-
-  enum SortFieldTimeline {
-    title
-    description
-    updated
-    created
-  }
-
-  input SortTimeline {
-    sortField: SortFieldTimeline!
-    sortOrder: Direction!
-  }
-
-  ###############
-  #### QUERY ####
-  ###############
-  type ColumnHeaderResult {
-    ${columnHeader}
-  }
-
-  type QueryMatchResult {
-    ${queryMatch}
-  }
-
-  type DataProviderResult {
-    id: String
-    name: String
-    enabled: Boolean
-    excluded: Boolean
-    kqlQuery: String
-    queryMatch: QueryMatchResult
-    type: DataProviderType
-    and: [DataProviderResult!]
-  }
-
-  type KueryFilterQueryResult {
-    ${kueryFilterQuery}
-  }
-
-  type SerializedKueryQueryResult {
-    kuery: KueryFilterQueryResult
-    serializedQuery: String
-  }
-
-  type SerializedFilterQueryResult {
-    filterQuery: SerializedKueryQueryResult
-  }
-
-  type DateRangePickerResult {
-    ${dateRange}
-  }
-
-  type FavoriteTimelineResult {
-    ${favoriteTimeline}
-  }
-
-  type FilterMetaTimelineResult {
-    ${filtersMetaTimeline}
-  }
-
-  type EqlOptionsResult {
-    ${eqlOptions}
-  }
-
-  type FilterTimelineResult {
-    exists: String
-    meta: FilterMetaTimelineResult
-    match_all: String
-    missing: String
-    query: String
-    range: String
-    script: String
-  }
-
-  type TimelineResult {
-    columns: [ColumnHeaderResult!]
-    created: Float
-    createdBy: String
-    dataProviders: [DataProviderResult!]
-    dateRange: DateRangePickerResult
-    description: String
-    eqlOptions: EqlOptionsResult
-    eventIdToNoteIds: [NoteResult!]
-    eventType: String
-    excludedRowRendererIds: [RowRendererId!]
-    favorite: [FavoriteTimelineResult!]
-    filters: [FilterTimelineResult!]
-    kqlMode: String
-    kqlQuery: SerializedFilterQueryResult
-    indexNames: [String!]
-    notes: [NoteResult!]
-    noteIds: [String!]
-    pinnedEventIds: [String!]
-    pinnedEventsSaveObject: [PinnedEvent!]
-    savedQueryId: String
-    savedObjectId: String!
-    sort: ToAny
-    status: TimelineStatus
-    title: String
-    templateTimelineId: String
-    templateTimelineVersion: Int
-    timelineType: TimelineType
-    updated: Float
-    updatedBy: String
-    version: String!
-  }
-
-  type ResponseTimeline {
-    code: Float
-    message: String
-    timeline: TimelineResult!
-  }
-
-  type ResponseFavoriteTimeline {
-    code: Float
-    message: String
-    savedObjectId: String!
-    templateTimelineId: String
-    templateTimelineVersion: Int
-    timelineType: TimelineType
-    version: String!
-    favorite: [FavoriteTimelineResult!]
-  }
-
-  type ResponseTimelines {
-    timeline: [TimelineResult]!
-    totalCount: Float
-    defaultTimelineCount: Float
-    templateTimelineCount: Float
-    elasticTemplateTimelineCount: Float
-    customTemplateTimelineCount: Float
-    favoriteCount: Float
-  }
-
-  #########################
-  ####  Mutation/Query ####
-  #########################
-
-  extend type Query {
-    getOneTimeline(id: ID!, timelineType: TimelineType): TimelineResult!
-    getAllTimeline(pageInfo: PageInfoTimeline!, search: String, sort: SortTimeline, onlyUserFavorite: Boolean, timelineType: TimelineType, status: TimelineStatus): ResponseTimelines!
-  }
-
-  extend type Mutation {
-    "Persists a timeline"
-    persistTimeline(id: ID, version: String, timeline: TimelineInput!): ResponseTimeline!
-    persistFavorite(timelineId: ID, templateTimelineId: String, templateTimelineVersion: Int, timelineType: TimelineType): ResponseFavoriteTimeline!
-    deleteTimeline(id: [ID!]!): Boolean!
-  }
-`;
diff --git a/x-pack/plugins/security_solution/server/graphql/types.ts b/x-pack/plugins/security_solution/server/graphql/types.ts
deleted file mode 100644
index a60a6dd6093d18..00000000000000
--- a/x-pack/plugins/security_solution/server/graphql/types.ts
+++ /dev/null
@@ -1,5706 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { SiemContext } from '../lib/types';
-
-export type Maybe<T> = T | null;
-
-export interface PageInfoNote {
-  pageIndex: number;
-
-  pageSize: number;
-}
-
-export interface SortNote {
-  sortField: SortFieldNote;
-
-  sortOrder: Direction;
-}
-
-export interface PageInfoTimeline {
-  pageIndex: number;
-
-  pageSize: number;
-}
-
-export interface SortTimeline {
-  sortField: SortFieldTimeline;
-
-  sortOrder: Direction;
-}
-
-export interface NoteInput {
-  eventId?: Maybe<string>;
-
-  note?: Maybe<string>;
-
-  timelineId?: Maybe<string>;
-}
-
-export interface TimelineInput {
-  columns?: Maybe<ColumnHeaderInput[]>;
-
-  dataProviders?: Maybe<DataProviderInput[]>;
-
-  description?: Maybe<string>;
-
-  eqlOptions?: Maybe<EqlOptionsInput>;
-
-  eventType?: Maybe<string>;
-
-  excludedRowRendererIds?: Maybe<RowRendererId[]>;
-
-  filters?: Maybe<FilterTimelineInput[]>;
-
-  kqlMode?: Maybe<string>;
-
-  kqlQuery?: Maybe<SerializedFilterQueryInput>;
-
-  indexNames?: Maybe<string[]>;
-
-  title?: Maybe<string>;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  dateRange?: Maybe<DateRangePickerInput>;
-
-  savedQueryId?: Maybe<string>;
-
-  sort?: Maybe<SortTimelineInput[]>;
-
-  status?: Maybe<TimelineStatus>;
-}
-
-export interface ColumnHeaderInput {
-  aggregatable?: Maybe<boolean>;
-
-  category?: Maybe<string>;
-
-  columnHeaderType?: Maybe<string>;
-
-  description?: Maybe<string>;
-
-  example?: Maybe<string>;
-
-  indexes?: Maybe<string[]>;
-
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  placeholder?: Maybe<string>;
-
-  searchable?: Maybe<boolean>;
-
-  type?: Maybe<string>;
-}
-
-export interface DataProviderInput {
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  enabled?: Maybe<boolean>;
-
-  excluded?: Maybe<boolean>;
-
-  kqlQuery?: Maybe<string>;
-
-  queryMatch?: Maybe<QueryMatchInput>;
-
-  and?: Maybe<DataProviderInput[]>;
-
-  type?: Maybe<DataProviderType>;
-}
-
-export interface QueryMatchInput {
-  field?: Maybe<string>;
-
-  displayField?: Maybe<string>;
-
-  value?: Maybe<string>;
-
-  displayValue?: Maybe<string>;
-
-  operator?: Maybe<string>;
-}
-
-export interface EqlOptionsInput {
-  eventCategoryField?: Maybe<string>;
-
-  tiebreakerField?: Maybe<string>;
-
-  timestampField?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  size?: Maybe<ToAny>;
-}
-
-export interface FilterTimelineInput {
-  exists?: Maybe<string>;
-
-  meta?: Maybe<FilterMetaTimelineInput>;
-
-  match_all?: Maybe<string>;
-
-  missing?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  range?: Maybe<string>;
-
-  script?: Maybe<string>;
-}
-
-export interface FilterMetaTimelineInput {
-  alias?: Maybe<string>;
-
-  controlledBy?: Maybe<string>;
-
-  disabled?: Maybe<boolean>;
-
-  field?: Maybe<string>;
-
-  formattedValue?: Maybe<string>;
-
-  index?: Maybe<string>;
-
-  key?: Maybe<string>;
-
-  negate?: Maybe<boolean>;
-
-  params?: Maybe<string>;
-
-  type?: Maybe<string>;
-
-  value?: Maybe<string>;
-}
-
-export interface SerializedFilterQueryInput {
-  filterQuery?: Maybe<SerializedKueryQueryInput>;
-}
-
-export interface SerializedKueryQueryInput {
-  kuery?: Maybe<KueryFilterQueryInput>;
-
-  serializedQuery?: Maybe<string>;
-}
-
-export interface KueryFilterQueryInput {
-  kind?: Maybe<string>;
-
-  expression?: Maybe<string>;
-}
-
-export interface DateRangePickerInput {
-  start?: Maybe<ToAny>;
-
-  end?: Maybe<ToAny>;
-}
-
-export interface SortTimelineInput {
-  columnId?: Maybe<string>;
-
-  sortDirection?: Maybe<string>;
-}
-
-export interface TimerangeInput {
-  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
-  interval: string;
-  /** The end of the timerange */
-  to: string;
-  /** The beginning of the timerange */
-  from: string;
-}
-
-export interface DocValueFieldsInput {
-  field: string;
-
-  format: string;
-}
-
-export interface PaginationInput {
-  /** The limit parameter allows you to configure the maximum amount of items to be returned */
-  limit: number;
-  /** The cursor parameter defines the next result you want to fetch */
-  cursor?: Maybe<string>;
-  /** The tiebreaker parameter allow to be more precise to fetch the next item */
-  tiebreaker?: Maybe<string>;
-}
-
-export interface PaginationInputPaginated {
-  /** The activePage parameter defines the page of results you want to fetch */
-  activePage: number;
-  /** The cursorStart parameter defines the start of the results to be displayed */
-  cursorStart: number;
-  /** The fakePossibleCount parameter determines the total count in order to show 5 additional pages */
-  fakePossibleCount: number;
-  /** The querySize parameter is the number of items to be returned */
-  querySize: number;
-}
-
-export interface SortField {
-  sortFieldId: string;
-
-  direction: Direction;
-}
-
-export interface FavoriteTimelineInput {
-  fullName?: Maybe<string>;
-
-  userName?: Maybe<string>;
-
-  favoriteDate?: Maybe<number>;
-}
-
-export enum SortFieldNote {
-  updatedBy = 'updatedBy',
-  updated = 'updated',
-}
-
-export enum Direction {
-  asc = 'asc',
-  desc = 'desc',
-}
-
-export enum TimelineType {
-  default = 'default',
-  template = 'template',
-}
-
-export enum DataProviderType {
-  default = 'default',
-  template = 'template',
-}
-
-export enum RowRendererId {
-  alerts = 'alerts',
-  auditd = 'auditd',
-  auditd_file = 'auditd_file',
-  library = 'library',
-  netflow = 'netflow',
-  plain = 'plain',
-  registry = 'registry',
-  suricata = 'suricata',
-  system = 'system',
-  system_dns = 'system_dns',
-  system_endgame_process = 'system_endgame_process',
-  system_file = 'system_file',
-  system_fim = 'system_fim',
-  system_security_event = 'system_security_event',
-  system_socket = 'system_socket',
-  threat_match = 'threat_match',
-  zeek = 'zeek',
-}
-
-export enum TimelineStatus {
-  active = 'active',
-  draft = 'draft',
-  immutable = 'immutable',
-}
-
-export enum SortFieldTimeline {
-  title = 'title',
-  description = 'description',
-  updated = 'updated',
-  created = 'created',
-}
-
-export enum FlowTarget {
-  client = 'client',
-  destination = 'destination',
-  server = 'server',
-  source = 'source',
-}
-
-export enum FlowTargetSourceDest {
-  destination = 'destination',
-  source = 'source',
-}
-
-export enum FlowDirection {
-  uniDirectional = 'uniDirectional',
-  biDirectional = 'biDirectional',
-}
-
-export type ToAny = any;
-
-export type ToStringArray = string[] | string;
-
-export type ToStringArrayNoNullable = any;
-
-export type ToDateArray = string[] | string;
-
-export type ToNumberArray = number[] | number;
-
-export type ToBooleanArray = boolean[] | boolean;
-
-export type Date = string;
-
-export type ToIFieldSubTypeNonNullable = any;
-
-// ====================================================
-// Scalars
-// ====================================================
-
-// ====================================================
-// Types
-// ====================================================
-
-export interface Query {
-  getNote: NoteResult;
-
-  getNotesByTimelineId: NoteResult[];
-
-  getNotesByEventId: NoteResult[];
-
-  getAllNotes: ResponseNotes;
-
-  getAllPinnedEventsByTimelineId: PinnedEvent[];
-  /** Get a security data source by id */
-  source: Source;
-  /** Get a list of all security data sources */
-  allSources: Source[];
-
-  getOneTimeline: TimelineResult;
-
-  getAllTimeline: ResponseTimelines;
-}
-
-export interface NoteResult {
-  eventId?: Maybe<string>;
-
-  note?: Maybe<string>;
-
-  timelineId?: Maybe<string>;
-
-  noteId: string;
-
-  created?: Maybe<number>;
-
-  createdBy?: Maybe<string>;
-
-  timelineVersion?: Maybe<string>;
-
-  updated?: Maybe<number>;
-
-  updatedBy?: Maybe<string>;
-
-  version?: Maybe<string>;
-}
-
-export interface ResponseNotes {
-  notes: NoteResult[];
-
-  totalCount?: Maybe<number>;
-}
-
-export interface PinnedEvent {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  pinnedEventId: string;
-
-  eventId?: Maybe<string>;
-
-  timelineId?: Maybe<string>;
-
-  timelineVersion?: Maybe<string>;
-
-  created?: Maybe<number>;
-
-  createdBy?: Maybe<string>;
-
-  updated?: Maybe<number>;
-
-  updatedBy?: Maybe<string>;
-
-  version?: Maybe<string>;
-}
-
-export interface Source {
-  /** The id of the source */
-  id: string;
-  /** The raw configuration of the source */
-  configuration: SourceConfiguration;
-  /** The status of the source */
-  status: SourceStatus;
-}
-
-/** A set of configuration options for a security data source */
-export interface SourceConfiguration {
-  /** The field mapping to use for this source */
-  fields: SourceFields;
-}
-
-/** A mapping of semantic fields to their document counterparts */
-export interface SourceFields {
-  /** The field to identify a container by */
-  container: string;
-  /** The fields to identify a host by */
-  host: string;
-  /** The fields that may contain the log event message. The first field found win. */
-  message: string[];
-  /** The field to identify a pod by */
-  pod: string;
-  /** The field to use as a tiebreaker for log events that have identical timestamps */
-  tiebreaker: string;
-  /** The field to use as a timestamp for metrics and logs */
-  timestamp: string;
-}
-
-/** The status of an infrastructure data source */
-export interface SourceStatus {
-  /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */
-  indicesExist: boolean;
-  /** The list of fields defined in the index mappings */
-  indexFields: string[];
-}
-
-export interface TimelineResult {
-  columns?: Maybe<ColumnHeaderResult[]>;
-
-  created?: Maybe<number>;
-
-  createdBy?: Maybe<string>;
-
-  dataProviders?: Maybe<DataProviderResult[]>;
-
-  dateRange?: Maybe<DateRangePickerResult>;
-
-  description?: Maybe<string>;
-
-  eqlOptions?: Maybe<EqlOptionsResult>;
-
-  eventIdToNoteIds?: Maybe<NoteResult[]>;
-
-  eventType?: Maybe<string>;
-
-  excludedRowRendererIds?: Maybe<RowRendererId[]>;
-
-  favorite?: Maybe<FavoriteTimelineResult[]>;
-
-  filters?: Maybe<FilterTimelineResult[]>;
-
-  kqlMode?: Maybe<string>;
-
-  kqlQuery?: Maybe<SerializedFilterQueryResult>;
-
-  indexNames?: Maybe<string[]>;
-
-  notes?: Maybe<NoteResult[]>;
-
-  noteIds?: Maybe<string[]>;
-
-  pinnedEventIds?: Maybe<string[]>;
-
-  pinnedEventsSaveObject?: Maybe<PinnedEvent[]>;
-
-  savedQueryId?: Maybe<string>;
-
-  savedObjectId: string;
-
-  sort?: Maybe<ToAny>;
-
-  status?: Maybe<TimelineStatus>;
-
-  title?: Maybe<string>;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  updated?: Maybe<number>;
-
-  updatedBy?: Maybe<string>;
-
-  version: string;
-}
-
-export interface ColumnHeaderResult {
-  aggregatable?: Maybe<boolean>;
-
-  category?: Maybe<string>;
-
-  columnHeaderType?: Maybe<string>;
-
-  description?: Maybe<string>;
-
-  example?: Maybe<string>;
-
-  indexes?: Maybe<string[]>;
-
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  placeholder?: Maybe<string>;
-
-  searchable?: Maybe<boolean>;
-
-  type?: Maybe<string>;
-}
-
-export interface DataProviderResult {
-  id?: Maybe<string>;
-
-  name?: Maybe<string>;
-
-  enabled?: Maybe<boolean>;
-
-  excluded?: Maybe<boolean>;
-
-  kqlQuery?: Maybe<string>;
-
-  queryMatch?: Maybe<QueryMatchResult>;
-
-  type?: Maybe<DataProviderType>;
-
-  and?: Maybe<DataProviderResult[]>;
-}
-
-export interface QueryMatchResult {
-  field?: Maybe<string>;
-
-  displayField?: Maybe<string>;
-
-  value?: Maybe<string>;
-
-  displayValue?: Maybe<string>;
-
-  operator?: Maybe<string>;
-}
-
-export interface DateRangePickerResult {
-  start?: Maybe<ToAny>;
-
-  end?: Maybe<ToAny>;
-}
-
-export interface EqlOptionsResult {
-  eventCategoryField?: Maybe<string>;
-
-  tiebreakerField?: Maybe<string>;
-
-  timestampField?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  size?: Maybe<ToAny>;
-}
-
-export interface FavoriteTimelineResult {
-  fullName?: Maybe<string>;
-
-  userName?: Maybe<string>;
-
-  favoriteDate?: Maybe<number>;
-}
-
-export interface FilterTimelineResult {
-  exists?: Maybe<string>;
-
-  meta?: Maybe<FilterMetaTimelineResult>;
-
-  match_all?: Maybe<string>;
-
-  missing?: Maybe<string>;
-
-  query?: Maybe<string>;
-
-  range?: Maybe<string>;
-
-  script?: Maybe<string>;
-}
-
-export interface FilterMetaTimelineResult {
-  alias?: Maybe<string>;
-
-  controlledBy?: Maybe<string>;
-
-  disabled?: Maybe<boolean>;
-
-  field?: Maybe<string>;
-
-  formattedValue?: Maybe<string>;
-
-  index?: Maybe<string>;
-
-  key?: Maybe<string>;
-
-  negate?: Maybe<boolean>;
-
-  params?: Maybe<string>;
-
-  type?: Maybe<string>;
-
-  value?: Maybe<string>;
-}
-
-export interface SerializedFilterQueryResult {
-  filterQuery?: Maybe<SerializedKueryQueryResult>;
-}
-
-export interface SerializedKueryQueryResult {
-  kuery?: Maybe<KueryFilterQueryResult>;
-
-  serializedQuery?: Maybe<string>;
-}
-
-export interface KueryFilterQueryResult {
-  kind?: Maybe<string>;
-
-  expression?: Maybe<string>;
-}
-
-export interface ResponseTimelines {
-  timeline: (Maybe<TimelineResult>)[];
-
-  totalCount?: Maybe<number>;
-
-  defaultTimelineCount?: Maybe<number>;
-
-  templateTimelineCount?: Maybe<number>;
-
-  elasticTemplateTimelineCount?: Maybe<number>;
-
-  customTemplateTimelineCount?: Maybe<number>;
-
-  favoriteCount?: Maybe<number>;
-}
-
-export interface Mutation {
-  /** Persists a note */
-  persistNote: ResponseNote;
-
-  deleteNote?: Maybe<boolean>;
-
-  deleteNoteByTimelineId?: Maybe<boolean>;
-  /** Persists a pinned event in a timeline */
-  persistPinnedEventOnTimeline?: Maybe<PinnedEvent>;
-  /** Remove a pinned events in a timeline */
-  deletePinnedEventOnTimeline: boolean;
-  /** Remove all pinned events in a timeline */
-  deleteAllPinnedEventsOnTimeline: boolean;
-  /** Persists a timeline */
-  persistTimeline: ResponseTimeline;
-
-  persistFavorite: ResponseFavoriteTimeline;
-
-  deleteTimeline: boolean;
-}
-
-export interface ResponseNote {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  note: NoteResult;
-}
-
-export interface ResponseTimeline {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  timeline: TimelineResult;
-}
-
-export interface ResponseFavoriteTimeline {
-  code?: Maybe<number>;
-
-  message?: Maybe<string>;
-
-  savedObjectId: string;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  version: string;
-
-  favorite?: Maybe<FavoriteTimelineResult[]>;
-}
-
-export interface EventEcsFields {
-  action?: Maybe<string[] | string>;
-
-  category?: Maybe<string[] | string>;
-
-  code?: Maybe<string[] | string>;
-
-  created?: Maybe<string[] | string>;
-
-  dataset?: Maybe<string[] | string>;
-
-  duration?: Maybe<number[] | number>;
-
-  end?: Maybe<string[] | string>;
-
-  hash?: Maybe<string[] | string>;
-
-  id?: Maybe<string[] | string>;
-
-  kind?: Maybe<string[] | string>;
-
-  module?: Maybe<string[] | string>;
-
-  original?: Maybe<string[] | string>;
-
-  outcome?: Maybe<string[] | string>;
-
-  risk_score?: Maybe<number[] | number>;
-
-  risk_score_norm?: Maybe<number[] | number>;
-
-  severity?: Maybe<number[] | number>;
-
-  start?: Maybe<string[] | string>;
-
-  timezone?: Maybe<string[] | string>;
-
-  type?: Maybe<string[] | string>;
-}
-
-export interface Location {
-  lon?: Maybe<number[] | number>;
-
-  lat?: Maybe<number[] | number>;
-}
-
-export interface GeoEcsFields {
-  city_name?: Maybe<string[] | string>;
-
-  continent_name?: Maybe<string[] | string>;
-
-  country_iso_code?: Maybe<string[] | string>;
-
-  country_name?: Maybe<string[] | string>;
-
-  location?: Maybe<Location>;
-
-  region_iso_code?: Maybe<string[] | string>;
-
-  region_name?: Maybe<string[] | string>;
-}
-
-export interface PrimarySecondary {
-  primary?: Maybe<string[] | string>;
-
-  secondary?: Maybe<string[] | string>;
-
-  type?: Maybe<string[] | string>;
-}
-
-export interface Summary {
-  actor?: Maybe<PrimarySecondary>;
-
-  object?: Maybe<PrimarySecondary>;
-
-  how?: Maybe<string[] | string>;
-
-  message_type?: Maybe<string[] | string>;
-
-  sequence?: Maybe<string[] | string>;
-}
-
-export interface AgentEcsField {
-  type?: Maybe<string[] | string>;
-}
-
-export interface AuditdData {
-  acct?: Maybe<string[] | string>;
-
-  terminal?: Maybe<string[] | string>;
-
-  op?: Maybe<string[] | string>;
-}
-
-export interface AuditdEcsFields {
-  result?: Maybe<string[] | string>;
-
-  session?: Maybe<string[] | string>;
-
-  data?: Maybe<AuditdData>;
-
-  summary?: Maybe<Summary>;
-
-  sequence?: Maybe<string[] | string>;
-}
-
-export interface OsEcsFields {
-  platform?: Maybe<string[] | string>;
-
-  name?: Maybe<string[] | string>;
-
-  full?: Maybe<string[] | string>;
-
-  family?: Maybe<string[] | string>;
-
-  version?: Maybe<string[] | string>;
-
-  kernel?: Maybe<string[] | string>;
-}
-
-export interface HostEcsFields {
-  architecture?: Maybe<string[] | string>;
-
-  id?: Maybe<string[] | string>;
-
-  ip?: Maybe<string[] | string>;
-
-  mac?: Maybe<string[] | string>;
-
-  name?: Maybe<string[] | string>;
-
-  os?: Maybe<OsEcsFields>;
-
-  type?: Maybe<string[] | string>;
-}
-
-export interface Thread {
-  id?: Maybe<number[] | number>;
-
-  start?: Maybe<string[] | string>;
-}
-
-export interface ProcessHashData {
-  md5?: Maybe<string[] | string>;
-
-  sha1?: Maybe<string[] | string>;
-
-  sha256?: Maybe<string[] | string>;
-}
-
-export interface ProcessEcsFields {
-  hash?: Maybe<ProcessHashData>;
-
-  pid?: Maybe<number[] | number>;
-
-  name?: Maybe<string[] | string>;
-
-  ppid?: Maybe<number[] | number>;
-
-  args?: Maybe<string[] | string>;
-
-  entity_id?: Maybe<string[] | string>;
-
-  executable?: Maybe<string[] | string>;
-
-  title?: Maybe<string[] | string>;
-
-  thread?: Maybe<Thread>;
-
-  working_directory?: Maybe<string[] | string>;
-}
-
-export interface SourceEcsFields {
-  bytes?: Maybe<number[] | number>;
-
-  ip?: Maybe<string[] | string>;
-
-  port?: Maybe<number[] | number>;
-
-  domain?: Maybe<string[] | string>;
-
-  geo?: Maybe<GeoEcsFields>;
-
-  packets?: Maybe<number[] | number>;
-}
-
-export interface DestinationEcsFields {
-  bytes?: Maybe<number[] | number>;
-
-  ip?: Maybe<string[] | string>;
-
-  port?: Maybe<number[] | number>;
-
-  domain?: Maybe<string[] | string>;
-
-  geo?: Maybe<GeoEcsFields>;
-
-  packets?: Maybe<number[] | number>;
-}
-
-export interface DnsQuestionData {
-  name?: Maybe<string[] | string>;
-
-  type?: Maybe<string[] | string>;
-}
-
-export interface DnsEcsFields {
-  question?: Maybe<DnsQuestionData>;
-
-  resolved_ip?: Maybe<string[] | string>;
-
-  response_code?: Maybe<string[] | string>;
-}
-
-export interface EndgameEcsFields {
-  exit_code?: Maybe<number[] | number>;
-
-  file_name?: Maybe<string[] | string>;
-
-  file_path?: Maybe<string[] | string>;
-
-  logon_type?: Maybe<number[] | number>;
-
-  parent_process_name?: Maybe<string[] | string>;
-
-  pid?: Maybe<number[] | number>;
-
-  process_name?: Maybe<string[] | string>;
-
-  subject_domain_name?: Maybe<string[] | string>;
-
-  subject_logon_id?: Maybe<string[] | string>;
-
-  subject_user_name?: Maybe<string[] | string>;
-
-  target_domain_name?: Maybe<string[] | string>;
-
-  target_logon_id?: Maybe<string[] | string>;
-
-  target_user_name?: Maybe<string[] | string>;
-}
-
-export interface SuricataAlertData {
-  signature?: Maybe<string[] | string>;
-
-  signature_id?: Maybe<number[] | number>;
-}
-
-export interface SuricataEveData {
-  alert?: Maybe<SuricataAlertData>;
-
-  flow_id?: Maybe<number[] | number>;
-
-  proto?: Maybe<string[] | string>;
-}
-
-export interface SuricataEcsFields {
-  eve?: Maybe<SuricataEveData>;
-}
-
-export interface TlsJa3Data {
-  hash?: Maybe<string[] | string>;
-}
-
-export interface FingerprintData {
-  sha1?: Maybe<string[] | string>;
-}
-
-export interface TlsClientCertificateData {
-  fingerprint?: Maybe<FingerprintData>;
-}
-
-export interface TlsServerCertificateData {
-  fingerprint?: Maybe<FingerprintData>;
-}
-
-export interface TlsFingerprintsData {
-  ja3?: Maybe<TlsJa3Data>;
-}
-
-export interface TlsEcsFields {
-  client_certificate?: Maybe<TlsClientCertificateData>;
-
-  fingerprints?: Maybe<TlsFingerprintsData>;
-
-  server_certificate?: Maybe<TlsServerCertificateData>;
-}
-
-export interface ZeekConnectionData {
-  local_resp?: Maybe<boolean[] | boolean>;
-
-  local_orig?: Maybe<boolean[] | boolean>;
-
-  missed_bytes?: Maybe<number[] | number>;
-
-  state?: Maybe<string[] | string>;
-
-  history?: Maybe<string[] | string>;
-}
-
-export interface ZeekNoticeData {
-  suppress_for?: Maybe<number[] | number>;
-
-  msg?: Maybe<string[] | string>;
-
-  note?: Maybe<string[] | string>;
-
-  sub?: Maybe<string[] | string>;
-
-  dst?: Maybe<string[] | string>;
-
-  dropped?: Maybe<boolean[] | boolean>;
-
-  peer_descr?: Maybe<string[] | string>;
-}
-
-export interface ZeekDnsData {
-  AA?: Maybe<boolean[] | boolean>;
-
-  qclass_name?: Maybe<string[] | string>;
-
-  RD?: Maybe<boolean[] | boolean>;
-
-  qtype_name?: Maybe<string[] | string>;
-
-  rejected?: Maybe<boolean[] | boolean>;
-
-  qtype?: Maybe<string[] | string>;
-
-  query?: Maybe<string[] | string>;
-
-  trans_id?: Maybe<number[] | number>;
-
-  qclass?: Maybe<string[] | string>;
-
-  RA?: Maybe<boolean[] | boolean>;
-
-  TC?: Maybe<boolean[] | boolean>;
-}
-
-export interface FileFields {
-  name?: Maybe<string[] | string>;
-
-  path?: Maybe<string[] | string>;
-
-  target_path?: Maybe<string[] | string>;
-
-  extension?: Maybe<string[] | string>;
-
-  type?: Maybe<string[] | string>;
-
-  device?: Maybe<string[] | string>;
-
-  inode?: Maybe<string[] | string>;
-
-  uid?: Maybe<string[] | string>;
-
-  owner?: Maybe<string[] | string>;
-
-  gid?: Maybe<string[] | string>;
-
-  group?: Maybe<string[] | string>;
-
-  mode?: Maybe<string[] | string>;
-
-  size?: Maybe<number[] | number>;
-
-  mtime?: Maybe<string[] | string>;
-
-  ctime?: Maybe<string[] | string>;
-}
-
-export interface ZeekHttpData {
-  resp_mime_types?: Maybe<string[] | string>;
-
-  trans_depth?: Maybe<string[] | string>;
-
-  status_msg?: Maybe<string[] | string>;
-
-  resp_fuids?: Maybe<string[] | string>;
-
-  tags?: Maybe<string[] | string>;
-}
-
-export interface HttpBodyData {
-  content?: Maybe<string[] | string>;
-
-  bytes?: Maybe<number[] | number>;
-}
-
-export interface HttpRequestData {
-  method?: Maybe<string[] | string>;
-
-  body?: Maybe<HttpBodyData>;
-
-  referrer?: Maybe<string[] | string>;
-
-  bytes?: Maybe<number[] | number>;
-}
-
-export interface HttpResponseData {
-  status_code?: Maybe<number[] | number>;
-
-  body?: Maybe<HttpBodyData>;
-
-  bytes?: Maybe<number[] | number>;
-}
-
-export interface HttpEcsFields {
-  version?: Maybe<string[] | string>;
-
-  request?: Maybe<HttpRequestData>;
-
-  response?: Maybe<HttpResponseData>;
-}
-
-export interface UrlEcsFields {
-  domain?: Maybe<string[] | string>;
-
-  original?: Maybe<string[] | string>;
-
-  username?: Maybe<string[] | string>;
-
-  password?: Maybe<string[] | string>;
-}
-
-export interface ZeekFileData {
-  session_ids?: Maybe<string[] | string>;
-
-  timedout?: Maybe<boolean[] | boolean>;
-
-  local_orig?: Maybe<boolean[] | boolean>;
-
-  tx_host?: Maybe<string[] | string>;
-
-  source?: Maybe<string[] | string>;
-
-  is_orig?: Maybe<boolean[] | boolean>;
-
-  overflow_bytes?: Maybe<number[] | number>;
-
-  sha1?: Maybe<string[] | string>;
-
-  duration?: Maybe<number[] | number>;
-
-  depth?: Maybe<number[] | number>;
-
-  analyzers?: Maybe<string[] | string>;
-
-  mime_type?: Maybe<string[] | string>;
-
-  rx_host?: Maybe<string[] | string>;
-
-  total_bytes?: Maybe<number[] | number>;
-
-  fuid?: Maybe<string[] | string>;
-
-  seen_bytes?: Maybe<number[] | number>;
-
-  missing_bytes?: Maybe<number[] | number>;
-
-  md5?: Maybe<string[] | string>;
-}
-
-export interface ZeekSslData {
-  cipher?: Maybe<string[] | string>;
-
-  established?: Maybe<boolean[] | boolean>;
-
-  resumed?: Maybe<boolean[] | boolean>;
-
-  version?: Maybe<string[] | string>;
-}
-
-export interface ZeekEcsFields {
-  session_id?: Maybe<string[] | string>;
-
-  connection?: Maybe<ZeekConnectionData>;
-
-  notice?: Maybe<ZeekNoticeData>;
-
-  dns?: Maybe<ZeekDnsData>;
-
-  http?: Maybe<ZeekHttpData>;
-
-  files?: Maybe<ZeekFileData>;
-
-  ssl?: Maybe<ZeekSslData>;
-}
-
-export interface UserEcsFields {
-  domain?: Maybe<string[] | string>;
-
-  id?: Maybe<string[] | string>;
-
-  name?: Maybe<string[] | string>;
-
-  full_name?: Maybe<string[] | string>;
-
-  email?: Maybe<string[] | string>;
-
-  hash?: Maybe<string[] | string>;
-
-  group?: Maybe<string[] | string>;
-}
-
-export interface WinlogEcsFields {
-  event_id?: Maybe<number[] | number>;
-}
-
-export interface NetworkEcsField {
-  bytes?: Maybe<number[] | number>;
-
-  community_id?: Maybe<string[] | string>;
-
-  direction?: Maybe<string[] | string>;
-
-  packets?: Maybe<number[] | number>;
-
-  protocol?: Maybe<string[] | string>;
-
-  transport?: Maybe<string[] | string>;
-}
-
-export interface PackageEcsFields {
-  arch?: Maybe<string[] | string>;
-
-  entity_id?: Maybe<string[] | string>;
-
-  name?: Maybe<string[] | string>;
-
-  size?: Maybe<number[] | number>;
-
-  summary?: Maybe<string[] | string>;
-
-  version?: Maybe<string[] | string>;
-}
-
-export interface AuditEcsFields {
-  package?: Maybe<PackageEcsFields>;
-}
-
-export interface SshEcsFields {
-  method?: Maybe<string[] | string>;
-
-  signature?: Maybe<string[] | string>;
-}
-
-export interface AuthEcsFields {
-  ssh?: Maybe<SshEcsFields>;
-}
-
-export interface SystemEcsField {
-  audit?: Maybe<AuditEcsFields>;
-
-  auth?: Maybe<AuthEcsFields>;
-}
-
-export interface RuleField {
-  id?: Maybe<string[] | string>;
-
-  rule_id?: Maybe<string[] | string>;
-
-  false_positives: string[];
-
-  saved_id?: Maybe<string[] | string>;
-
-  timeline_id?: Maybe<string[] | string>;
-
-  timeline_title?: Maybe<string[] | string>;
-
-  max_signals?: Maybe<number[] | number>;
-
-  risk_score?: Maybe<string[] | string>;
-
-  output_index?: Maybe<string[] | string>;
-
-  description?: Maybe<string[] | string>;
-
-  from?: Maybe<string[] | string>;
-
-  immutable?: Maybe<boolean[] | boolean>;
-
-  index?: Maybe<string[] | string>;
-
-  interval?: Maybe<string[] | string>;
-
-  language?: Maybe<string[] | string>;
-
-  query?: Maybe<string[] | string>;
-
-  references?: Maybe<string[] | string>;
-
-  severity?: Maybe<string[] | string>;
-
-  tags?: Maybe<string[] | string>;
-
-  threat?: Maybe<ToAny>;
-
-  type?: Maybe<string[] | string>;
-
-  size?: Maybe<string[] | string>;
-
-  to?: Maybe<string[] | string>;
-
-  enabled?: Maybe<boolean[] | boolean>;
-
-  filters?: Maybe<ToAny>;
-
-  created_at?: Maybe<string[] | string>;
-
-  updated_at?: Maybe<string[] | string>;
-
-  created_by?: Maybe<string[] | string>;
-
-  updated_by?: Maybe<string[] | string>;
-
-  version?: Maybe<string[] | string>;
-
-  note?: Maybe<string[] | string>;
-
-  threshold?: Maybe<ToAny>;
-
-  exceptions_list?: Maybe<ToAny>;
-}
-
-export interface SignalField {
-  rule?: Maybe<RuleField>;
-
-  original_time?: Maybe<string[] | string>;
-
-  status?: Maybe<string[] | string>;
-}
-
-export interface RuleEcsField {
-  reference?: Maybe<string[] | string>;
-}
-
-export interface Ecs {
-  _id: string;
-
-  _index?: Maybe<string>;
-
-  agent?: Maybe<AgentEcsField>;
-
-  auditd?: Maybe<AuditdEcsFields>;
-
-  destination?: Maybe<DestinationEcsFields>;
-
-  dns?: Maybe<DnsEcsFields>;
-
-  endgame?: Maybe<EndgameEcsFields>;
-
-  event?: Maybe<EventEcsFields>;
-
-  geo?: Maybe<GeoEcsFields>;
-
-  host?: Maybe<HostEcsFields>;
-
-  network?: Maybe<NetworkEcsField>;
-
-  rule?: Maybe<RuleEcsField>;
-
-  signal?: Maybe<SignalField>;
-
-  source?: Maybe<SourceEcsFields>;
-
-  suricata?: Maybe<SuricataEcsFields>;
-
-  tls?: Maybe<TlsEcsFields>;
-
-  zeek?: Maybe<ZeekEcsFields>;
-
-  http?: Maybe<HttpEcsFields>;
-
-  url?: Maybe<UrlEcsFields>;
-
-  timestamp?: Maybe<string>;
-
-  message?: Maybe<string[] | string>;
-
-  user?: Maybe<UserEcsFields>;
-
-  winlog?: Maybe<WinlogEcsFields>;
-
-  process?: Maybe<ProcessEcsFields>;
-
-  file?: Maybe<FileFields>;
-
-  system?: Maybe<SystemEcsField>;
-}
-
-export interface EcsEdges {
-  node: Ecs;
-
-  cursor: CursorType;
-}
-
-export interface CursorType {
-  value?: Maybe<string>;
-
-  tiebreaker?: Maybe<string>;
-}
-
-/** A descriptor of a field in an index */
-export interface IndexField {
-  /** Where the field belong */
-  category: string;
-  /** Example of field's value */
-  example?: Maybe<string>;
-  /** whether the field's belong to an alias index */
-  indexes: (Maybe<string>)[];
-  /** The name of the field */
-  name: string;
-  /** The type of the field's values as recognized by Kibana */
-  type: string;
-  /** Whether the field's values can be efficiently searched for */
-  searchable: boolean;
-  /** Whether the field's values can be aggregated */
-  aggregatable: boolean;
-  /** Description of the field */
-  description?: Maybe<string>;
-
-  format?: Maybe<string>;
-  /** the elastic type as mapped in the index */
-  esTypes?: Maybe<ToStringArrayNoNullable>;
-
-  subType?: Maybe<ToIFieldSubTypeNonNullable>;
-}
-
-export interface PageInfo {
-  endCursor?: Maybe<CursorType>;
-
-  hasNextPage?: Maybe<boolean>;
-}
-
-export interface Inspect {
-  dsl: string[];
-
-  response: string[];
-}
-
-export interface PageInfoPaginated {
-  activePage: number;
-
-  fakeTotalCount: number;
-
-  showMorePagesIndicator: boolean;
-}
-
-// ====================================================
-// Arguments
-// ====================================================
-
-export interface GetNoteQueryArgs {
-  id: string;
-}
-export interface GetNotesByTimelineIdQueryArgs {
-  timelineId: string;
-}
-export interface GetNotesByEventIdQueryArgs {
-  eventId: string;
-}
-export interface GetAllNotesQueryArgs {
-  pageInfo?: Maybe<PageInfoNote>;
-
-  search?: Maybe<string>;
-
-  sort?: Maybe<SortNote>;
-}
-export interface GetAllPinnedEventsByTimelineIdQueryArgs {
-  timelineId: string;
-}
-export interface SourceQueryArgs {
-  /** The id of the source */
-  id: string;
-}
-export interface GetOneTimelineQueryArgs {
-  id: string;
-
-  timelineType?: Maybe<TimelineType>;
-}
-export interface GetAllTimelineQueryArgs {
-  pageInfo: PageInfoTimeline;
-
-  search?: Maybe<string>;
-
-  sort?: Maybe<SortTimeline>;
-
-  onlyUserFavorite?: Maybe<boolean>;
-
-  timelineType?: Maybe<TimelineType>;
-
-  status?: Maybe<TimelineStatus>;
-}
-export interface IndicesExistSourceStatusArgs {
-  defaultIndex: string[];
-}
-export interface IndexFieldsSourceStatusArgs {
-  defaultIndex: string[];
-}
-export interface PersistNoteMutationArgs {
-  noteId?: Maybe<string>;
-
-  version?: Maybe<string>;
-
-  note: NoteInput;
-}
-export interface DeleteNoteMutationArgs {
-  id: string[];
-}
-export interface DeleteNoteByTimelineIdMutationArgs {
-  timelineId: string;
-
-  version?: Maybe<string>;
-}
-export interface PersistPinnedEventOnTimelineMutationArgs {
-  pinnedEventId?: Maybe<string>;
-
-  eventId: string;
-
-  timelineId?: Maybe<string>;
-}
-export interface DeletePinnedEventOnTimelineMutationArgs {
-  id: string[];
-}
-export interface DeleteAllPinnedEventsOnTimelineMutationArgs {
-  timelineId: string;
-}
-export interface PersistTimelineMutationArgs {
-  id?: Maybe<string>;
-
-  version?: Maybe<string>;
-
-  timeline: TimelineInput;
-}
-export interface PersistFavoriteMutationArgs {
-  timelineId?: Maybe<string>;
-
-  templateTimelineId?: Maybe<string>;
-
-  templateTimelineVersion?: Maybe<number>;
-
-  timelineType?: Maybe<TimelineType>;
-}
-export interface DeleteTimelineMutationArgs {
-  id: string[];
-}
-
-import { GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig } from 'graphql';
-
-export type Resolver<Result, Parent = {}, TContext = {}, Args = {}> = (
-  parent: Parent,
-  args: Args,
-  context: TContext,
-  info: GraphQLResolveInfo
-) => Promise<Result> | Result;
-
-export interface ISubscriptionResolverObject<Result, Parent, TContext, Args> {
-  subscribe<R = Result, P = Parent>(
-    parent: P,
-    args: Args,
-    context: TContext,
-    info: GraphQLResolveInfo
-  ): AsyncIterator<R | Result> | Promise<AsyncIterator<R | Result>>;
-  resolve?<R = Result, P = Parent>(
-    parent: P,
-    args: Args,
-    context: TContext,
-    info: GraphQLResolveInfo
-  ): R | Result | Promise<R | Result>;
-}
-
-export type SubscriptionResolver<Result, Parent = {}, TContext = {}, Args = {}> =
-  | ((...args: any[]) => ISubscriptionResolverObject<Result, Parent, TContext, Args>)
-  | ISubscriptionResolverObject<Result, Parent, TContext, Args>;
-
-export type TypeResolveFn<Types, Parent = {}, TContext = {}> = (
-  parent: Parent,
-  context: TContext,
-  info: GraphQLResolveInfo
-) => Maybe<Types>;
-
-export type NextResolverFn<T> = () => Promise<T>;
-
-export type DirectiveResolverFn<TResult, TArgs = {}, TContext = {}> = (
-  next: NextResolverFn<TResult>,
-  source: any,
-  args: TArgs,
-  context: TContext,
-  info: GraphQLResolveInfo
-) => TResult | Promise<TResult>;
-
-export namespace QueryResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = {}> {
-    getNote?: GetNoteResolver<NoteResult, TypeParent, TContext>;
-
-    getNotesByTimelineId?: GetNotesByTimelineIdResolver<NoteResult[], TypeParent, TContext>;
-
-    getNotesByEventId?: GetNotesByEventIdResolver<NoteResult[], TypeParent, TContext>;
-
-    getAllNotes?: GetAllNotesResolver<ResponseNotes, TypeParent, TContext>;
-
-    getAllPinnedEventsByTimelineId?: GetAllPinnedEventsByTimelineIdResolver<
-      PinnedEvent[],
-      TypeParent,
-      TContext
-    >;
-    /** Get a security data source by id */
-    source?: SourceResolver<Source, TypeParent, TContext>;
-    /** Get a list of all security data sources */
-    allSources?: AllSourcesResolver<Source[], TypeParent, TContext>;
-
-    getOneTimeline?: GetOneTimelineResolver<TimelineResult, TypeParent, TContext>;
-
-    getAllTimeline?: GetAllTimelineResolver<ResponseTimelines, TypeParent, TContext>;
-  }
-
-  export type GetNoteResolver<R = NoteResult, Parent = {}, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext,
-    GetNoteArgs
-  >;
-  export interface GetNoteArgs {
-    id: string;
-  }
-
-  export type GetNotesByTimelineIdResolver<
-    R = NoteResult[],
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, GetNotesByTimelineIdArgs>;
-  export interface GetNotesByTimelineIdArgs {
-    timelineId: string;
-  }
-
-  export type GetNotesByEventIdResolver<
-    R = NoteResult[],
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, GetNotesByEventIdArgs>;
-  export interface GetNotesByEventIdArgs {
-    eventId: string;
-  }
-
-  export type GetAllNotesResolver<
-    R = ResponseNotes,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, GetAllNotesArgs>;
-  export interface GetAllNotesArgs {
-    pageInfo?: Maybe<PageInfoNote>;
-
-    search?: Maybe<string>;
-
-    sort?: Maybe<SortNote>;
-  }
-
-  export type GetAllPinnedEventsByTimelineIdResolver<
-    R = PinnedEvent[],
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, GetAllPinnedEventsByTimelineIdArgs>;
-  export interface GetAllPinnedEventsByTimelineIdArgs {
-    timelineId: string;
-  }
-
-  export type SourceResolver<R = Source, Parent = {}, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext,
-    SourceArgs
-  >;
-  export interface SourceArgs {
-    /** The id of the source */
-    id: string;
-  }
-
-  export type AllSourcesResolver<R = Source[], Parent = {}, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type GetOneTimelineResolver<
-    R = TimelineResult,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, GetOneTimelineArgs>;
-  export interface GetOneTimelineArgs {
-    id: string;
-
-    timelineType?: Maybe<TimelineType>;
-  }
-
-  export type GetAllTimelineResolver<
-    R = ResponseTimelines,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, GetAllTimelineArgs>;
-  export interface GetAllTimelineArgs {
-    pageInfo: PageInfoTimeline;
-
-    search?: Maybe<string>;
-
-    sort?: Maybe<SortTimeline>;
-
-    onlyUserFavorite?: Maybe<boolean>;
-
-    timelineType?: Maybe<TimelineType>;
-
-    status?: Maybe<TimelineStatus>;
-  }
-}
-
-export namespace NoteResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = NoteResult> {
-    eventId?: EventIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    note?: NoteResolver<Maybe<string>, TypeParent, TContext>;
-
-    timelineId?: TimelineIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    noteId?: NoteIdResolver<string, TypeParent, TContext>;
-
-    created?: CreatedResolver<Maybe<number>, TypeParent, TContext>;
-
-    createdBy?: CreatedByResolver<Maybe<string>, TypeParent, TContext>;
-
-    timelineVersion?: TimelineVersionResolver<Maybe<string>, TypeParent, TContext>;
-
-    updated?: UpdatedResolver<Maybe<number>, TypeParent, TContext>;
-
-    updatedBy?: UpdatedByResolver<Maybe<string>, TypeParent, TContext>;
-
-    version?: VersionResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type EventIdResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoteResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineIdResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoteIdResolver<R = string, Parent = NoteResult, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type CreatedResolver<
-    R = Maybe<number>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedByResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineVersionResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedResolver<
-    R = Maybe<number>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedByResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = Maybe<string>,
-    Parent = NoteResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ResponseNotesResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ResponseNotes> {
-    notes?: NotesResolver<NoteResult[], TypeParent, TContext>;
-
-    totalCount?: TotalCountResolver<Maybe<number>, TypeParent, TContext>;
-  }
-
-  export type NotesResolver<
-    R = NoteResult[],
-    Parent = ResponseNotes,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TotalCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseNotes,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace PinnedEventResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = PinnedEvent> {
-    code?: CodeResolver<Maybe<number>, TypeParent, TContext>;
-
-    message?: MessageResolver<Maybe<string>, TypeParent, TContext>;
-
-    pinnedEventId?: PinnedEventIdResolver<string, TypeParent, TContext>;
-
-    eventId?: EventIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    timelineId?: TimelineIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    timelineVersion?: TimelineVersionResolver<Maybe<string>, TypeParent, TContext>;
-
-    created?: CreatedResolver<Maybe<number>, TypeParent, TContext>;
-
-    createdBy?: CreatedByResolver<Maybe<string>, TypeParent, TContext>;
-
-    updated?: UpdatedResolver<Maybe<number>, TypeParent, TContext>;
-
-    updatedBy?: UpdatedByResolver<Maybe<string>, TypeParent, TContext>;
-
-    version?: VersionResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type CodeResolver<
-    R = Maybe<number>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MessageResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PinnedEventIdResolver<
-    R = string,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EventIdResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineIdResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineVersionResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedResolver<
-    R = Maybe<number>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedByResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedResolver<
-    R = Maybe<number>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedByResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = Maybe<string>,
-    Parent = PinnedEvent,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SourceResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = Source> {
-    /** The id of the source */
-    id?: IdResolver<string, TypeParent, TContext>;
-    /** The raw configuration of the source */
-    configuration?: ConfigurationResolver<SourceConfiguration, TypeParent, TContext>;
-    /** The status of the source */
-    status?: StatusResolver<SourceStatus, TypeParent, TContext>;
-  }
-
-  export type IdResolver<R = string, Parent = Source, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type ConfigurationResolver<
-    R = SourceConfiguration,
-    Parent = Source,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StatusResolver<R = SourceStatus, Parent = Source, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-}
-/** A set of configuration options for a security data source */
-export namespace SourceConfigurationResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SourceConfiguration> {
-    /** The field mapping to use for this source */
-    fields?: FieldsResolver<SourceFields, TypeParent, TContext>;
-  }
-
-  export type FieldsResolver<
-    R = SourceFields,
-    Parent = SourceConfiguration,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-/** A mapping of semantic fields to their document counterparts */
-export namespace SourceFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SourceFields> {
-    /** The field to identify a container by */
-    container?: ContainerResolver<string, TypeParent, TContext>;
-    /** The fields to identify a host by */
-    host?: HostResolver<string, TypeParent, TContext>;
-    /** The fields that may contain the log event message. The first field found win. */
-    message?: MessageResolver<string[], TypeParent, TContext>;
-    /** The field to identify a pod by */
-    pod?: PodResolver<string, TypeParent, TContext>;
-    /** The field to use as a tiebreaker for log events that have identical timestamps */
-    tiebreaker?: TiebreakerResolver<string, TypeParent, TContext>;
-    /** The field to use as a timestamp for metrics and logs */
-    timestamp?: TimestampResolver<string, TypeParent, TContext>;
-  }
-
-  export type ContainerResolver<
-    R = string,
-    Parent = SourceFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HostResolver<R = string, Parent = SourceFields, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type MessageResolver<
-    R = string[],
-    Parent = SourceFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PodResolver<R = string, Parent = SourceFields, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type TiebreakerResolver<
-    R = string,
-    Parent = SourceFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimestampResolver<
-    R = string,
-    Parent = SourceFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-/** The status of an infrastructure data source */
-export namespace SourceStatusResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SourceStatus> {
-    /** Whether the configured alias or wildcard pattern resolve to any auditbeat indices */
-    indicesExist?: IndicesExistResolver<boolean, TypeParent, TContext>;
-    /** The list of fields defined in the index mappings */
-    indexFields?: IndexFieldsResolver<string[], TypeParent, TContext>;
-  }
-
-  export type IndicesExistResolver<
-    R = boolean,
-    Parent = SourceStatus,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, IndicesExistArgs>;
-  export interface IndicesExistArgs {
-    defaultIndex: string[];
-  }
-
-  export type IndexFieldsResolver<
-    R = string[],
-    Parent = SourceStatus,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, IndexFieldsArgs>;
-  export interface IndexFieldsArgs {
-    defaultIndex: string[];
-  }
-}
-
-export namespace TimelineResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = TimelineResult> {
-    columns?: ColumnsResolver<Maybe<ColumnHeaderResult[]>, TypeParent, TContext>;
-
-    created?: CreatedResolver<Maybe<number>, TypeParent, TContext>;
-
-    createdBy?: CreatedByResolver<Maybe<string>, TypeParent, TContext>;
-
-    dataProviders?: DataProvidersResolver<Maybe<DataProviderResult[]>, TypeParent, TContext>;
-
-    dateRange?: DateRangeResolver<Maybe<DateRangePickerResult>, TypeParent, TContext>;
-
-    description?: DescriptionResolver<Maybe<string>, TypeParent, TContext>;
-
-    eqlOptions?: EqlOptionsResolver<Maybe<EqlOptionsResult>, TypeParent, TContext>;
-
-    eventIdToNoteIds?: EventIdToNoteIdsResolver<Maybe<NoteResult[]>, TypeParent, TContext>;
-
-    eventType?: EventTypeResolver<Maybe<string>, TypeParent, TContext>;
-
-    excludedRowRendererIds?: ExcludedRowRendererIdsResolver<
-      Maybe<RowRendererId[]>,
-      TypeParent,
-      TContext
-    >;
-
-    favorite?: FavoriteResolver<Maybe<FavoriteTimelineResult[]>, TypeParent, TContext>;
-
-    filters?: FiltersResolver<Maybe<FilterTimelineResult[]>, TypeParent, TContext>;
-
-    kqlMode?: KqlModeResolver<Maybe<string>, TypeParent, TContext>;
-
-    kqlQuery?: KqlQueryResolver<Maybe<SerializedFilterQueryResult>, TypeParent, TContext>;
-
-    indexNames?: IndexNamesResolver<Maybe<string[]>, TypeParent, TContext>;
-
-    notes?: NotesResolver<Maybe<NoteResult[]>, TypeParent, TContext>;
-
-    noteIds?: NoteIdsResolver<Maybe<string[]>, TypeParent, TContext>;
-
-    pinnedEventIds?: PinnedEventIdsResolver<Maybe<string[]>, TypeParent, TContext>;
-
-    pinnedEventsSaveObject?: PinnedEventsSaveObjectResolver<
-      Maybe<PinnedEvent[]>,
-      TypeParent,
-      TContext
-    >;
-
-    savedQueryId?: SavedQueryIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    savedObjectId?: SavedObjectIdResolver<string, TypeParent, TContext>;
-
-    sort?: SortResolver<Maybe<ToAny>, TypeParent, TContext>;
-
-    status?: StatusResolver<Maybe<TimelineStatus>, TypeParent, TContext>;
-
-    title?: TitleResolver<Maybe<string>, TypeParent, TContext>;
-
-    templateTimelineId?: TemplateTimelineIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    templateTimelineVersion?: TemplateTimelineVersionResolver<Maybe<number>, TypeParent, TContext>;
-
-    timelineType?: TimelineTypeResolver<Maybe<TimelineType>, TypeParent, TContext>;
-
-    updated?: UpdatedResolver<Maybe<number>, TypeParent, TContext>;
-
-    updatedBy?: UpdatedByResolver<Maybe<string>, TypeParent, TContext>;
-
-    version?: VersionResolver<string, TypeParent, TContext>;
-  }
-
-  export type ColumnsResolver<
-    R = Maybe<ColumnHeaderResult[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedResolver<
-    R = Maybe<number>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedByResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DataProvidersResolver<
-    R = Maybe<DataProviderResult[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DateRangeResolver<
-    R = Maybe<DateRangePickerResult>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DescriptionResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EqlOptionsResolver<
-    R = Maybe<EqlOptionsResult>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EventIdToNoteIdsResolver<
-    R = Maybe<NoteResult[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EventTypeResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExcludedRowRendererIdsResolver<
-    R = Maybe<RowRendererId[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FavoriteResolver<
-    R = Maybe<FavoriteTimelineResult[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FiltersResolver<
-    R = Maybe<FilterTimelineResult[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type KqlModeResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type KqlQueryResolver<
-    R = Maybe<SerializedFilterQueryResult>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IndexNamesResolver<
-    R = Maybe<string[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NotesResolver<
-    R = Maybe<NoteResult[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoteIdsResolver<
-    R = Maybe<string[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PinnedEventIdsResolver<
-    R = Maybe<string[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PinnedEventsSaveObjectResolver<
-    R = Maybe<PinnedEvent[]>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SavedQueryIdResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SavedObjectIdResolver<
-    R = string,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SortResolver<
-    R = Maybe<ToAny>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StatusResolver<
-    R = Maybe<TimelineStatus>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TitleResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TemplateTimelineIdResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TemplateTimelineVersionResolver<
-    R = Maybe<number>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineTypeResolver<
-    R = Maybe<TimelineType>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedResolver<
-    R = Maybe<number>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedByResolver<
-    R = Maybe<string>,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = string,
-    Parent = TimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ColumnHeaderResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ColumnHeaderResult> {
-    aggregatable?: AggregatableResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    category?: CategoryResolver<Maybe<string>, TypeParent, TContext>;
-
-    columnHeaderType?: ColumnHeaderTypeResolver<Maybe<string>, TypeParent, TContext>;
-
-    description?: DescriptionResolver<Maybe<string>, TypeParent, TContext>;
-
-    example?: ExampleResolver<Maybe<string>, TypeParent, TContext>;
-
-    indexes?: IndexesResolver<Maybe<string[]>, TypeParent, TContext>;
-
-    id?: IdResolver<Maybe<string>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string>, TypeParent, TContext>;
-
-    placeholder?: PlaceholderResolver<Maybe<string>, TypeParent, TContext>;
-
-    searchable?: SearchableResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type AggregatableResolver<
-    R = Maybe<boolean>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CategoryResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ColumnHeaderTypeResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DescriptionResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExampleResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IndexesResolver<
-    R = Maybe<string[]>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IdResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PlaceholderResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SearchableResolver<
-    R = Maybe<boolean>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string>,
-    Parent = ColumnHeaderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace DataProviderResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = DataProviderResult> {
-    id?: IdResolver<Maybe<string>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string>, TypeParent, TContext>;
-
-    enabled?: EnabledResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    excluded?: ExcludedResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    kqlQuery?: KqlQueryResolver<Maybe<string>, TypeParent, TContext>;
-
-    queryMatch?: QueryMatchResolver<Maybe<QueryMatchResult>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<DataProviderType>, TypeParent, TContext>;
-
-    and?: AndResolver<Maybe<DataProviderResult[]>, TypeParent, TContext>;
-  }
-
-  export type IdResolver<
-    R = Maybe<string>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EnabledResolver<
-    R = Maybe<boolean>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExcludedResolver<
-    R = Maybe<boolean>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type KqlQueryResolver<
-    R = Maybe<string>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QueryMatchResolver<
-    R = Maybe<QueryMatchResult>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<DataProviderType>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type AndResolver<
-    R = Maybe<DataProviderResult[]>,
-    Parent = DataProviderResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace QueryMatchResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = QueryMatchResult> {
-    field?: FieldResolver<Maybe<string>, TypeParent, TContext>;
-
-    displayField?: DisplayFieldResolver<Maybe<string>, TypeParent, TContext>;
-
-    value?: ValueResolver<Maybe<string>, TypeParent, TContext>;
-
-    displayValue?: DisplayValueResolver<Maybe<string>, TypeParent, TContext>;
-
-    operator?: OperatorResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type FieldResolver<
-    R = Maybe<string>,
-    Parent = QueryMatchResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DisplayFieldResolver<
-    R = Maybe<string>,
-    Parent = QueryMatchResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ValueResolver<
-    R = Maybe<string>,
-    Parent = QueryMatchResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DisplayValueResolver<
-    R = Maybe<string>,
-    Parent = QueryMatchResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OperatorResolver<
-    R = Maybe<string>,
-    Parent = QueryMatchResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace DateRangePickerResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = DateRangePickerResult> {
-    start?: StartResolver<Maybe<ToAny>, TypeParent, TContext>;
-
-    end?: EndResolver<Maybe<ToAny>, TypeParent, TContext>;
-  }
-
-  export type StartResolver<
-    R = Maybe<ToAny>,
-    Parent = DateRangePickerResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EndResolver<
-    R = Maybe<ToAny>,
-    Parent = DateRangePickerResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace EqlOptionsResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = EqlOptionsResult> {
-    eventCategoryField?: EventCategoryFieldResolver<Maybe<string>, TypeParent, TContext>;
-
-    tiebreakerField?: TiebreakerFieldResolver<Maybe<string>, TypeParent, TContext>;
-
-    timestampField?: TimestampFieldResolver<Maybe<string>, TypeParent, TContext>;
-
-    query?: QueryResolver<Maybe<string>, TypeParent, TContext>;
-
-    size?: SizeResolver<Maybe<ToAny>, TypeParent, TContext>;
-  }
-
-  export type EventCategoryFieldResolver<
-    R = Maybe<string>,
-    Parent = EqlOptionsResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TiebreakerFieldResolver<
-    R = Maybe<string>,
-    Parent = EqlOptionsResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimestampFieldResolver<
-    R = Maybe<string>,
-    Parent = EqlOptionsResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QueryResolver<
-    R = Maybe<string>,
-    Parent = EqlOptionsResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SizeResolver<
-    R = Maybe<ToAny>,
-    Parent = EqlOptionsResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace FavoriteTimelineResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = FavoriteTimelineResult> {
-    fullName?: FullNameResolver<Maybe<string>, TypeParent, TContext>;
-
-    userName?: UserNameResolver<Maybe<string>, TypeParent, TContext>;
-
-    favoriteDate?: FavoriteDateResolver<Maybe<number>, TypeParent, TContext>;
-  }
-
-  export type FullNameResolver<
-    R = Maybe<string>,
-    Parent = FavoriteTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UserNameResolver<
-    R = Maybe<string>,
-    Parent = FavoriteTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FavoriteDateResolver<
-    R = Maybe<number>,
-    Parent = FavoriteTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace FilterTimelineResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = FilterTimelineResult> {
-    exists?: ExistsResolver<Maybe<string>, TypeParent, TContext>;
-
-    meta?: MetaResolver<Maybe<FilterMetaTimelineResult>, TypeParent, TContext>;
-
-    match_all?: MatchAllResolver<Maybe<string>, TypeParent, TContext>;
-
-    missing?: MissingResolver<Maybe<string>, TypeParent, TContext>;
-
-    query?: QueryResolver<Maybe<string>, TypeParent, TContext>;
-
-    range?: RangeResolver<Maybe<string>, TypeParent, TContext>;
-
-    script?: ScriptResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type ExistsResolver<
-    R = Maybe<string>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MetaResolver<
-    R = Maybe<FilterMetaTimelineResult>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MatchAllResolver<
-    R = Maybe<string>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MissingResolver<
-    R = Maybe<string>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QueryResolver<
-    R = Maybe<string>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RangeResolver<
-    R = Maybe<string>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ScriptResolver<
-    R = Maybe<string>,
-    Parent = FilterTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace FilterMetaTimelineResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = FilterMetaTimelineResult> {
-    alias?: AliasResolver<Maybe<string>, TypeParent, TContext>;
-
-    controlledBy?: ControlledByResolver<Maybe<string>, TypeParent, TContext>;
-
-    disabled?: DisabledResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    field?: FieldResolver<Maybe<string>, TypeParent, TContext>;
-
-    formattedValue?: FormattedValueResolver<Maybe<string>, TypeParent, TContext>;
-
-    index?: IndexResolver<Maybe<string>, TypeParent, TContext>;
-
-    key?: KeyResolver<Maybe<string>, TypeParent, TContext>;
-
-    negate?: NegateResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    params?: ParamsResolver<Maybe<string>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string>, TypeParent, TContext>;
-
-    value?: ValueResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type AliasResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ControlledByResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DisabledResolver<
-    R = Maybe<boolean>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FieldResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FormattedValueResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IndexResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type KeyResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NegateResolver<
-    R = Maybe<boolean>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ParamsResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ValueResolver<
-    R = Maybe<string>,
-    Parent = FilterMetaTimelineResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SerializedFilterQueryResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SerializedFilterQueryResult> {
-    filterQuery?: FilterQueryResolver<Maybe<SerializedKueryQueryResult>, TypeParent, TContext>;
-  }
-
-  export type FilterQueryResolver<
-    R = Maybe<SerializedKueryQueryResult>,
-    Parent = SerializedFilterQueryResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SerializedKueryQueryResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SerializedKueryQueryResult> {
-    kuery?: KueryResolver<Maybe<KueryFilterQueryResult>, TypeParent, TContext>;
-
-    serializedQuery?: SerializedQueryResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type KueryResolver<
-    R = Maybe<KueryFilterQueryResult>,
-    Parent = SerializedKueryQueryResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SerializedQueryResolver<
-    R = Maybe<string>,
-    Parent = SerializedKueryQueryResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace KueryFilterQueryResultResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = KueryFilterQueryResult> {
-    kind?: KindResolver<Maybe<string>, TypeParent, TContext>;
-
-    expression?: ExpressionResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type KindResolver<
-    R = Maybe<string>,
-    Parent = KueryFilterQueryResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExpressionResolver<
-    R = Maybe<string>,
-    Parent = KueryFilterQueryResult,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ResponseTimelinesResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ResponseTimelines> {
-    timeline?: TimelineResolver<(Maybe<TimelineResult>)[], TypeParent, TContext>;
-
-    totalCount?: TotalCountResolver<Maybe<number>, TypeParent, TContext>;
-
-    defaultTimelineCount?: DefaultTimelineCountResolver<Maybe<number>, TypeParent, TContext>;
-
-    templateTimelineCount?: TemplateTimelineCountResolver<Maybe<number>, TypeParent, TContext>;
-
-    elasticTemplateTimelineCount?: ElasticTemplateTimelineCountResolver<
-      Maybe<number>,
-      TypeParent,
-      TContext
-    >;
-
-    customTemplateTimelineCount?: CustomTemplateTimelineCountResolver<
-      Maybe<number>,
-      TypeParent,
-      TContext
-    >;
-
-    favoriteCount?: FavoriteCountResolver<Maybe<number>, TypeParent, TContext>;
-  }
-
-  export type TimelineResolver<
-    R = (Maybe<TimelineResult>)[],
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TotalCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DefaultTimelineCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TemplateTimelineCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ElasticTemplateTimelineCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CustomTemplateTimelineCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FavoriteCountResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimelines,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace MutationResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = {}> {
-    /** Persists a note */
-    persistNote?: PersistNoteResolver<ResponseNote, TypeParent, TContext>;
-
-    deleteNote?: DeleteNoteResolver<Maybe<boolean>, TypeParent, TContext>;
-
-    deleteNoteByTimelineId?: DeleteNoteByTimelineIdResolver<Maybe<boolean>, TypeParent, TContext>;
-    /** Persists a pinned event in a timeline */
-    persistPinnedEventOnTimeline?: PersistPinnedEventOnTimelineResolver<
-      Maybe<PinnedEvent>,
-      TypeParent,
-      TContext
-    >;
-    /** Remove a pinned events in a timeline */
-    deletePinnedEventOnTimeline?: DeletePinnedEventOnTimelineResolver<
-      boolean,
-      TypeParent,
-      TContext
-    >;
-    /** Remove all pinned events in a timeline */
-    deleteAllPinnedEventsOnTimeline?: DeleteAllPinnedEventsOnTimelineResolver<
-      boolean,
-      TypeParent,
-      TContext
-    >;
-    /** Persists a timeline */
-    persistTimeline?: PersistTimelineResolver<ResponseTimeline, TypeParent, TContext>;
-
-    persistFavorite?: PersistFavoriteResolver<ResponseFavoriteTimeline, TypeParent, TContext>;
-
-    deleteTimeline?: DeleteTimelineResolver<boolean, TypeParent, TContext>;
-  }
-
-  export type PersistNoteResolver<R = ResponseNote, Parent = {}, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext,
-    PersistNoteArgs
-  >;
-  export interface PersistNoteArgs {
-    noteId?: Maybe<string>;
-
-    version?: Maybe<string>;
-
-    note: NoteInput;
-  }
-
-  export type DeleteNoteResolver<
-    R = Maybe<boolean>,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, DeleteNoteArgs>;
-  export interface DeleteNoteArgs {
-    id: string[];
-  }
-
-  export type DeleteNoteByTimelineIdResolver<
-    R = Maybe<boolean>,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, DeleteNoteByTimelineIdArgs>;
-  export interface DeleteNoteByTimelineIdArgs {
-    timelineId: string;
-
-    version?: Maybe<string>;
-  }
-
-  export type PersistPinnedEventOnTimelineResolver<
-    R = Maybe<PinnedEvent>,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, PersistPinnedEventOnTimelineArgs>;
-  export interface PersistPinnedEventOnTimelineArgs {
-    pinnedEventId?: Maybe<string>;
-
-    eventId: string;
-
-    timelineId?: Maybe<string>;
-  }
-
-  export type DeletePinnedEventOnTimelineResolver<
-    R = boolean,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, DeletePinnedEventOnTimelineArgs>;
-  export interface DeletePinnedEventOnTimelineArgs {
-    id: string[];
-  }
-
-  export type DeleteAllPinnedEventsOnTimelineResolver<
-    R = boolean,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, DeleteAllPinnedEventsOnTimelineArgs>;
-  export interface DeleteAllPinnedEventsOnTimelineArgs {
-    timelineId: string;
-  }
-
-  export type PersistTimelineResolver<
-    R = ResponseTimeline,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, PersistTimelineArgs>;
-  export interface PersistTimelineArgs {
-    id?: Maybe<string>;
-
-    version?: Maybe<string>;
-
-    timeline: TimelineInput;
-  }
-
-  export type PersistFavoriteResolver<
-    R = ResponseFavoriteTimeline,
-    Parent = {},
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext, PersistFavoriteArgs>;
-  export interface PersistFavoriteArgs {
-    timelineId?: Maybe<string>;
-
-    templateTimelineId?: Maybe<string>;
-
-    templateTimelineVersion?: Maybe<number>;
-
-    timelineType?: Maybe<TimelineType>;
-  }
-
-  export type DeleteTimelineResolver<R = boolean, Parent = {}, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext,
-    DeleteTimelineArgs
-  >;
-  export interface DeleteTimelineArgs {
-    id: string[];
-  }
-}
-
-export namespace ResponseNoteResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ResponseNote> {
-    code?: CodeResolver<Maybe<number>, TypeParent, TContext>;
-
-    message?: MessageResolver<Maybe<string>, TypeParent, TContext>;
-
-    note?: NoteResolver<NoteResult, TypeParent, TContext>;
-  }
-
-  export type CodeResolver<
-    R = Maybe<number>,
-    Parent = ResponseNote,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MessageResolver<
-    R = Maybe<string>,
-    Parent = ResponseNote,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoteResolver<
-    R = NoteResult,
-    Parent = ResponseNote,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ResponseTimelineResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ResponseTimeline> {
-    code?: CodeResolver<Maybe<number>, TypeParent, TContext>;
-
-    message?: MessageResolver<Maybe<string>, TypeParent, TContext>;
-
-    timeline?: TimelineResolver<TimelineResult, TypeParent, TContext>;
-  }
-
-  export type CodeResolver<
-    R = Maybe<number>,
-    Parent = ResponseTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MessageResolver<
-    R = Maybe<string>,
-    Parent = ResponseTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineResolver<
-    R = TimelineResult,
-    Parent = ResponseTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ResponseFavoriteTimelineResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ResponseFavoriteTimeline> {
-    code?: CodeResolver<Maybe<number>, TypeParent, TContext>;
-
-    message?: MessageResolver<Maybe<string>, TypeParent, TContext>;
-
-    savedObjectId?: SavedObjectIdResolver<string, TypeParent, TContext>;
-
-    templateTimelineId?: TemplateTimelineIdResolver<Maybe<string>, TypeParent, TContext>;
-
-    templateTimelineVersion?: TemplateTimelineVersionResolver<Maybe<number>, TypeParent, TContext>;
-
-    timelineType?: TimelineTypeResolver<Maybe<TimelineType>, TypeParent, TContext>;
-
-    version?: VersionResolver<string, TypeParent, TContext>;
-
-    favorite?: FavoriteResolver<Maybe<FavoriteTimelineResult[]>, TypeParent, TContext>;
-  }
-
-  export type CodeResolver<
-    R = Maybe<number>,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MessageResolver<
-    R = Maybe<string>,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SavedObjectIdResolver<
-    R = string,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TemplateTimelineIdResolver<
-    R = Maybe<string>,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TemplateTimelineVersionResolver<
-    R = Maybe<number>,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineTypeResolver<
-    R = Maybe<TimelineType>,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = string,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FavoriteResolver<
-    R = Maybe<FavoriteTimelineResult[]>,
-    Parent = ResponseFavoriteTimeline,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace EventEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = EventEcsFields> {
-    action?: ActionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    category?: CategoryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    code?: CodeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    created?: CreatedResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    dataset?: DatasetResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    duration?: DurationResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    end?: EndResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    hash?: HashResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    id?: IdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    kind?: KindResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    module?: ModuleResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    original?: OriginalResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    outcome?: OutcomeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    risk_score?: RiskScoreResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    risk_score_norm?: RiskScoreNormResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    severity?: SeverityResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    start?: StartResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    timezone?: TimezoneResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ActionResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CategoryResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CodeResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DatasetResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DurationResolver<
-    R = Maybe<number[] | number>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EndResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HashResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IdResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type KindResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ModuleResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OriginalResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OutcomeResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RiskScoreResolver<
-    R = Maybe<number[] | number>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RiskScoreNormResolver<
-    R = Maybe<number[] | number>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SeverityResolver<
-    R = Maybe<number[] | number>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StartResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimezoneResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = EventEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace LocationResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = Location> {
-    lon?: LonResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    lat?: LatResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type LonResolver<
-    R = Maybe<number[] | number>,
-    Parent = Location,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type LatResolver<
-    R = Maybe<number[] | number>,
-    Parent = Location,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace GeoEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = GeoEcsFields> {
-    city_name?: CityNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    continent_name?: ContinentNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    country_iso_code?: CountryIsoCodeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    country_name?: CountryNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    location?: LocationResolver<Maybe<Location>, TypeParent, TContext>;
-
-    region_iso_code?: RegionIsoCodeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    region_name?: RegionNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type CityNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ContinentNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CountryIsoCodeResolver<
-    R = Maybe<string[] | string>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CountryNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type LocationResolver<
-    R = Maybe<Location>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RegionIsoCodeResolver<
-    R = Maybe<string[] | string>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RegionNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = GeoEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace PrimarySecondaryResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = PrimarySecondary> {
-    primary?: PrimaryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    secondary?: SecondaryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type PrimaryResolver<
-    R = Maybe<string[] | string>,
-    Parent = PrimarySecondary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SecondaryResolver<
-    R = Maybe<string[] | string>,
-    Parent = PrimarySecondary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = PrimarySecondary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SummaryResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = Summary> {
-    actor?: ActorResolver<Maybe<PrimarySecondary>, TypeParent, TContext>;
-
-    object?: ObjectResolver<Maybe<PrimarySecondary>, TypeParent, TContext>;
-
-    how?: HowResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    message_type?: MessageTypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    sequence?: SequenceResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ActorResolver<
-    R = Maybe<PrimarySecondary>,
-    Parent = Summary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ObjectResolver<
-    R = Maybe<PrimarySecondary>,
-    Parent = Summary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HowResolver<
-    R = Maybe<string[] | string>,
-    Parent = Summary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MessageTypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = Summary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SequenceResolver<
-    R = Maybe<string[] | string>,
-    Parent = Summary,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace AgentEcsFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = AgentEcsField> {
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = AgentEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace AuditdDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = AuditdData> {
-    acct?: AcctResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    terminal?: TerminalResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    op?: OpResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type AcctResolver<
-    R = Maybe<string[] | string>,
-    Parent = AuditdData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TerminalResolver<
-    R = Maybe<string[] | string>,
-    Parent = AuditdData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OpResolver<
-    R = Maybe<string[] | string>,
-    Parent = AuditdData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace AuditdEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = AuditdEcsFields> {
-    result?: ResultResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    session?: SessionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    data?: DataResolver<Maybe<AuditdData>, TypeParent, TContext>;
-
-    summary?: SummaryResolver<Maybe<Summary>, TypeParent, TContext>;
-
-    sequence?: SequenceResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ResultResolver<
-    R = Maybe<string[] | string>,
-    Parent = AuditdEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SessionResolver<
-    R = Maybe<string[] | string>,
-    Parent = AuditdEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DataResolver<
-    R = Maybe<AuditdData>,
-    Parent = AuditdEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SummaryResolver<
-    R = Maybe<Summary>,
-    Parent = AuditdEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SequenceResolver<
-    R = Maybe<string[] | string>,
-    Parent = AuditdEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace OsEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = OsEcsFields> {
-    platform?: PlatformResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    full?: FullResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    family?: FamilyResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    version?: VersionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    kernel?: KernelResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type PlatformResolver<
-    R = Maybe<string[] | string>,
-    Parent = OsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = OsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FullResolver<
-    R = Maybe<string[] | string>,
-    Parent = OsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FamilyResolver<
-    R = Maybe<string[] | string>,
-    Parent = OsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = Maybe<string[] | string>,
-    Parent = OsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type KernelResolver<
-    R = Maybe<string[] | string>,
-    Parent = OsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace HostEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = HostEcsFields> {
-    architecture?: ArchitectureResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    id?: IdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    ip?: IpResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    mac?: MacResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    os?: OsResolver<Maybe<OsEcsFields>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ArchitectureResolver<
-    R = Maybe<string[] | string>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IdResolver<
-    R = Maybe<string[] | string>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IpResolver<
-    R = Maybe<string[] | string>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MacResolver<
-    R = Maybe<string[] | string>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OsResolver<
-    R = Maybe<OsEcsFields>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = HostEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ThreadResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = Thread> {
-    id?: IdResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    start?: StartResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type IdResolver<
-    R = Maybe<number[] | number>,
-    Parent = Thread,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StartResolver<
-    R = Maybe<string[] | string>,
-    Parent = Thread,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ProcessHashDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ProcessHashData> {
-    md5?: Md5Resolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    sha1?: Sha1Resolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    sha256?: Sha256Resolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type Md5Resolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessHashData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type Sha1Resolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessHashData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type Sha256Resolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessHashData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ProcessEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ProcessEcsFields> {
-    hash?: HashResolver<Maybe<ProcessHashData>, TypeParent, TContext>;
-
-    pid?: PidResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    ppid?: PpidResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    args?: ArgsResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    entity_id?: EntityIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    executable?: ExecutableResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    title?: TitleResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    thread?: ThreadResolver<Maybe<Thread>, TypeParent, TContext>;
-
-    working_directory?: WorkingDirectoryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type HashResolver<
-    R = Maybe<ProcessHashData>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PidResolver<
-    R = Maybe<number[] | number>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PpidResolver<
-    R = Maybe<number[] | number>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ArgsResolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EntityIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExecutableResolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TitleResolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ThreadResolver<
-    R = Maybe<Thread>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type WorkingDirectoryResolver<
-    R = Maybe<string[] | string>,
-    Parent = ProcessEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SourceEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SourceEcsFields> {
-    bytes?: BytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    ip?: IpResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    port?: PortResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    domain?: DomainResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    geo?: GeoResolver<Maybe<GeoEcsFields>, TypeParent, TContext>;
-
-    packets?: PacketsResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type BytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = SourceEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IpResolver<
-    R = Maybe<string[] | string>,
-    Parent = SourceEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PortResolver<
-    R = Maybe<number[] | number>,
-    Parent = SourceEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DomainResolver<
-    R = Maybe<string[] | string>,
-    Parent = SourceEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type GeoResolver<
-    R = Maybe<GeoEcsFields>,
-    Parent = SourceEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PacketsResolver<
-    R = Maybe<number[] | number>,
-    Parent = SourceEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace DestinationEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = DestinationEcsFields> {
-    bytes?: BytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    ip?: IpResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    port?: PortResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    domain?: DomainResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    geo?: GeoResolver<Maybe<GeoEcsFields>, TypeParent, TContext>;
-
-    packets?: PacketsResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type BytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = DestinationEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IpResolver<
-    R = Maybe<string[] | string>,
-    Parent = DestinationEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PortResolver<
-    R = Maybe<number[] | number>,
-    Parent = DestinationEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DomainResolver<
-    R = Maybe<string[] | string>,
-    Parent = DestinationEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type GeoResolver<
-    R = Maybe<GeoEcsFields>,
-    Parent = DestinationEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PacketsResolver<
-    R = Maybe<number[] | number>,
-    Parent = DestinationEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace DnsQuestionDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = DnsQuestionData> {
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = DnsQuestionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = DnsQuestionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace DnsEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = DnsEcsFields> {
-    question?: QuestionResolver<Maybe<DnsQuestionData>, TypeParent, TContext>;
-
-    resolved_ip?: ResolvedIpResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    response_code?: ResponseCodeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type QuestionResolver<
-    R = Maybe<DnsQuestionData>,
-    Parent = DnsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ResolvedIpResolver<
-    R = Maybe<string[] | string>,
-    Parent = DnsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ResponseCodeResolver<
-    R = Maybe<string[] | string>,
-    Parent = DnsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace EndgameEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = EndgameEcsFields> {
-    exit_code?: ExitCodeResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    file_name?: FileNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    file_path?: FilePathResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    logon_type?: LogonTypeResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    parent_process_name?: ParentProcessNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    pid?: PidResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    process_name?: ProcessNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    subject_domain_name?: SubjectDomainNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    subject_logon_id?: SubjectLogonIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    subject_user_name?: SubjectUserNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    target_domain_name?: TargetDomainNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    target_logon_id?: TargetLogonIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    target_user_name?: TargetUserNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ExitCodeResolver<
-    R = Maybe<number[] | number>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FileNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FilePathResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type LogonTypeResolver<
-    R = Maybe<number[] | number>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ParentProcessNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PidResolver<
-    R = Maybe<number[] | number>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ProcessNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SubjectDomainNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SubjectLogonIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SubjectUserNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TargetDomainNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TargetLogonIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TargetUserNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = EndgameEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SuricataAlertDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SuricataAlertData> {
-    signature?: SignatureResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    signature_id?: SignatureIdResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type SignatureResolver<
-    R = Maybe<string[] | string>,
-    Parent = SuricataAlertData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SignatureIdResolver<
-    R = Maybe<number[] | number>,
-    Parent = SuricataAlertData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SuricataEveDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SuricataEveData> {
-    alert?: AlertResolver<Maybe<SuricataAlertData>, TypeParent, TContext>;
-
-    flow_id?: FlowIdResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    proto?: ProtoResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type AlertResolver<
-    R = Maybe<SuricataAlertData>,
-    Parent = SuricataEveData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FlowIdResolver<
-    R = Maybe<number[] | number>,
-    Parent = SuricataEveData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ProtoResolver<
-    R = Maybe<string[] | string>,
-    Parent = SuricataEveData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SuricataEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SuricataEcsFields> {
-    eve?: EveResolver<Maybe<SuricataEveData>, TypeParent, TContext>;
-  }
-
-  export type EveResolver<
-    R = Maybe<SuricataEveData>,
-    Parent = SuricataEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace TlsJa3DataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = TlsJa3Data> {
-    hash?: HashResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type HashResolver<
-    R = Maybe<string[] | string>,
-    Parent = TlsJa3Data,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace FingerprintDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = FingerprintData> {
-    sha1?: Sha1Resolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type Sha1Resolver<
-    R = Maybe<string[] | string>,
-    Parent = FingerprintData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace TlsClientCertificateDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = TlsClientCertificateData> {
-    fingerprint?: FingerprintResolver<Maybe<FingerprintData>, TypeParent, TContext>;
-  }
-
-  export type FingerprintResolver<
-    R = Maybe<FingerprintData>,
-    Parent = TlsClientCertificateData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace TlsServerCertificateDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = TlsServerCertificateData> {
-    fingerprint?: FingerprintResolver<Maybe<FingerprintData>, TypeParent, TContext>;
-  }
-
-  export type FingerprintResolver<
-    R = Maybe<FingerprintData>,
-    Parent = TlsServerCertificateData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace TlsFingerprintsDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = TlsFingerprintsData> {
-    ja3?: Ja3Resolver<Maybe<TlsJa3Data>, TypeParent, TContext>;
-  }
-
-  export type Ja3Resolver<
-    R = Maybe<TlsJa3Data>,
-    Parent = TlsFingerprintsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace TlsEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = TlsEcsFields> {
-    client_certificate?: ClientCertificateResolver<
-      Maybe<TlsClientCertificateData>,
-      TypeParent,
-      TContext
-    >;
-
-    fingerprints?: FingerprintsResolver<Maybe<TlsFingerprintsData>, TypeParent, TContext>;
-
-    server_certificate?: ServerCertificateResolver<
-      Maybe<TlsServerCertificateData>,
-      TypeParent,
-      TContext
-    >;
-  }
-
-  export type ClientCertificateResolver<
-    R = Maybe<TlsClientCertificateData>,
-    Parent = TlsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FingerprintsResolver<
-    R = Maybe<TlsFingerprintsData>,
-    Parent = TlsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ServerCertificateResolver<
-    R = Maybe<TlsServerCertificateData>,
-    Parent = TlsEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekConnectionDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekConnectionData> {
-    local_resp?: LocalRespResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    local_orig?: LocalOrigResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    missed_bytes?: MissedBytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    state?: StateResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    history?: HistoryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type LocalRespResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekConnectionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type LocalOrigResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekConnectionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MissedBytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekConnectionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StateResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekConnectionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HistoryResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekConnectionData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekNoticeDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekNoticeData> {
-    suppress_for?: SuppressForResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    msg?: MsgResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    note?: NoteResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    sub?: SubResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    dst?: DstResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    dropped?: DroppedResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    peer_descr?: PeerDescrResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type SuppressForResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MsgResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoteResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SubResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DstResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DroppedResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PeerDescrResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekNoticeData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekDnsDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekDnsData> {
-    AA?: AaResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    qclass_name?: QclassNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    RD?: RdResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    qtype_name?: QtypeNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    rejected?: RejectedResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    qtype?: QtypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    query?: QueryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    trans_id?: TransIdResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    qclass?: QclassResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    RA?: RaResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    TC?: TcResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-  }
-
-  export type AaResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QclassNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RdResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QtypeNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RejectedResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QtypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QueryResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TransIdResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QclassResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RaResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TcResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekDnsData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace FileFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = FileFields> {
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    path?: PathResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    target_path?: TargetPathResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    extension?: ExtensionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    device?: DeviceResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    inode?: InodeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    uid?: UidResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    owner?: OwnerResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    gid?: GidResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    group?: GroupResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    mode?: ModeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    size?: SizeResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    mtime?: MtimeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    ctime?: CtimeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PathResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TargetPathResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExtensionResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DeviceResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type InodeResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UidResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OwnerResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type GidResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type GroupResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ModeResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SizeResolver<
-    R = Maybe<number[] | number>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MtimeResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CtimeResolver<
-    R = Maybe<string[] | string>,
-    Parent = FileFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekHttpDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekHttpData> {
-    resp_mime_types?: RespMimeTypesResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    trans_depth?: TransDepthResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    status_msg?: StatusMsgResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    resp_fuids?: RespFuidsResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    tags?: TagsResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type RespMimeTypesResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekHttpData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TransDepthResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekHttpData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StatusMsgResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekHttpData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RespFuidsResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekHttpData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TagsResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekHttpData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace HttpBodyDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = HttpBodyData> {
-    content?: ContentResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    bytes?: BytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type ContentResolver<
-    R = Maybe<string[] | string>,
-    Parent = HttpBodyData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type BytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = HttpBodyData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace HttpRequestDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = HttpRequestData> {
-    method?: MethodResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    body?: BodyResolver<Maybe<HttpBodyData>, TypeParent, TContext>;
-
-    referrer?: ReferrerResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    bytes?: BytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type MethodResolver<
-    R = Maybe<string[] | string>,
-    Parent = HttpRequestData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type BodyResolver<
-    R = Maybe<HttpBodyData>,
-    Parent = HttpRequestData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ReferrerResolver<
-    R = Maybe<string[] | string>,
-    Parent = HttpRequestData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type BytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = HttpRequestData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace HttpResponseDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = HttpResponseData> {
-    status_code?: StatusCodeResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    body?: BodyResolver<Maybe<HttpBodyData>, TypeParent, TContext>;
-
-    bytes?: BytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type StatusCodeResolver<
-    R = Maybe<number[] | number>,
-    Parent = HttpResponseData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type BodyResolver<
-    R = Maybe<HttpBodyData>,
-    Parent = HttpResponseData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type BytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = HttpResponseData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace HttpEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = HttpEcsFields> {
-    version?: VersionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    request?: RequestResolver<Maybe<HttpRequestData>, TypeParent, TContext>;
-
-    response?: ResponseResolver<Maybe<HttpResponseData>, TypeParent, TContext>;
-  }
-
-  export type VersionResolver<
-    R = Maybe<string[] | string>,
-    Parent = HttpEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RequestResolver<
-    R = Maybe<HttpRequestData>,
-    Parent = HttpEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ResponseResolver<
-    R = Maybe<HttpResponseData>,
-    Parent = HttpEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace UrlEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = UrlEcsFields> {
-    domain?: DomainResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    original?: OriginalResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    username?: UsernameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    password?: PasswordResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type DomainResolver<
-    R = Maybe<string[] | string>,
-    Parent = UrlEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OriginalResolver<
-    R = Maybe<string[] | string>,
-    Parent = UrlEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UsernameResolver<
-    R = Maybe<string[] | string>,
-    Parent = UrlEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PasswordResolver<
-    R = Maybe<string[] | string>,
-    Parent = UrlEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekFileDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekFileData> {
-    session_ids?: SessionIdsResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    timedout?: TimedoutResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    local_orig?: LocalOrigResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    tx_host?: TxHostResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    source?: SourceResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    is_orig?: IsOrigResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    overflow_bytes?: OverflowBytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    sha1?: Sha1Resolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    duration?: DurationResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    depth?: DepthResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    analyzers?: AnalyzersResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    mime_type?: MimeTypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    rx_host?: RxHostResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    total_bytes?: TotalBytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    fuid?: FuidResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    seen_bytes?: SeenBytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    missing_bytes?: MissingBytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    md5?: Md5Resolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type SessionIdsResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimedoutResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type LocalOrigResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TxHostResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SourceResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IsOrigResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OverflowBytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type Sha1Resolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DurationResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DepthResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type AnalyzersResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MimeTypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RxHostResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TotalBytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FuidResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SeenBytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MissingBytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type Md5Resolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekFileData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekSslDataResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekSslData> {
-    cipher?: CipherResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    established?: EstablishedResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    resumed?: ResumedResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    version?: VersionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type CipherResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekSslData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EstablishedResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekSslData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ResumedResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = ZeekSslData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekSslData,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace ZeekEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = ZeekEcsFields> {
-    session_id?: SessionIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    connection?: ConnectionResolver<Maybe<ZeekConnectionData>, TypeParent, TContext>;
-
-    notice?: NoticeResolver<Maybe<ZeekNoticeData>, TypeParent, TContext>;
-
-    dns?: DnsResolver<Maybe<ZeekDnsData>, TypeParent, TContext>;
-
-    http?: HttpResolver<Maybe<ZeekHttpData>, TypeParent, TContext>;
-
-    files?: FilesResolver<Maybe<ZeekFileData>, TypeParent, TContext>;
-
-    ssl?: SslResolver<Maybe<ZeekSslData>, TypeParent, TContext>;
-  }
-
-  export type SessionIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ConnectionResolver<
-    R = Maybe<ZeekConnectionData>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoticeResolver<
-    R = Maybe<ZeekNoticeData>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DnsResolver<
-    R = Maybe<ZeekDnsData>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HttpResolver<
-    R = Maybe<ZeekHttpData>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FilesResolver<
-    R = Maybe<ZeekFileData>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SslResolver<
-    R = Maybe<ZeekSslData>,
-    Parent = ZeekEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace UserEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = UserEcsFields> {
-    domain?: DomainResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    id?: IdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    full_name?: FullNameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    email?: EmailResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    hash?: HashResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    group?: GroupResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type DomainResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IdResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FullNameResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EmailResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HashResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type GroupResolver<
-    R = Maybe<string[] | string>,
-    Parent = UserEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace WinlogEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = WinlogEcsFields> {
-    event_id?: EventIdResolver<Maybe<number[] | number>, TypeParent, TContext>;
-  }
-
-  export type EventIdResolver<
-    R = Maybe<number[] | number>,
-    Parent = WinlogEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace NetworkEcsFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = NetworkEcsField> {
-    bytes?: BytesResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    community_id?: CommunityIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    direction?: DirectionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    packets?: PacketsResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    protocol?: ProtocolResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    transport?: TransportResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type BytesResolver<
-    R = Maybe<number[] | number>,
-    Parent = NetworkEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CommunityIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = NetworkEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DirectionResolver<
-    R = Maybe<string[] | string>,
-    Parent = NetworkEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type PacketsResolver<
-    R = Maybe<number[] | number>,
-    Parent = NetworkEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ProtocolResolver<
-    R = Maybe<string[] | string>,
-    Parent = NetworkEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TransportResolver<
-    R = Maybe<string[] | string>,
-    Parent = NetworkEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace PackageEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = PackageEcsFields> {
-    arch?: ArchResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    entity_id?: EntityIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    name?: NameResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    size?: SizeResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    summary?: SummaryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    version?: VersionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ArchResolver<
-    R = Maybe<string[] | string>,
-    Parent = PackageEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EntityIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = PackageEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<
-    R = Maybe<string[] | string>,
-    Parent = PackageEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SizeResolver<
-    R = Maybe<number[] | number>,
-    Parent = PackageEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SummaryResolver<
-    R = Maybe<string[] | string>,
-    Parent = PackageEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = Maybe<string[] | string>,
-    Parent = PackageEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace AuditEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = AuditEcsFields> {
-    package?: PackageResolver<Maybe<PackageEcsFields>, TypeParent, TContext>;
-  }
-
-  export type PackageResolver<
-    R = Maybe<PackageEcsFields>,
-    Parent = AuditEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SshEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SshEcsFields> {
-    method?: MethodResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    signature?: SignatureResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type MethodResolver<
-    R = Maybe<string[] | string>,
-    Parent = SshEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SignatureResolver<
-    R = Maybe<string[] | string>,
-    Parent = SshEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace AuthEcsFieldsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = AuthEcsFields> {
-    ssh?: SshResolver<Maybe<SshEcsFields>, TypeParent, TContext>;
-  }
-
-  export type SshResolver<
-    R = Maybe<SshEcsFields>,
-    Parent = AuthEcsFields,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SystemEcsFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SystemEcsField> {
-    audit?: AuditResolver<Maybe<AuditEcsFields>, TypeParent, TContext>;
-
-    auth?: AuthResolver<Maybe<AuthEcsFields>, TypeParent, TContext>;
-  }
-
-  export type AuditResolver<
-    R = Maybe<AuditEcsFields>,
-    Parent = SystemEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type AuthResolver<
-    R = Maybe<AuthEcsFields>,
-    Parent = SystemEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace RuleFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = RuleField> {
-    id?: IdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    rule_id?: RuleIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    false_positives?: FalsePositivesResolver<string[], TypeParent, TContext>;
-
-    saved_id?: SavedIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    timeline_id?: TimelineIdResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    timeline_title?: TimelineTitleResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    max_signals?: MaxSignalsResolver<Maybe<number[] | number>, TypeParent, TContext>;
-
-    risk_score?: RiskScoreResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    output_index?: OutputIndexResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    description?: DescriptionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    from?: FromResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    immutable?: ImmutableResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    index?: IndexResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    interval?: IntervalResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    language?: LanguageResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    query?: QueryResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    references?: ReferencesResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    severity?: SeverityResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    tags?: TagsResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    threat?: ThreatResolver<Maybe<ToAny>, TypeParent, TContext>;
-
-    type?: TypeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    size?: SizeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    to?: ToResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    enabled?: EnabledResolver<Maybe<boolean[] | boolean>, TypeParent, TContext>;
-
-    filters?: FiltersResolver<Maybe<ToAny>, TypeParent, TContext>;
-
-    created_at?: CreatedAtResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    updated_at?: UpdatedAtResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    created_by?: CreatedByResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    updated_by?: UpdatedByResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    version?: VersionResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    note?: NoteResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    threshold?: ThresholdResolver<Maybe<ToAny>, TypeParent, TContext>;
-
-    exceptions_list?: ExceptionsListResolver<Maybe<ToAny>, TypeParent, TContext>;
-  }
-
-  export type IdResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RuleIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FalsePositivesResolver<
-    R = string[],
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SavedIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineIdResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TimelineTitleResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type MaxSignalsResolver<
-    R = Maybe<number[] | number>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RiskScoreResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OutputIndexResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DescriptionResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FromResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ImmutableResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IndexResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IntervalResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type LanguageResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type QueryResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ReferencesResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SeverityResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TagsResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ThreatResolver<
-    R = Maybe<ToAny>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TypeResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SizeResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ToResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EnabledResolver<
-    R = Maybe<boolean[] | boolean>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FiltersResolver<
-    R = Maybe<ToAny>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedAtResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedAtResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type CreatedByResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UpdatedByResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type VersionResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NoteResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ThresholdResolver<
-    R = Maybe<ToAny>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ExceptionsListResolver<
-    R = Maybe<ToAny>,
-    Parent = RuleField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace SignalFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = SignalField> {
-    rule?: RuleResolver<Maybe<RuleField>, TypeParent, TContext>;
-
-    original_time?: OriginalTimeResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    status?: StatusResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type RuleResolver<
-    R = Maybe<RuleField>,
-    Parent = SignalField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type OriginalTimeResolver<
-    R = Maybe<string[] | string>,
-    Parent = SignalField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type StatusResolver<
-    R = Maybe<string[] | string>,
-    Parent = SignalField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace RuleEcsFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = RuleEcsField> {
-    reference?: ReferenceResolver<Maybe<string[] | string>, TypeParent, TContext>;
-  }
-
-  export type ReferenceResolver<
-    R = Maybe<string[] | string>,
-    Parent = RuleEcsField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace EcsResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = Ecs> {
-    _id?: _IdResolver<string, TypeParent, TContext>;
-
-    _index?: _IndexResolver<Maybe<string>, TypeParent, TContext>;
-
-    agent?: AgentResolver<Maybe<AgentEcsField>, TypeParent, TContext>;
-
-    auditd?: AuditdResolver<Maybe<AuditdEcsFields>, TypeParent, TContext>;
-
-    destination?: DestinationResolver<Maybe<DestinationEcsFields>, TypeParent, TContext>;
-
-    dns?: DnsResolver<Maybe<DnsEcsFields>, TypeParent, TContext>;
-
-    endgame?: EndgameResolver<Maybe<EndgameEcsFields>, TypeParent, TContext>;
-
-    event?: EventResolver<Maybe<EventEcsFields>, TypeParent, TContext>;
-
-    geo?: GeoResolver<Maybe<GeoEcsFields>, TypeParent, TContext>;
-
-    host?: HostResolver<Maybe<HostEcsFields>, TypeParent, TContext>;
-
-    network?: NetworkResolver<Maybe<NetworkEcsField>, TypeParent, TContext>;
-
-    rule?: RuleResolver<Maybe<RuleEcsField>, TypeParent, TContext>;
-
-    signal?: SignalResolver<Maybe<SignalField>, TypeParent, TContext>;
-
-    source?: SourceResolver<Maybe<SourceEcsFields>, TypeParent, TContext>;
-
-    suricata?: SuricataResolver<Maybe<SuricataEcsFields>, TypeParent, TContext>;
-
-    tls?: TlsResolver<Maybe<TlsEcsFields>, TypeParent, TContext>;
-
-    zeek?: ZeekResolver<Maybe<ZeekEcsFields>, TypeParent, TContext>;
-
-    http?: HttpResolver<Maybe<HttpEcsFields>, TypeParent, TContext>;
-
-    url?: UrlResolver<Maybe<UrlEcsFields>, TypeParent, TContext>;
-
-    timestamp?: TimestampResolver<Maybe<string>, TypeParent, TContext>;
-
-    message?: MessageResolver<Maybe<string[] | string>, TypeParent, TContext>;
-
-    user?: UserResolver<Maybe<UserEcsFields>, TypeParent, TContext>;
-
-    winlog?: WinlogResolver<Maybe<WinlogEcsFields>, TypeParent, TContext>;
-
-    process?: ProcessResolver<Maybe<ProcessEcsFields>, TypeParent, TContext>;
-
-    file?: FileResolver<Maybe<FileFields>, TypeParent, TContext>;
-
-    system?: SystemResolver<Maybe<SystemEcsField>, TypeParent, TContext>;
-  }
-
-  export type _IdResolver<R = string, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type _IndexResolver<R = Maybe<string>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type AgentResolver<
-    R = Maybe<AgentEcsField>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type AuditdResolver<
-    R = Maybe<AuditdEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DestinationResolver<
-    R = Maybe<DestinationEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DnsResolver<R = Maybe<DnsEcsFields>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type EndgameResolver<
-    R = Maybe<EndgameEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EventResolver<
-    R = Maybe<EventEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type GeoResolver<R = Maybe<GeoEcsFields>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type HostResolver<
-    R = Maybe<HostEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NetworkResolver<
-    R = Maybe<NetworkEcsField>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type RuleResolver<
-    R = Maybe<RuleEcsField>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SignalResolver<
-    R = Maybe<SignalField>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SourceResolver<
-    R = Maybe<SourceEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SuricataResolver<
-    R = Maybe<SuricataEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TlsResolver<R = Maybe<TlsEcsFields>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type ZeekResolver<
-    R = Maybe<ZeekEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HttpResolver<
-    R = Maybe<HttpEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UrlResolver<R = Maybe<UrlEcsFields>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type TimestampResolver<R = Maybe<string>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type MessageResolver<
-    R = Maybe<string[] | string>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type UserResolver<
-    R = Maybe<UserEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type WinlogResolver<
-    R = Maybe<WinlogEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ProcessResolver<
-    R = Maybe<ProcessEcsFields>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FileResolver<R = Maybe<FileFields>, Parent = Ecs, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type SystemResolver<
-    R = Maybe<SystemEcsField>,
-    Parent = Ecs,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace EcsEdgesResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = EcsEdges> {
-    node?: NodeResolver<Ecs, TypeParent, TContext>;
-
-    cursor?: CursorResolver<CursorType, TypeParent, TContext>;
-  }
-
-  export type NodeResolver<R = Ecs, Parent = EcsEdges, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type CursorResolver<R = CursorType, Parent = EcsEdges, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-}
-
-export namespace CursorTypeResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = CursorType> {
-    value?: ValueResolver<Maybe<string>, TypeParent, TContext>;
-
-    tiebreaker?: TiebreakerResolver<Maybe<string>, TypeParent, TContext>;
-  }
-
-  export type ValueResolver<
-    R = Maybe<string>,
-    Parent = CursorType,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type TiebreakerResolver<
-    R = Maybe<string>,
-    Parent = CursorType,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-/** A descriptor of a field in an index */
-export namespace IndexFieldResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = IndexField> {
-    /** Where the field belong */
-    category?: CategoryResolver<string, TypeParent, TContext>;
-    /** Example of field's value */
-    example?: ExampleResolver<Maybe<string>, TypeParent, TContext>;
-    /** whether the field's belong to an alias index */
-    indexes?: IndexesResolver<(Maybe<string>)[], TypeParent, TContext>;
-    /** The name of the field */
-    name?: NameResolver<string, TypeParent, TContext>;
-    /** The type of the field's values as recognized by Kibana */
-    type?: TypeResolver<string, TypeParent, TContext>;
-    /** Whether the field's values can be efficiently searched for */
-    searchable?: SearchableResolver<boolean, TypeParent, TContext>;
-    /** Whether the field's values can be aggregated */
-    aggregatable?: AggregatableResolver<boolean, TypeParent, TContext>;
-    /** Description of the field */
-    description?: DescriptionResolver<Maybe<string>, TypeParent, TContext>;
-
-    format?: FormatResolver<Maybe<string>, TypeParent, TContext>;
-    /** the elastic type as mapped in the index */
-    esTypes?: EsTypesResolver<Maybe<ToStringArrayNoNullable>, TypeParent, TContext>;
-
-    subType?: SubTypeResolver<Maybe<ToIFieldSubTypeNonNullable>, TypeParent, TContext>;
-  }
-
-  export type CategoryResolver<R = string, Parent = IndexField, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type ExampleResolver<
-    R = Maybe<string>,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type IndexesResolver<
-    R = (Maybe<string>)[],
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type NameResolver<R = string, Parent = IndexField, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type TypeResolver<R = string, Parent = IndexField, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type SearchableResolver<
-    R = boolean,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type AggregatableResolver<
-    R = boolean,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type DescriptionResolver<
-    R = Maybe<string>,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FormatResolver<
-    R = Maybe<string>,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type EsTypesResolver<
-    R = Maybe<ToStringArrayNoNullable>,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type SubTypeResolver<
-    R = Maybe<ToIFieldSubTypeNonNullable>,
-    Parent = IndexField,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace PageInfoResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = PageInfo> {
-    endCursor?: EndCursorResolver<Maybe<CursorType>, TypeParent, TContext>;
-
-    hasNextPage?: HasNextPageResolver<Maybe<boolean>, TypeParent, TContext>;
-  }
-
-  export type EndCursorResolver<
-    R = Maybe<CursorType>,
-    Parent = PageInfo,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type HasNextPageResolver<
-    R = Maybe<boolean>,
-    Parent = PageInfo,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-export namespace InspectResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = Inspect> {
-    dsl?: DslResolver<string[], TypeParent, TContext>;
-
-    response?: ResponseResolver<string[], TypeParent, TContext>;
-  }
-
-  export type DslResolver<R = string[], Parent = Inspect, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-  export type ResponseResolver<R = string[], Parent = Inspect, TContext = SiemContext> = Resolver<
-    R,
-    Parent,
-    TContext
-  >;
-}
-
-export namespace PageInfoPaginatedResolvers {
-  export interface Resolvers<TContext = SiemContext, TypeParent = PageInfoPaginated> {
-    activePage?: ActivePageResolver<number, TypeParent, TContext>;
-
-    fakeTotalCount?: FakeTotalCountResolver<number, TypeParent, TContext>;
-
-    showMorePagesIndicator?: ShowMorePagesIndicatorResolver<boolean, TypeParent, TContext>;
-  }
-
-  export type ActivePageResolver<
-    R = number,
-    Parent = PageInfoPaginated,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type FakeTotalCountResolver<
-    R = number,
-    Parent = PageInfoPaginated,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-  export type ShowMorePagesIndicatorResolver<
-    R = boolean,
-    Parent = PageInfoPaginated,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
-}
-
-/** Directs the executor to skip this field or fragment when the `if` argument is true. */
-export type SkipDirectiveResolver<Result> = DirectiveResolverFn<
-  Result,
-  SkipDirectiveArgs,
-  SiemContext
->;
-export interface SkipDirectiveArgs {
-  /** Skipped when true. */
-  if: boolean;
-}
-
-/** Directs the executor to include this field or fragment only when the `if` argument is true. */
-export type IncludeDirectiveResolver<Result> = DirectiveResolverFn<
-  Result,
-  IncludeDirectiveArgs,
-  SiemContext
->;
-export interface IncludeDirectiveArgs {
-  /** Included when true. */
-  if: boolean;
-}
-
-/** Marks an element of a GraphQL schema as no longer supported. */
-export type DeprecatedDirectiveResolver<Result> = DirectiveResolverFn<
-  Result,
-  DeprecatedDirectiveArgs,
-  SiemContext
->;
-export interface DeprecatedDirectiveArgs {
-  /** Explains why this element was deprecated, usually also including a suggestion for how to access supported similar data. Formatted in [Markdown](https://daringfireball.net/projects/markdown/). */
-  reason?: string;
-}
-
-export interface ToAnyScalarConfig extends GraphQLScalarTypeConfig<ToAny, any> {
-  name: 'ToAny';
-}
-export interface ToStringArrayScalarConfig extends GraphQLScalarTypeConfig<ToStringArray, any> {
-  name: 'ToStringArray';
-}
-export interface ToStringArrayNoNullableScalarConfig
-  extends GraphQLScalarTypeConfig<ToStringArrayNoNullable, any> {
-  name: 'ToStringArrayNoNullable';
-}
-export interface ToDateArrayScalarConfig extends GraphQLScalarTypeConfig<ToDateArray, any> {
-  name: 'ToDateArray';
-}
-export interface ToNumberArrayScalarConfig extends GraphQLScalarTypeConfig<ToNumberArray, any> {
-  name: 'ToNumberArray';
-}
-export interface ToBooleanArrayScalarConfig extends GraphQLScalarTypeConfig<ToBooleanArray, any> {
-  name: 'ToBooleanArray';
-}
-export interface DateScalarConfig extends GraphQLScalarTypeConfig<Date, any> {
-  name: 'Date';
-}
-export interface ToIFieldSubTypeNonNullableScalarConfig
-  extends GraphQLScalarTypeConfig<ToIFieldSubTypeNonNullable, any> {
-  name: 'ToIFieldSubTypeNonNullable';
-}
-
-export type IResolvers<TContext = SiemContext> = {
-  Query?: QueryResolvers.Resolvers<TContext>;
-  NoteResult?: NoteResultResolvers.Resolvers<TContext>;
-  ResponseNotes?: ResponseNotesResolvers.Resolvers<TContext>;
-  PinnedEvent?: PinnedEventResolvers.Resolvers<TContext>;
-  Source?: SourceResolvers.Resolvers<TContext>;
-  SourceConfiguration?: SourceConfigurationResolvers.Resolvers<TContext>;
-  SourceFields?: SourceFieldsResolvers.Resolvers<TContext>;
-  SourceStatus?: SourceStatusResolvers.Resolvers<TContext>;
-  TimelineResult?: TimelineResultResolvers.Resolvers<TContext>;
-  ColumnHeaderResult?: ColumnHeaderResultResolvers.Resolvers<TContext>;
-  DataProviderResult?: DataProviderResultResolvers.Resolvers<TContext>;
-  QueryMatchResult?: QueryMatchResultResolvers.Resolvers<TContext>;
-  DateRangePickerResult?: DateRangePickerResultResolvers.Resolvers<TContext>;
-  EqlOptionsResult?: EqlOptionsResultResolvers.Resolvers<TContext>;
-  FavoriteTimelineResult?: FavoriteTimelineResultResolvers.Resolvers<TContext>;
-  FilterTimelineResult?: FilterTimelineResultResolvers.Resolvers<TContext>;
-  FilterMetaTimelineResult?: FilterMetaTimelineResultResolvers.Resolvers<TContext>;
-  SerializedFilterQueryResult?: SerializedFilterQueryResultResolvers.Resolvers<TContext>;
-  SerializedKueryQueryResult?: SerializedKueryQueryResultResolvers.Resolvers<TContext>;
-  KueryFilterQueryResult?: KueryFilterQueryResultResolvers.Resolvers<TContext>;
-  ResponseTimelines?: ResponseTimelinesResolvers.Resolvers<TContext>;
-  Mutation?: MutationResolvers.Resolvers<TContext>;
-  ResponseNote?: ResponseNoteResolvers.Resolvers<TContext>;
-  ResponseTimeline?: ResponseTimelineResolvers.Resolvers<TContext>;
-  ResponseFavoriteTimeline?: ResponseFavoriteTimelineResolvers.Resolvers<TContext>;
-  EventEcsFields?: EventEcsFieldsResolvers.Resolvers<TContext>;
-  Location?: LocationResolvers.Resolvers<TContext>;
-  GeoEcsFields?: GeoEcsFieldsResolvers.Resolvers<TContext>;
-  PrimarySecondary?: PrimarySecondaryResolvers.Resolvers<TContext>;
-  Summary?: SummaryResolvers.Resolvers<TContext>;
-  AgentEcsField?: AgentEcsFieldResolvers.Resolvers<TContext>;
-  AuditdData?: AuditdDataResolvers.Resolvers<TContext>;
-  AuditdEcsFields?: AuditdEcsFieldsResolvers.Resolvers<TContext>;
-  OsEcsFields?: OsEcsFieldsResolvers.Resolvers<TContext>;
-  HostEcsFields?: HostEcsFieldsResolvers.Resolvers<TContext>;
-  Thread?: ThreadResolvers.Resolvers<TContext>;
-  ProcessHashData?: ProcessHashDataResolvers.Resolvers<TContext>;
-  ProcessEcsFields?: ProcessEcsFieldsResolvers.Resolvers<TContext>;
-  SourceEcsFields?: SourceEcsFieldsResolvers.Resolvers<TContext>;
-  DestinationEcsFields?: DestinationEcsFieldsResolvers.Resolvers<TContext>;
-  DnsQuestionData?: DnsQuestionDataResolvers.Resolvers<TContext>;
-  DnsEcsFields?: DnsEcsFieldsResolvers.Resolvers<TContext>;
-  EndgameEcsFields?: EndgameEcsFieldsResolvers.Resolvers<TContext>;
-  SuricataAlertData?: SuricataAlertDataResolvers.Resolvers<TContext>;
-  SuricataEveData?: SuricataEveDataResolvers.Resolvers<TContext>;
-  SuricataEcsFields?: SuricataEcsFieldsResolvers.Resolvers<TContext>;
-  TlsJa3Data?: TlsJa3DataResolvers.Resolvers<TContext>;
-  FingerprintData?: FingerprintDataResolvers.Resolvers<TContext>;
-  TlsClientCertificateData?: TlsClientCertificateDataResolvers.Resolvers<TContext>;
-  TlsServerCertificateData?: TlsServerCertificateDataResolvers.Resolvers<TContext>;
-  TlsFingerprintsData?: TlsFingerprintsDataResolvers.Resolvers<TContext>;
-  TlsEcsFields?: TlsEcsFieldsResolvers.Resolvers<TContext>;
-  ZeekConnectionData?: ZeekConnectionDataResolvers.Resolvers<TContext>;
-  ZeekNoticeData?: ZeekNoticeDataResolvers.Resolvers<TContext>;
-  ZeekDnsData?: ZeekDnsDataResolvers.Resolvers<TContext>;
-  FileFields?: FileFieldsResolvers.Resolvers<TContext>;
-  ZeekHttpData?: ZeekHttpDataResolvers.Resolvers<TContext>;
-  HttpBodyData?: HttpBodyDataResolvers.Resolvers<TContext>;
-  HttpRequestData?: HttpRequestDataResolvers.Resolvers<TContext>;
-  HttpResponseData?: HttpResponseDataResolvers.Resolvers<TContext>;
-  HttpEcsFields?: HttpEcsFieldsResolvers.Resolvers<TContext>;
-  UrlEcsFields?: UrlEcsFieldsResolvers.Resolvers<TContext>;
-  ZeekFileData?: ZeekFileDataResolvers.Resolvers<TContext>;
-  ZeekSslData?: ZeekSslDataResolvers.Resolvers<TContext>;
-  ZeekEcsFields?: ZeekEcsFieldsResolvers.Resolvers<TContext>;
-  UserEcsFields?: UserEcsFieldsResolvers.Resolvers<TContext>;
-  WinlogEcsFields?: WinlogEcsFieldsResolvers.Resolvers<TContext>;
-  NetworkEcsField?: NetworkEcsFieldResolvers.Resolvers<TContext>;
-  PackageEcsFields?: PackageEcsFieldsResolvers.Resolvers<TContext>;
-  AuditEcsFields?: AuditEcsFieldsResolvers.Resolvers<TContext>;
-  SshEcsFields?: SshEcsFieldsResolvers.Resolvers<TContext>;
-  AuthEcsFields?: AuthEcsFieldsResolvers.Resolvers<TContext>;
-  SystemEcsField?: SystemEcsFieldResolvers.Resolvers<TContext>;
-  RuleField?: RuleFieldResolvers.Resolvers<TContext>;
-  SignalField?: SignalFieldResolvers.Resolvers<TContext>;
-  RuleEcsField?: RuleEcsFieldResolvers.Resolvers<TContext>;
-  Ecs?: EcsResolvers.Resolvers<TContext>;
-  EcsEdges?: EcsEdgesResolvers.Resolvers<TContext>;
-  CursorType?: CursorTypeResolvers.Resolvers<TContext>;
-  IndexField?: IndexFieldResolvers.Resolvers<TContext>;
-  PageInfo?: PageInfoResolvers.Resolvers<TContext>;
-  Inspect?: InspectResolvers.Resolvers<TContext>;
-  PageInfoPaginated?: PageInfoPaginatedResolvers.Resolvers<TContext>;
-  ToAny?: GraphQLScalarType;
-  ToStringArray?: GraphQLScalarType;
-  ToStringArrayNoNullable?: GraphQLScalarType;
-  ToDateArray?: GraphQLScalarType;
-  ToNumberArray?: GraphQLScalarType;
-  ToBooleanArray?: GraphQLScalarType;
-  Date?: GraphQLScalarType;
-  ToIFieldSubTypeNonNullable?: GraphQLScalarType;
-} & { [typeName: string]: never };
-
-export type IDirectiveResolvers<Result> = {
-  skip?: SkipDirectiveResolver<Result>;
-  include?: IncludeDirectiveResolver<Result>;
-  deprecated?: DeprecatedDirectiveResolver<Result>;
-} & { [directiveName: string]: never };
diff --git a/x-pack/plugins/security_solution/server/init_server.ts b/x-pack/plugins/security_solution/server/init_server.ts
deleted file mode 100644
index d2810bf71f8aea..00000000000000
--- a/x-pack/plugins/security_solution/server/init_server.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { IResolvers, makeExecutableSchema } from 'graphql-tools';
-
-import { schemas } from './graphql';
-import { createScalarToStringArrayValueResolvers } from './graphql/ecs';
-import { createNoteResolvers } from './graphql/note';
-import { createPinnedEventResolvers } from './graphql/pinned_event';
-import { createScalarDateResolvers } from './graphql/scalar_date';
-import { createScalarToAnyValueResolvers } from './graphql/scalar_to_any';
-import { createScalarToBooleanArrayValueResolvers } from './graphql/scalar_to_boolean_array';
-import { createScalarToDateArrayValueResolvers } from './graphql/scalar_to_date_array';
-import { createScalarToNumberArrayValueResolvers } from './graphql/scalar_to_number_array';
-import { createSourceStatusResolvers } from './graphql/source_status';
-import { createSourcesResolvers } from './graphql/sources';
-import { createTimelineResolvers } from './graphql/timeline';
-import { AppBackendLibs } from './lib/types';
-
-export const initServer = (libs: AppBackendLibs) => {
-  const schema = makeExecutableSchema({
-    resolvers: [
-      createNoteResolvers(libs) as IResolvers,
-      createPinnedEventResolvers(libs) as IResolvers,
-      createSourcesResolvers(libs) as IResolvers,
-      createScalarToStringArrayValueResolvers() as IResolvers,
-      createScalarDateResolvers() as IResolvers,
-      createScalarToDateArrayValueResolvers() as IResolvers,
-      createScalarToAnyValueResolvers() as IResolvers,
-      createScalarToBooleanArrayValueResolvers() as IResolvers,
-      createScalarToNumberArrayValueResolvers() as IResolvers,
-      createSourcesResolvers(libs) as IResolvers,
-      createSourceStatusResolvers(libs) as IResolvers,
-      createTimelineResolvers(libs) as IResolvers,
-    ],
-    typeDefs: schemas,
-  });
-
-  libs.framework.registerGraphQLEndpoint('/api/solutions/security/graphql', schema);
-};
diff --git a/x-pack/plugins/security_solution/server/lib/compose/kibana.ts b/x-pack/plugins/security_solution/server/lib/compose/kibana.ts
index 01318c87f8b3f8..9be922ecf8db26 100644
--- a/x-pack/plugins/security_solution/server/lib/compose/kibana.ts
+++ b/x-pack/plugins/security_solution/server/lib/compose/kibana.ts
@@ -23,7 +23,7 @@ export function compose(
   plugins: SetupPlugins,
   endpointContext: EndpointAppContext
 ): AppBackendLibs {
-  const framework = new KibanaBackendFrameworkAdapter(core, plugins);
+  const framework = new KibanaBackendFrameworkAdapter();
   const sources = new Sources(new ConfigurationSourcesAdapter());
   const sourceStatus = new SourceStatus(new ElasticsearchSourceStatusAdapter(framework));
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/delete_timeline_by_timeline_id.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/delete_timeline_by_timeline_id.sh
index 6271fd69cca5e8..844ff61c4cd89d 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/delete_timeline_by_timeline_id.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/delete_timeline_by_timeline_id.sh
@@ -17,6 +17,6 @@ curl -s -k \
   -H "Content-Type: application/json" \
   -H 'kbn-xsrf: 123' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-  -X POST "${KIBANA_URL}${SPACE_URL}/api/solutions/security/graphql" \
-  -d '{"operationName":"DeleteTimelineMutation","variables":{"id":["'$1'"]},"query":"mutation DeleteTimelineMutation($id: [ID!]!) {\n  deleteTimeline(id: $id)\n}\n"}'
+  -X DELETE "${KIBANA_URL}${SPACE_URL}/api/timeline" \
+  -d '{"savedObjectIds": ["'$1'"]}'
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/find_timeline_by_filter.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/find_timeline_by_filter.sh
index 721f3d888727e3..d3b67120772f48 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/find_timeline_by_filter.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/find_timeline_by_filter.sh
@@ -15,7 +15,7 @@ STATUS=${1:-active}
 TIMELINE_TYPE=${2:-default}
 
 # Example get all timelines:
-# sh ./timelines/find_timeline_by_filter.sh active
+# sh ./timelines/find_timeline_by_filter.sh active default
 
 # Example get all prepackaged timeline templates:
 # ./timelines/find_timeline_by_filter.sh immutable template
@@ -27,8 +27,7 @@ curl -s -k \
   -H "Content-Type: application/json" \
   -H 'kbn-xsrf: 123' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-  -X POST "${KIBANA_URL}${SPACE_URL}/api/solutions/security/graphql" \
-  -d '{"operationName":"GetAllTimeline","variables":{"onlyUserFavorite":false,"pageInfo":{"pageIndex":1,"pageSize":10},"search":"","sort":{"sortField":"updated","sortOrder":"desc"},"status":"'$STATUS'","timelineType":"'$TIMELINE_TYPE'"},"query":"query GetAllTimeline($pageInfo: PageInfoTimeline!, $search: String, $sort: SortTimeline, $onlyUserFavorite: Boolean, $timelineType: TimelineType, $status: TimelineStatus) {\n  getAllTimeline(pageInfo: $pageInfo, search: $search, sort: $sort, onlyUserFavorite: $onlyUserFavorite, timelineType: $timelineType, status: $status) {\n    totalCount\n    defaultTimelineCount\n    templateTimelineCount\n    elasticTemplateTimelineCount\n    customTemplateTimelineCount\n    favoriteCount\n    timeline {\n      savedObjectId\n      description\n      favorite {\n        fullName\n        userName\n        favoriteDate\n        __typename\n      }\n      eventIdToNoteIds {\n        eventId\n        note\n        timelineId\n        noteId\n        created\n        createdBy\n        timelineVersion\n        updated\n        updatedBy\n        version\n        __typename\n      }\n      notes {\n        eventId\n        note\n        timelineId\n        timelineVersion\n        noteId\n        created\n        createdBy\n        updated\n        updatedBy\n        version\n        __typename\n      }\n      noteIds\n      pinnedEventIds\n      status\n      title\n      timelineType\n      templateTimelineId\n      templateTimelineVersion\n      created\n      createdBy\n      updated\n      updatedBy\n      version\n      __typename\n    }\n    __typename\n  }\n}\n"}' \
+  -X GET "${KIBANA_URL}${SPACE_URL}/api/timelines?only_user_favorite=false&status=$STATUS&timeline_type=$TIMELINE_TYPE" \
   | jq .
 
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/get_all_timelines.sh b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/get_all_timelines.sh
index fdf3488ab7c9d1..d07f47db6b3a4b 100755
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/get_all_timelines.sh
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/timelines/get_all_timelines.sh
@@ -16,5 +16,5 @@ curl -s -k \
   -H "Content-Type: application/json" \
   -H 'kbn-xsrf: 123' \
   -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
-  -X GET "${KIBANA_URL}${SPACE_URL}/api/timeline" \
+  -X GET "${KIBANA_URL}${SPACE_URL}/api/timelines" \
   | jq .
diff --git a/x-pack/plugins/security_solution/server/lib/framework/kibana_framework_adapter.ts b/x-pack/plugins/security_solution/server/lib/framework/kibana_framework_adapter.ts
index 6306b26161b389..56c1c802fdd68b 100644
--- a/x-pack/plugins/security_solution/server/lib/framework/kibana_framework_adapter.ts
+++ b/x-pack/plugins/security_solution/server/lib/framework/kibana_framework_adapter.ts
@@ -5,21 +5,10 @@
  * 2.0.
  */
 
-import { GraphQLSchema } from 'graphql';
-import { runHttpQuery } from 'apollo-server-core';
-import { schema as configSchema } from '@kbn/config-schema';
-import type {
-  CoreSetup,
-  KibanaResponseFactory,
-  KibanaRequest,
-} from '../../../../../../src/core/server';
+import type { KibanaRequest } from '../../../../../../src/core/server';
 import { IndexPatternsFetcher, UI_SETTINGS } from '../../../../../../src/plugins/data/server';
 import { AuthenticatedUser } from '../../../../security/common/model';
-import { SetupPlugins } from '../../plugin';
-import type {
-  SecuritySolutionRequestHandlerContext,
-  SecuritySolutionPluginRouter,
-} from '../../types';
+import type { SecuritySolutionRequestHandlerContext } from '../../types';
 
 import {
   FrameworkAdapter,
@@ -27,17 +16,8 @@ import {
   FrameworkRequest,
   internalFrameworkRequest,
 } from './types';
-import { buildSiemResponse } from '../detection_engine/routes/utils';
 
 export class KibanaBackendFrameworkAdapter implements FrameworkAdapter {
-  private router: SecuritySolutionPluginRouter;
-  private security: SetupPlugins['security'];
-
-  constructor(core: CoreSetup, plugins: SetupPlugins) {
-    this.router = core.http.createRouter();
-    this.security = plugins.security;
-  }
-
   public async callWithRequest(
     req: FrameworkRequest,
     endpoint: string,
@@ -60,67 +40,6 @@ export class KibanaBackendFrameworkAdapter implements FrameworkAdapter {
     });
   }
 
-  public registerGraphQLEndpoint(routePath: string, schema: GraphQLSchema): void {
-    this.router.post(
-      {
-        path: routePath,
-        validate: { body: configSchema.object({}, { unknowns: 'allow' }) },
-        options: {
-          tags: ['access:securitySolution'],
-        },
-      },
-      async (context, request, response) => {
-        try {
-          const user = await this.getCurrentUserInfo(request);
-          const gqlResponse = await runHttpQuery([request], {
-            method: 'POST',
-            options: (req: KibanaRequest) => ({
-              context: { req: wrapRequest(req, context, user) },
-              schema,
-            }),
-            query: request.body,
-          });
-
-          return response.ok({
-            body: gqlResponse,
-            headers: {
-              'content-type': 'application/json',
-            },
-          });
-        } catch (error) {
-          return this.handleError(error, response);
-        }
-      }
-    );
-  }
-
-  private async getCurrentUserInfo(request: KibanaRequest): Promise<AuthenticatedUser | null> {
-    try {
-      const user = (await this.security?.authc.getCurrentUser(request)) ?? null;
-      return user;
-    } catch {
-      return null;
-    }
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private handleError(error: any, response: KibanaResponseFactory) {
-    const siemResponse = buildSiemResponse(response);
-
-    if (error.name === 'HttpQueryError') {
-      return siemResponse.error({
-        statusCode: error.statusCode,
-        headers: error.headers,
-        body: error.message,
-      });
-    }
-
-    return siemResponse.error({
-      statusCode: 500,
-      body: error.message,
-    });
-  }
-
   public getIndexPatternsService(request: FrameworkRequest): FrameworkIndexPatternsService {
     return new IndexPatternsFetcher(request.context.core.elasticsearch.client.asCurrentUser, true);
   }
diff --git a/x-pack/plugins/security_solution/server/lib/framework/types.ts b/x-pack/plugins/security_solution/server/lib/framework/types.ts
index b3f55a7a0ffa23..34012f8f15d168 100644
--- a/x-pack/plugins/security_solution/server/lib/framework/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/framework/types.ts
@@ -6,27 +6,25 @@
  */
 
 import { IndicesGetMappingParams } from 'elasticsearch';
-import { GraphQLSchema } from 'graphql';
 
 import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticatedUser } from '../../../../security/common/model';
 import { ESQuery } from '../../../common/typed_json';
 import type { SecuritySolutionRequestHandlerContext } from '../../types';
 import {
+  DocValueFieldsInput,
   PaginationInput,
   PaginationInputPaginated,
   SortField,
-  SourceConfiguration,
   TimerangeInput,
-  DocValueFieldsInput,
-} from '../../graphql/types';
+} from '../../../common/search_strategy';
+import { SourceConfiguration } from '../sources';
 
 export * from '../../utils/typed_resolvers';
 
 export const internalFrameworkRequest = Symbol('internalFrameworkRequest');
 
 export interface FrameworkAdapter {
-  registerGraphQLEndpoint(routePath: string, schema: GraphQLSchema): void;
   callWithRequest<Hit = {}, Aggregation = undefined>(
     req: FrameworkRequest,
     method: 'search',
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/request_responses.ts b/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/request_responses.ts
index 2cdcb92baed083..cda97954563f39 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/request_responses.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/request_responses.ts
@@ -19,11 +19,7 @@ import { SavedTimeline, TimelineType, TimelineStatus } from '../../../../common/
 
 import { requestMock } from '../../detection_engine/routes/__mocks__';
 
-import {
-  patchTimelineSchema,
-  createTimelineSchema,
-  GetTimelineByIdSchemaQuery,
-} from '../schemas/timelines';
+import { patchTimelineSchema, createTimelineSchema, GetTimelineQuery } from '../schemas/timelines';
 
 import { getReadables } from '../utils/common';
 
@@ -185,7 +181,7 @@ export const cleanDraftTimelinesRequest = (timelineType: TimelineType) =>
     },
   });
 
-export const getTimelineRequest = (query?: GetTimelineByIdSchemaQuery) =>
+export const getTimelineRequest = (query?: GetTimelineQuery) =>
   requestMock.create({
     method: 'get',
     path: TIMELINE_URL,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md b/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
index ee57d5bb3d0314..defbf8be8b7c3c 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
@@ -619,5 +619,817 @@ kbn-version: 8.0.0
 }
 ```
 
+## Get timelines / timeline templates api
+
+#### GET /api/timelines
+
+
+##### Authorization
+
+Type: Basic Auth
+username: Your Kibana username
+password: Your Kibana password
+
+
+##### Request header
+
+```
+Content-Type: application/json
+kbn-version: 8.0.0
+```
+
+##### Query params
+
+optional:
+only_user_favorite={boolean}
+page_index={number}
+page_size={number}
+search={string}
+sort_field={title|description|updated|created}
+sort_order={asc|desc}
+status={active|draft|immutable}
+timeline_type={default|template}
+
+##### example
+api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timeline_type=default
+
+##### Response
+
+```json
+{
+  "totalCount": 2,
+  "timeline": [
+    {
+      "savedObjectId": "de9a3620-8e23-11eb-ad8a-a192243e45e8",
+      "version": "WzM1NzQ4NywzXQ==",
+      "columns": [
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "@timestamp",
+          "type": "number"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "message"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.category"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.action"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "host.name"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "source.ip"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "destination.ip"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "user.name"
+        }
+      ],
+      "dataProviders": [
+        {
+          "excluded": false,
+          "and": [],
+          "kqlQuery": "",
+          "name": "",
+          "queryMatch": {
+            "field": "host.name",
+            "value": "",
+            "operator": ":*"
+          },
+          "id": "timeline-1-db9f4fc8-9420-420e-8e67-b12dd36691f6",
+          "type": "default",
+          "enabled": true
+        }
+      ],
+      "description": "",
+      "eqlOptions": {
+        "tiebreakerField": "",
+        "size": 100,
+        "query": "",
+        "eventCategoryField": "event.category",
+        "timestampField": "@timestamp"
+      },
+      "eventType": "all",
+      "excludedRowRendererIds": [],
+      "filters": [],
+      "kqlMode": "filter",
+      "kqlQuery": {
+        "filterQuery": null
+      },
+      "indexNames": [
+        ".siem-signals-angelachuang-default",
+        "auditbeat-*",
+        "endgame-*",
+        "filebeat-*",
+        "logs-*",
+        "packetbeat-*",
+        "winlogbeat-*"
+      ],
+      "title": "timeline - Duplicate",
+      "timelineType": "default",
+      "templateTimelineVersion": null,
+      "templateTimelineId": null,
+      "dateRange": {
+        "start": "2021-03-25T05:38:55.593Z",
+        "end": "2021-03-26T15:59:59.999Z"
+      },
+      "savedQueryId": null,
+      "sort": [
+        {
+          "columnType": "number",
+          "sortDirection": "desc",
+          "columnId": "@timestamp"
+        }
+      ],
+      "status": "active",
+      "created": 1616757027458,
+      "createdBy": "angela",
+      "updated": 1616758738320,
+      "updatedBy": "angela",
+      "favorite": [],
+      "eventIdToNoteIds": [
+        {
+          "noteId": "e6f3a9a0-8e23-11eb-ad8a-a192243e45e8",
+          "version": "WzM1NzQ4MywzXQ==",
+          "eventId": "QN84bngBYJMSg9tnAi1V",
+          "note": "note!",
+          "timelineId": "de9a3620-8e23-11eb-ad8a-a192243e45e8",
+          "created": 1616757041466,
+          "createdBy": "angela",
+          "updated": 1616757041466,
+          "updatedBy": "angela"
+        }
+      ],
+      "noteIds": [
+        "221524f0-8e24-11eb-ad8a-a192243e45e8"
+      ],
+      "notes": [
+        {
+          "noteId": "e6f3a9a0-8e23-11eb-ad8a-a192243e45e8",
+          "version": "WzM1NzQ4MywzXQ==",
+          "eventId": "QN84bngBYJMSg9tnAi1V",
+          "note": "note!",
+          "timelineId": "de9a3620-8e23-11eb-ad8a-a192243e45e8",
+          "created": 1616757041466,
+          "createdBy": "angela",
+          "updated": 1616757041466,
+          "updatedBy": "angela"
+        },
+        {
+          "noteId": "221524f0-8e24-11eb-ad8a-a192243e45e8",
+          "version": "WzM1NzQ4NiwzXQ==",
+          "note": "global note!",
+          "timelineId": "de9a3620-8e23-11eb-ad8a-a192243e45e8",
+          "created": 1616757140671,
+          "createdBy": "angela",
+          "updated": 1616757140671,
+          "updatedBy": "angela"
+        }
+      ],
+      "pinnedEventIds": [
+        "QN84bngBYJMSg9tnAi1V",
+        "P984bngBYJMSg9tnAi1V"
+      ],
+      "pinnedEventsSaveObject": [
+        {
+          "pinnedEventId": "e85339a0-8e23-11eb-ad8a-a192243e45e8",
+          "version": "WzM1NzQ4NCwzXQ==",
+          "eventId": "QN84bngBYJMSg9tnAi1V",
+          "timelineId": "de9a3620-8e23-11eb-ad8a-a192243e45e8",
+          "created": 1616757043770,
+          "createdBy": "angela",
+          "updated": 1616757043770,
+          "updatedBy": "angela"
+        },
+        {
+          "pinnedEventId": "2945cfe0-8e24-11eb-ad8a-a192243e45e8",
+          "version": "WzM1NzQ4NSwzXQ==",
+          "eventId": "P984bngBYJMSg9tnAi1V",
+          "timelineId": "de9a3620-8e23-11eb-ad8a-a192243e45e8",
+          "created": 1616757152734,
+          "createdBy": "angela",
+          "updated": 1616757152734,
+          "updatedBy": "angela"
+        }
+      ]
+    },
+    {
+      "savedObjectId": "48870270-8e1f-11eb-9cbd-7f6324a02fb7",
+      "version": "WzM1NzQ4MiwzXQ==",
+      "columns": [
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "@timestamp",
+          "type": "number"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "message"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.category"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.action"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "host.name"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "source.ip"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "destination.ip"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "user.name"
+        }
+      ],
+      "dataProviders": [
+        {
+          "excluded": false,
+          "and": [],
+          "kqlQuery": "",
+          "name": "",
+          "queryMatch": {
+            "field": "host.name",
+            "value": "",
+            "operator": ":*"
+          },
+          "id": "timeline-1-db9f4fc8-9420-420e-8e67-b12dd36691f6",
+          "type": "default",
+          "enabled": true
+        }
+      ],
+      "description": "",
+      "eventType": "all",
+      "filters": [],
+      "kqlMode": "filter",
+      "timelineType": "default",
+      "kqlQuery": {
+        "filterQuery": null
+      },
+      "title": "timeline",
+      "sort": [
+        {
+          "columnType": "number",
+          "sortDirection": "desc",
+          "columnId": "@timestamp"
+        }
+      ],
+      "status": "active",
+      "created": 1616755057686,
+      "createdBy": "angela",
+      "updated": 1616756755376,
+      "updatedBy": "angela",
+      "templateTimelineId": null,
+      "templateTimelineVersion": null,
+      "excludedRowRendererIds": [],
+      "dateRange": {
+        "start": "2021-03-25T16:00:00.000Z",
+        "end": "2021-03-26T15:59:59.999Z"
+      },
+      "indexNames": [
+        "auditbeat-*",
+        "endgame-*",
+        "filebeat-*",
+        "logs-*",
+        "packetbeat-*",
+        "winlogbeat-*",
+        ".siem-signals-angelachuang-default"
+      ],
+      "eqlOptions": {
+        "tiebreakerField": "",
+        "size": 100,
+        "query": "",
+        "eventCategoryField": "event.category",
+        "timestampField": "@timestamp"
+      },
+      "savedQueryId": null,
+      "favorite": [
+        {
+          "favoriteDate": 1616756755376,
+          "keySearch": "YW5nZWxh",
+          "fullName": "Angela",
+          "userName": "angela"
+        }
+      ],
+      "eventIdToNoteIds": [],
+      "noteIds": [],
+      "notes": [],
+      "pinnedEventIds": [],
+      "pinnedEventsSaveObject": []
+    }
+  ],
+  "defaultTimelineCount": 2,
+  "templateTimelineCount": 4,
+  "elasticTemplateTimelineCount": 3,
+  "customTemplateTimelineCount": 1,
+  "favoriteCount": 1
+}
+```
+
+## Get timeline api
+
+#### GET /api/id?id={savedObjectId}
+
+##### Authorization
+
+Type: Basic Auth
+username: Your Kibana username
+password: Your Kibana password
+
+
+##### Request header
+
+```
+Content-Type: application/json
+kbn-version: 8.0.0
+```
+
+##### Response
+```json
+{
+  "data": {
+    "getOneTimeline": {
+      "savedObjectId": "48870270-8e1f-11eb-9cbd-7f6324a02fb7",
+      "version": "WzM1NzQ4MiwzXQ==",
+      "columns": [
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "@timestamp",
+          "type": "number"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "message"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.category"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.action"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "host.name"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "source.ip"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "destination.ip"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "user.name"
+        }
+      ],
+      "dataProviders": [
+        {
+          "excluded": false,
+          "and": [],
+          "kqlQuery": "",
+          "name": "",
+          "queryMatch": {
+            "field": "host.name",
+            "value": "",
+            "operator": ":*"
+          },
+          "id": "timeline-1-db9f4fc8-9420-420e-8e67-b12dd36691f6",
+          "type": "default",
+          "enabled": true
+        }
+      ],
+      "description": "",
+      "eventType": "all",
+      "filters": [],
+      "kqlMode": "filter",
+      "timelineType": "default",
+      "kqlQuery": {
+        "filterQuery": null
+      },
+      "title": "timeline",
+      "sort": [
+        {
+          "columnType": "number",
+          "sortDirection": "desc",
+          "columnId": "@timestamp"
+        }
+      ],
+      "status": "active",
+      "created": 1616755057686,
+      "createdBy": "angela",
+      "updated": 1616756755376,
+      "updatedBy": "angela",
+      "templateTimelineId": null,
+      "templateTimelineVersion": null,
+      "excludedRowRendererIds": [],
+      "dateRange": {
+        "start": "2021-03-25T16:00:00.000Z",
+        "end": "2021-03-26T15:59:59.999Z"
+      },
+      "indexNames": [
+        "auditbeat-*",
+        "endgame-*",
+        "filebeat-*",
+        "logs-*",
+        "packetbeat-*",
+        "winlogbeat-*",
+        ".siem-signals-angelachuang-default"
+      ],
+      "eqlOptions": {
+        "tiebreakerField": "",
+        "size": 100,
+        "query": "",
+        "eventCategoryField": "event.category",
+        "timestampField": "@timestamp"
+      },
+      "savedQueryId": null,
+      "favorite": [
+        {
+          "favoriteDate": 1616756755376,
+          "keySearch": "YW5nZWxh",
+          "fullName": "Angela",
+          "userName": "angela"
+        }
+      ],
+      "eventIdToNoteIds": [],
+      "noteIds": [],
+      "notes": [],
+      "pinnedEventIds": [],
+      "pinnedEventsSaveObject": []
+    }
+  }
+}
+```
+
+
+## Get timeline template api
+
+#### GET /api/timeline?template_timeline_id={templateTimelineId}
+
+##### Authorization
+
+Type: Basic Auth
+username: Your Kibana username
+password: Your Kibana password
+
+
+##### Request header
+
+```
+Content-Type: application/json
+kbn-version: 8.0.0
+```
+
+##### Response
+```json
+{
+  "data": {
+    "getOneTimeline": {
+      "savedObjectId": "bf662160-9788-11eb-8277-3516cc4109c3",
+      "version": "WzM1NzU2MCwzXQ==",
+      "columns": [
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "@timestamp"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "signal.rule.description"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "event.action"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "process.name"
+        },
+        {
+          "aggregatable": true,
+          "description": "The working directory of the process.",
+          "columnHeaderType": "not-filtered",
+          "id": "process.working_directory",
+          "category": "process",
+          "type": "string",
+          "example": "/home/alice"
+        },
+        {
+          "aggregatable": true,
+          "description": "Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.",
+          "columnHeaderType": "not-filtered",
+          "id": "process.args",
+          "category": "process",
+          "type": "string",
+          "example": "[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"
+        },
+        {
+          "columnHeaderType": "not-filtered",
+          "id": "process.pid"
+        },
+        {
+          "aggregatable": true,
+          "description": "Absolute path to the process executable.",
+          "columnHeaderType": "not-filtered",
+          "id": "process.parent.executable",
+          "category": "process",
+          "type": "string",
+          "example": "/usr/bin/ssh"
+        },
+        {
+          "aggregatable": true,
+          "description": "Array of process arguments.\n\nMay be filtered to protect sensitive information.",
+          "columnHeaderType": "not-filtered",
+          "id": "process.parent.args",
+          "category": "process",
+          "type": "string",
+          "example": "[\"ssh\",\"-l\",\"user\",\"10.0.0.16\"]"
+        },
+        {
+          "aggregatable": true,
+          "description": "Process id.",
+          "columnHeaderType": "not-filtered",
+          "id": "process.parent.pid",
+          "category": "process",
+          "type": "number",
+          "example": "4242"
+        },
+        {
+          "aggregatable": true,
+          "description": "Short name or login of the user.",
+          "columnHeaderType": "not-filtered",
+          "id": "user.name",
+          "category": "user",
+          "type": "string",
+          "example": "albert"
+        },
+        {
+          "aggregatable": true,
+          "description": "Name of the host.\n\nIt can contain what `hostname` returns on Unix systems, the fully qualified\ndomain name, or a name specified by the user. The sender decides which value\nto use.",
+          "columnHeaderType": "not-filtered",
+          "id": "host.name",
+          "category": "host",
+          "type": "string"
+        }
+      ],
+      "dataProviders": [
+        {
+          "excluded": false,
+          "and": [],
+          "kqlQuery": "",
+          "name": "{process.name}",
+          "queryMatch": {
+            "displayValue": null,
+            "field": "process.name",
+            "displayField": null,
+            "value": "{process.name}",
+            "operator": ":"
+          },
+          "id": "timeline-1-8622010a-61fb-490d-b162-beac9c36a853",
+          "type": "template",
+          "enabled": true
+        }
+      ],
+      "description": "",
+      "eqlOptions": {
+        "eventCategoryField": "event.category",
+        "tiebreakerField": "",
+        "timestampField": "@timestamp",
+        "query": "",
+        "size": 100
+      },
+      "eventType": "all",
+      "excludedRowRendererIds": [],
+      "filters": [],
+      "kqlMode": "filter",
+      "kqlQuery": {
+        "filterQuery": {
+          "kuery": {
+            "kind": "kuery",
+            "expression": ""
+          },
+          "serializedQuery": ""
+        }
+      },
+      "indexNames": [],
+      "title": "Generic Process Timeline - Duplicate",
+      "timelineType": "template",
+      "templateTimelineVersion": 1,
+      "templateTimelineId": "94dd7443-97ea-4461-864d-fa96803ec111",
+      "dateRange": {
+        "start": "2021-04-06T07:57:57.922Z",
+        "end": "2021-04-07T07:57:57.922Z"
+      },
+      "savedQueryId": null,
+      "sort": [
+        {
+          "sortDirection": "desc",
+          "columnId": "@timestamp"
+        }
+      ],
+      "status": "active",
+      "created": 1617789914742,
+      "createdBy": "angela",
+      "updated": 1617790158569,
+      "updatedBy": "angela",
+      "favorite": [
+        {
+          "favoriteDate": 1617790158569,
+          "keySearch": "YW5nZWxh",
+          "fullName": "Angela",
+          "userName": "angela"
+        }
+      ],
+      "eventIdToNoteIds": [],
+      "noteIds": [],
+      "notes": [],
+      "pinnedEventIds": [],
+      "pinnedEventsSaveObject": []
+    }
+  }
+}
+```
+
+## Delete timeline api
+
+#### DELETE /api/timeline
+
+##### Authorization
+
+Type: Basic Auth
+username: Your Kibana username
+password: Your Kibana password
+
+
+##### Request header
+
+```
+
+Content-Type: application/json
+
+kbn-version: 8.0.0
+
+```
+
+##### Request body
+
+```json
+{
+	"savedObjectIds": [savedObjectId1, savedObjectId2]
+}
+```
+
+##### Response
+```json
+{"data":{"deleteTimeline":true}}
+```
+
+## Persist note api
+
+#### POST /api/note
+
+##### Authorization
+
+Type: Basic Auth
+username: Your Kibana username
+password: Your Kibana password
+
+
+##### Request header
+
+```
+Content-Type: application/json
+kbn-version: 8.0.0
+```
+
+##### Request body
+
+```json
+{
+	"note": {
+		"timelineId": {timeline id that the note is linked to},
+		"eventId" (optional): {event id the note is linked to. Not available is it is a global note},
+		"note"(optional):  {note content},
+	},
+	"noteId"(optional): note savedObjectId,
+	"version" (optional): note savedObjectVersion
+}
+```
+##### Example
+```json
+{
+  "noteId": null,
+  "version": null,
+  "note": {
+    "eventId": "Q9tqqXgBc4D54_cxJnHV",
+    "note": "note",
+    "timelineId": "1ec3b430-908e-11eb-94fa-c9122cbc0213"
+  }
+}
+```
+
+##### Response
+```
+{
+  "data": {
+    "persistNote": {
+      "code": 200,
+      "message": "success",
+      "note": {
+        "noteId": "fe8f6980-97ad-11eb-862e-850f4426d3d0",
+        "version": "WzM1MDAyNSwzXQ==",
+        "eventId": "UNtqqXgBc4D54_cxIGi-",
+        "note": "event note",
+        "timelineId": "1ec3b430-908e-11eb-94fa-c9122cbc0213",
+        "created": 1617805912088,
+        "createdBy": "angela",
+        "updated": 1617805912088,
+        "updatedBy": "angela"
+      }
+    }
+  }
+}
+```
+
+## Persist pinned event api
+
+#### POST /api/pinned_event
+
+##### Authorization
+
+Type: Basic Auth
+username: Your Kibana username
+password: Your Kibana password
+
+
+##### Request header
+
+```
+Content-Type: application/json
+kbn-version: 8.0.0
+```
+
+##### Request body
+
+```json
+{
+	"eventId":  {event which is pinned}
+	"pinnedEventId" (optional):  {pinned event savedObjectId}
+	"timelineId":  {timeline which this pinned event is linked to}
+}
+```
+
+##### example
+
+```
+{
+	"eventId":"UdtqqXgBc4D54_cxIGi",
+	"pinnedEventId":null,
+	"timelineId":"1ec3b430-908e-11eb-94fa-c9122cbc0213"
+}
+```
+
+##### Response
+```json
+{
+  "data": {
+    "persistPinnedEventOnTimeline": {
+      "pinnedEventId": "5b8f1720-97ae-11eb-862e-850f4426d3d0",
+      "version": "WzM1MDA1OSwzXQ==",
+      "eventId": "UdtqqXgBc4D54_cxIGi-",
+      "timelineId": "1ec3b430-908e-11eb-94fa-c9122cbc0213",
+      "created": 1617806068114,
+      "createdBy": "angela",
+      "updated": 1617806068114,
+      "updatedBy": "angela"
+    }
+  }
+}
+```
+
 
 
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/notes/index.ts
similarity index 83%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/index.ts
rename to x-pack/plugins/security_solution/server/lib/timeline/routes/notes/index.ts
index cd324619b79b0e..2b8b6eb55fd944 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/notes/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export * from './flyout_list_manage_drilldowns';
+export { persistNoteRoute } from './persist_note';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/notes/persist_note.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/notes/persist_note.ts
new file mode 100644
index 00000000000000..cb7d984ade40bc
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/notes/persist_note.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SecuritySolutionPluginRouter } from '../../../../types';
+
+import { NOTE_URL } from '../../../../../common/constants';
+
+import { SetupPlugins } from '../../../../plugin';
+import { buildRouteValidationWithExcess } from '../../../../utils/build_validation/route_validation';
+import { ConfigType } from '../../../..';
+
+import { transformError, buildSiemResponse } from '../../../detection_engine/routes/utils';
+
+import { buildFrameworkRequest } from '../../utils/common';
+import { persistNoteSchema } from '../../schemas/notes';
+import { persistNote } from '../../saved_object/notes';
+
+export const persistNoteRoute = (
+  router: SecuritySolutionPluginRouter,
+  config: ConfigType,
+  security: SetupPlugins['security']
+) => {
+  router.patch(
+    {
+      path: NOTE_URL,
+      validate: {
+        body: buildRouteValidationWithExcess(persistNoteSchema),
+      },
+      options: {
+        tags: ['access:securitySolution'],
+      },
+    },
+    async (context, request, response) => {
+      const siemResponse = buildSiemResponse(response);
+
+      try {
+        const frameworkRequest = await buildFrameworkRequest(context, security, request);
+        const { note } = request.body;
+        const noteId = request.body?.noteId ?? null;
+        const version = request.body?.version ?? null;
+
+        const res = await persistNote(
+          frameworkRequest,
+          noteId,
+          version,
+          {
+            ...note,
+            timelineId: note.timelineId || null,
+          },
+          true
+        );
+
+        return response.ok({
+          body: { data: { persistNote: res } },
+        });
+      } catch (err) {
+        const error = transformError(err);
+        return siemResponse.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/pinned_events/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/pinned_events/index.ts
new file mode 100644
index 00000000000000..448906196e34ad
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/pinned_events/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { persistPinnedEventRoute } from './persist_pinned_event';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/pinned_events/persist_pinned_event.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/pinned_events/persist_pinned_event.ts
new file mode 100644
index 00000000000000..53ac002721c6e3
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/pinned_events/persist_pinned_event.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SecuritySolutionPluginRouter } from '../../../../types';
+
+import { PINNED_EVENT_URL } from '../../../../../common/constants';
+
+import { SetupPlugins } from '../../../../plugin';
+import { buildRouteValidationWithExcess } from '../../../../utils/build_validation/route_validation';
+import { ConfigType } from '../../../..';
+
+import { transformError, buildSiemResponse } from '../../../detection_engine/routes/utils';
+
+import { buildFrameworkRequest } from '../../utils/common';
+import { persistPinnedEventSchema } from '../../schemas/pinned_events';
+import { persistPinnedEventOnTimeline } from '../../saved_object/pinned_events';
+
+export const persistPinnedEventRoute = (
+  router: SecuritySolutionPluginRouter,
+  config: ConfigType,
+  security: SetupPlugins['security']
+) => {
+  router.patch(
+    {
+      path: PINNED_EVENT_URL,
+      validate: {
+        body: buildRouteValidationWithExcess(persistPinnedEventSchema),
+      },
+      options: {
+        tags: ['access:securitySolution'],
+      },
+    },
+    async (context, request, response) => {
+      const siemResponse = buildSiemResponse(response);
+
+      try {
+        const frameworkRequest = await buildFrameworkRequest(context, security, request);
+        const { eventId } = request.body;
+        const pinnedEventId = request.body?.pinnedEventId ?? null;
+        const timelineId = request.body?.timelineId ?? null;
+
+        const res = await persistPinnedEventOnTimeline(
+          frameworkRequest,
+          pinnedEventId,
+          eventId,
+          timelineId
+        );
+
+        return response.ok({
+          body: { data: { persistPinnedEventOnTimeline: res } },
+        });
+      } catch (err) {
+        const error = transformError(err);
+        return siemResponse.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.ts
index 626f3cbed5b778..e202230bf5cce3 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.ts
@@ -10,9 +10,9 @@ import { isEmpty } from 'lodash/fp';
 import moment from 'moment';
 import { timeline as timelineLib, pinnedEvent as pinnedEventLib } from '../../../saved_object';
 import { FrameworkRequest } from '../../../../framework';
-import { SavedTimeline } from '../../../../../../common/types/timeline';
-import { NoteResult, ResponseTimeline } from '../../../../../graphql/types';
+import { ResponseTimeline, SavedTimeline } from '../../../../../../common/types/timeline';
 import { persistNotes } from '../../../saved_object/notes/persist_notes';
+import { NoteResult } from '../../../../../../common/types/timeline/note';
 
 interface CreateTimelineProps {
   frameworkRequest: FrameworkRequest;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/delete_timelines/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/delete_timelines/index.ts
new file mode 100644
index 00000000000000..7617881b90b7fa
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/delete_timelines/index.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { buildRouteValidationWithExcess } from '../../../../../utils/build_validation/route_validation';
+import { ConfigType } from '../../../../..';
+import { deleteTimelinesSchema } from '../../../schemas/timelines/delete_timelines_schema';
+import { SecuritySolutionPluginRouter } from '../../../../../types';
+import { SetupPlugins } from '../../../../../plugin';
+import { TIMELINE_URL } from '../../../../../../common/constants';
+import { transformError, buildSiemResponse } from '../../../../detection_engine/routes/utils';
+import { buildFrameworkRequest } from '../../../utils/common';
+import { deleteTimeline } from '../../../saved_object/timelines';
+
+export const deleteTimelinesRoute = (
+  router: SecuritySolutionPluginRouter,
+  config: ConfigType,
+  security: SetupPlugins['security']
+) => {
+  router.delete(
+    {
+      path: TIMELINE_URL,
+      validate: {
+        body: buildRouteValidationWithExcess(deleteTimelinesSchema),
+      },
+      options: {
+        tags: ['access:securitySolution'],
+      },
+    },
+    async (context, request, response) => {
+      const siemResponse = buildSiemResponse(response);
+
+      try {
+        const frameworkRequest = await buildFrameworkRequest(context, security, request);
+        const { savedObjectIds } = request.body;
+
+        await deleteTimeline(frameworkRequest, savedObjectIds);
+        return response.ok({ body: { data: { deleteTimeline: true } } });
+      } catch (err) {
+        const error = transformError(err);
+        return siemResponse.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.test.ts
index 8c559daa93da9c..13a3a3909095a5 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.test.ts
@@ -12,11 +12,7 @@ import {
   requestContextMock,
   createMockConfig,
 } from '../../../../detection_engine/routes/__mocks__';
-import {
-  getTimelineOrNull,
-  getTimelineTemplateOrNull,
-  getAllTimeline,
-} from '../../../saved_object/timelines';
+import { getTimelineOrNull, getTimelineTemplateOrNull } from '../../../saved_object/timelines';
 
 import { mockGetCurrentUser } from '../../../__mocks__/import_timelines';
 import { getTimelineRequest } from '../../../__mocks__/request_responses';
@@ -66,11 +62,8 @@ describe('get timeline', () => {
     expect((getTimelineOrNull as jest.Mock).mock.calls[0][1]).toEqual(id);
   });
 
-  test('should call getAllTimeline if nither templateTimelineId nor id is given', async () => {
-    (getAllTimeline as jest.Mock).mockResolvedValue({ totalCount: 3 });
-
-    await server.inject(getTimelineRequest(), context);
-
-    expect(getAllTimeline as jest.Mock).toHaveBeenCalledTimes(2);
+  test('should throw error message if nither templateTimelineId nor id is given', async () => {
+    const res = await server.inject(getTimelineRequest(), context);
+    expect(res.body.message).toEqual('please provide id or template_timeline_id');
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.ts
index f49110d1057652..8d94cd2ef2cceb 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timeline/index.ts
@@ -16,13 +16,8 @@ import { buildRouteValidationWithExcess } from '../../../../../utils/build_valid
 import { buildSiemResponse, transformError } from '../../../../detection_engine/routes/utils';
 
 import { buildFrameworkRequest } from '../../../utils/common';
-import { getTimelineByIdSchemaQuery } from '../../../schemas/timelines';
-import {
-  getTimelineTemplateOrNull,
-  getTimelineOrNull,
-  getAllTimeline,
-} from '../../../saved_object/timelines';
-import { TimelineStatus } from '../../../../../../common/types/timeline';
+import { getTimelineQuerySchema } from '../../../schemas/timelines';
+import { getTimelineTemplateOrNull, getTimelineOrNull } from '../../../saved_object/timelines';
 
 export const getTimelineRoute = (
   router: SecuritySolutionPluginRouter,
@@ -31,8 +26,10 @@ export const getTimelineRoute = (
 ) => {
   router.get(
     {
-      path: `${TIMELINE_URL}`,
-      validate: { query: buildRouteValidationWithExcess(getTimelineByIdSchemaQuery) },
+      path: TIMELINE_URL,
+      validate: {
+        query: buildRouteValidationWithExcess(getTimelineQuerySchema),
+      },
       options: {
         tags: ['access:securitySolution'],
       },
@@ -42,34 +39,18 @@ export const getTimelineRoute = (
         const frameworkRequest = await buildFrameworkRequest(context, security, request);
         const query = request.query ?? {};
         const { template_timeline_id: templateTimelineId, id } = query;
+
         let res = null;
+
         if (templateTimelineId != null && id == null) {
           res = await getTimelineTemplateOrNull(frameworkRequest, templateTimelineId);
         } else if (templateTimelineId == null && id != null) {
           res = await getTimelineOrNull(frameworkRequest, id);
-        } else if (templateTimelineId == null && id == null) {
-          const tempResult = await getAllTimeline(
-            frameworkRequest,
-            false,
-            { pageSize: 1, pageIndex: 1 },
-            null,
-            null,
-            TimelineStatus.active,
-            null
-          );
-
-          res = await getAllTimeline(
-            frameworkRequest,
-            false,
-            { pageSize: tempResult?.totalCount ?? 0, pageIndex: 1 },
-            null,
-            null,
-            TimelineStatus.active,
-            null
-          );
+        } else {
+          throw new Error('please provide id or template_timeline_id');
         }
 
-        return response.ok({ body: res ?? {} });
+        return response.ok({ body: res ? { data: { getOneTimeline: res } } : {} });
       } catch (err) {
         const error = transformError(err);
         const siemResponse = buildSiemResponse(response);
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timelines/index.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timelines/index.test.ts
new file mode 100644
index 00000000000000..a29902934172fc
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timelines/index.test.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SecurityPluginSetup } from '../../../../../../../security/server';
+
+import {
+  serverMock,
+  requestContextMock,
+  createMockConfig,
+} from '../../../../detection_engine/routes/__mocks__';
+import { getAllTimeline } from '../../../saved_object/timelines';
+
+import { mockGetCurrentUser } from '../../../__mocks__/import_timelines';
+import { getTimelineRequest } from '../../../__mocks__/request_responses';
+
+import { getTimelinesRoute } from '.';
+
+jest.mock('../../../saved_object/timelines', () => ({
+  getAllTimeline: jest.fn(),
+}));
+
+describe('get all timelines', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let securitySetup: SecurityPluginSetup;
+  let { context } = requestContextMock.createTools();
+
+  beforeEach(() => {
+    jest.resetModules();
+    jest.resetAllMocks();
+
+    server = serverMock.create();
+    context = requestContextMock.createTools().context;
+
+    securitySetup = ({
+      authc: {
+        getCurrentUser: jest.fn().mockReturnValue(mockGetCurrentUser),
+      },
+      authz: {},
+    } as unknown) as SecurityPluginSetup;
+
+    getTimelinesRoute(server.router, createMockConfig(), securitySetup);
+  });
+
+  test('should get the total count', async () => {
+    await server.inject(getTimelineRequest(), context);
+    expect((getAllTimeline as jest.Mock).mock.calls[0][2]).toEqual({ pageSize: 1, pageIndex: 1 });
+  });
+
+  test('should get all timelines with total count', async () => {
+    (getAllTimeline as jest.Mock).mockResolvedValue({ totalCount: 100 });
+    await server.inject(getTimelineRequest(), context);
+    expect((getAllTimeline as jest.Mock).mock.calls[1][2]).toEqual({ pageSize: 100, pageIndex: 1 });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timelines/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timelines/index.ts
new file mode 100644
index 00000000000000..51a02db681b0c1
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/get_timelines/index.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import Boom from '@hapi/boom';
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { fold } from 'fp-ts/lib/Either';
+import { identity } from 'fp-ts/lib/function';
+
+import type { SecuritySolutionPluginRouter } from '../../../../../types';
+import { TIMELINES_URL } from '../../../../../../common/constants';
+
+import { ConfigType } from '../../../../..';
+import { SetupPlugins } from '../../../../../plugin';
+
+import { buildSiemResponse, transformError } from '../../../../detection_engine/routes/utils';
+
+import { buildFrameworkRequest, escapeHatch, throwErrors } from '../../../utils/common';
+import { getAllTimeline } from '../../../saved_object/timelines';
+import { getTimelinesQuerySchema } from '../../../schemas/timelines';
+
+export const getTimelinesRoute = (
+  router: SecuritySolutionPluginRouter,
+  config: ConfigType,
+  security: SetupPlugins['security']
+) => {
+  router.get(
+    {
+      path: TIMELINES_URL,
+      validate: {
+        query: escapeHatch,
+      },
+      options: {
+        tags: ['access:securitySolution'],
+      },
+    },
+    async (context, request, response) => {
+      try {
+        const frameworkRequest = await buildFrameworkRequest(context, security, request);
+        const queryParams = pipe(
+          getTimelinesQuerySchema.decode(request.query),
+          fold(throwErrors(Boom.badRequest), identity)
+        );
+        const onlyUserFavorite = queryParams?.only_user_favorite === 'true' ? true : false;
+        const pageSize = queryParams?.page_size ? parseInt(queryParams.page_size, 10) : null;
+        const pageIndex = queryParams?.page_index ? parseInt(queryParams.page_index, 10) : null;
+        const search = queryParams?.search ?? null;
+        const sortField = queryParams?.sort_field ?? null;
+        const sortOrder = queryParams?.sort_order ?? null;
+        const status = queryParams?.status ?? null;
+        const timelineType = queryParams?.timeline_type ?? null;
+        const sort =
+          sortField && sortOrder
+            ? {
+                sortField,
+                sortOrder,
+              }
+            : null;
+        let res = null;
+        let totalCount = null;
+
+        if (pageSize == null && pageIndex == null) {
+          const allActiveTimelines = await getAllTimeline(
+            frameworkRequest,
+            false,
+            { pageSize: 1, pageIndex: 1 },
+            null,
+            null,
+            null,
+            null
+          );
+          totalCount = allActiveTimelines.totalCount;
+        }
+
+        res = await getAllTimeline(
+          frameworkRequest,
+          onlyUserFavorite,
+          {
+            pageSize: pageSize ?? totalCount ?? 1,
+            pageIndex: pageIndex ?? 1,
+          },
+          search,
+          sort,
+          status,
+          timelineType
+        );
+
+        return response.ok({ body: res ?? {} });
+      } catch (err) {
+        const error = transformError(err);
+        const siemResponse = buildSiemResponse(response);
+
+        return siemResponse.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/create_timelines_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/create_timelines_stream_from_ndjson.ts
index 1184629e47e874..aeb7463377b1f5 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/create_timelines_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/create_timelines_stream_from_ndjson.ts
@@ -9,7 +9,6 @@ import * as rt from 'io-ts';
 import { Transform } from 'stream';
 import { pipe } from 'fp-ts/lib/pipeable';
 import { fold } from 'fp-ts/lib/Either';
-import { failure } from 'io-ts/lib/PathReporter';
 import { identity } from 'fp-ts/lib/function';
 import { createConcatStream, createSplitStream, createMapStream } from '@kbn/utils';
 import {
@@ -21,15 +20,12 @@ import {
 import { ImportTimelineResponse } from './types';
 import { ImportTimelinesSchemaRt } from '../../../schemas/timelines/import_timelines_schema';
 import { BadRequestError } from '../../../../detection_engine/errors/bad_request_error';
+import { throwErrors } from '../../../utils/common';
 
 type ErrorFactory = (message: string) => Error;
 
 export const createPlainError = (message: string) => new Error(message);
 
-export const throwErrors = (createError: ErrorFactory) => (errors: rt.Errors) => {
-  throw createError(failure(errors).join('\n'));
-};
-
 export const decodeOrThrow = <A, O, I>(
   runtimeType: rt.Type<A, O, I>,
   createError: ErrorFactory = createPlainError
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/helpers.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/helpers.ts
index 21ff77e1edbdd1..a19276652e78b9 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/helpers.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/helpers.ts
@@ -131,6 +131,7 @@ export const importTimelines = async (
               timelineType,
               version,
             } = parsedTimeline;
+
             const parsedTimelineObject = omit(timelineSavedObjectOmittedFields, parsedTimeline);
             let newTimeline = null;
             try {
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/types.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/types.ts
index cc4221cba10982..2cec338555b30c 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/import_timelines/types.ts
@@ -7,9 +7,9 @@
 import { BulkError } from '../../../../detection_engine/routes/utils';
 
 import { SavedTimeline } from '../../../../../../common/types/timeline';
-import { NoteResult } from '../../../../../graphql/types';
 import { HapiReadableStream } from '../../../../detection_engine/rules/types';
 import { TimelineStatusActions } from '../../../utils/common';
+import { NoteResult } from '../../../../../../common/types/timeline/note';
 
 export type ImportedTimeline = SavedTimeline & {
   savedObjectId: string | null;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/index.ts
new file mode 100644
index 00000000000000..ebd0dbba7d1974
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export { createTimelinesRoute } from './create_timelines';
+export { deleteTimelinesRoute } from './delete_timelines';
+export { exportTimelinesRoute } from './export_timelines';
+export { getTimelineRoute } from './get_timeline';
+export { getTimelinesRoute } from './get_timelines';
+export { importTimelinesRoute } from './import_timelines';
+export { patchTimelinesRoute } from './patch_timelines';
+export { persistFavoriteRoute } from './persist_favorite';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.test.ts
index 8f583dbcc05a87..e0cd1a166dd43a 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.test.ts
@@ -86,8 +86,8 @@ describe('update timelines', () => {
           };
         });
 
-        const updateTimelinesRoute = jest.requireActual('./index').updateTimelinesRoute;
-        updateTimelinesRoute(server.router, createMockConfig(), securitySetup);
+        const patchTimelinesRoute = jest.requireActual('./index').patchTimelinesRoute;
+        patchTimelinesRoute(server.router, createMockConfig(), securitySetup);
 
         const mockRequest = getUpdateTimelinesRequest(updateTimelineWithTimelineId);
         await server.inject(mockRequest, context);
@@ -150,8 +150,8 @@ describe('update timelines', () => {
           };
         });
 
-        const updateTimelinesRoute = jest.requireActual('./index').updateTimelinesRoute;
-        updateTimelinesRoute(server.router, createMockConfig(), securitySetup);
+        const patchTimelinesRoute = jest.requireActual('./index').patchTimelinesRoute;
+        patchTimelinesRoute(server.router, createMockConfig(), securitySetup);
       });
 
       test('returns error message', async () => {
@@ -194,8 +194,8 @@ describe('update timelines', () => {
           };
         });
 
-        const updateTimelinesRoute = jest.requireActual('./index').updateTimelinesRoute;
-        updateTimelinesRoute(server.router, createMockConfig(), securitySetup);
+        const patchTimelinesRoute = jest.requireActual('./index').patchTimelinesRoute;
+        patchTimelinesRoute(server.router, createMockConfig(), securitySetup);
 
         const mockRequest = getUpdateTimelinesRequest(updateTemplateTimelineWithTimelineId);
         await server.inject(mockRequest, context);
@@ -270,8 +270,8 @@ describe('update timelines', () => {
           };
         });
 
-        const updateTimelinesRoute = jest.requireActual('./index').updateTimelinesRoute;
-        updateTimelinesRoute(server.router, createMockConfig(), securitySetup);
+        const patchTimelinesRoute = jest.requireActual('./index').patchTimelinesRoute;
+        patchTimelinesRoute(server.router, createMockConfig(), securitySetup);
       });
 
       test('returns error message', async () => {
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.ts
index 61880789eca849..b0142625f5e081 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/patch_timelines/index.ts
@@ -20,7 +20,7 @@ import { buildFrameworkRequest, TimelineStatusActions } from '../../../utils/com
 import { createTimelines } from '../create_timelines';
 import { CompareTimelinesStatus } from '../../../utils/compare_timelines_status';
 
-export const updateTimelinesRoute = (
+export const patchTimelinesRoute = (
   router: SecuritySolutionPluginRouter,
   config: ConfigType,
   security: SetupPlugins['security']
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/persist_favorite/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/persist_favorite/index.ts
new file mode 100644
index 00000000000000..2cc38886962487
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/persist_favorite/index.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SecuritySolutionPluginRouter } from '../../../../../types';
+
+import { TIMELINE_FAVORITE_URL } from '../../../../../../common/constants';
+
+import { SetupPlugins } from '../../../../../plugin';
+import { buildRouteValidationWithExcess } from '../../../../../utils/build_validation/route_validation';
+import { ConfigType } from '../../../../..';
+
+import { transformError, buildSiemResponse } from '../../../../detection_engine/routes/utils';
+
+import { buildFrameworkRequest } from '../../../utils/common';
+import { persistFavorite } from '../../../saved_object/timelines';
+import { TimelineType } from '../../../../../../common/types/timeline';
+import { persistFavoriteSchema } from '../../../schemas/timelines/persist_favorite_schema';
+
+export const persistFavoriteRoute = (
+  router: SecuritySolutionPluginRouter,
+  config: ConfigType,
+  security: SetupPlugins['security']
+) => {
+  router.patch(
+    {
+      path: TIMELINE_FAVORITE_URL,
+      validate: {
+        body: buildRouteValidationWithExcess(persistFavoriteSchema),
+      },
+      options: {
+        tags: ['access:securitySolution'],
+      },
+    },
+    async (context, request, response) => {
+      const siemResponse = buildSiemResponse(response);
+
+      try {
+        const frameworkRequest = await buildFrameworkRequest(context, security, request);
+        const {
+          timelineId,
+          templateTimelineId,
+          templateTimelineVersion,
+          timelineType,
+        } = request.body;
+
+        const timeline = await persistFavorite(
+          frameworkRequest,
+          timelineId || null,
+          templateTimelineId || null,
+          templateTimelineVersion || null,
+          timelineType || TimelineType.default
+        );
+
+        return response.ok({
+          body: {
+            data: {
+              persistFavorite: timeline,
+            },
+          },
+        });
+      } catch (err) {
+        const error = transformError(err);
+        return siemResponse.error({
+          body: error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/get_overridable_note.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/get_overridable_note.ts
index 1ff1c37a163576..6feca76ff53a9a 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/get_overridable_note.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/get_overridable_note.ts
@@ -5,11 +5,15 @@
  * 2.0.
  */
 
-import { SavedNote } from '../../../../../common/types/timeline/note';
-import { NoteResult } from '../../../../graphql/types';
+import { NoteResult, SavedNote } from '../../../../../common/types/timeline/note';
 import { FrameworkRequest } from '../../../framework';
 import { getNote } from './saved_object';
 
+/**
+ * When importing timeline with an existing note by others, we don't want override the owner.
+ *  In this case we can set overrideOwner to false to keep the original author
+ */
+
 export const getOverridableNote = async (
   frameworkRequest: FrameworkRequest,
   note: NoteResult,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/index.ts
index 9addf0f80e1242..34914517da683a 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/index.ts
@@ -6,8 +6,14 @@
  */
 
 import { FrameworkRequest } from '../../../framework';
-import { PageInfoNote, ResponseNote, ResponseNotes, SortNote } from '../../../../graphql/types';
-import { SavedNote, NoteSavedObject } from '../../../../../common/types/timeline/note';
+import {
+  SavedNote,
+  NoteSavedObject,
+  PageInfoNote,
+  SortNote,
+  ResponseNotes,
+  ResponseNote,
+} from '../../../../../common/types/timeline/note';
 
 export * from './saved_object';
 export interface Notes {
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/persist_notes.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/persist_notes.ts
index 7f6a355f43df00..58b4e33444d948 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/persist_notes.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/persist_notes.ts
@@ -6,9 +6,9 @@
  */
 
 import { FrameworkRequest } from '../../../framework';
-import { NoteResult } from '../../../../graphql/types';
 import { persistNote } from './saved_object';
 import { getOverridableNote } from './get_overridable_note';
+import { NoteResult } from '../../../../../common/types/timeline/note';
 
 export const persistNotes = async (
   frameworkRequest: FrameworkRequest,
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/saved_object.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/saved_object.ts
index 8016fdf12881d5..91caaa8cc8a8ba 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/saved_object.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/notes/saved_object.ts
@@ -20,14 +20,12 @@ import {
   SavedNote,
   NoteSavedObjectRuntimeType,
   NoteSavedObject,
-} from '../../../../../common/types/timeline/note';
-import {
   PageInfoNote,
-  ResponseNote,
-  ResponseNotes,
   SortNote,
   NoteResult,
-} from '../../../../graphql/types';
+  ResponseNotes,
+  ResponseNote,
+} from '../../../../../common/types/timeline/note';
 import { FrameworkRequest } from '../../../framework';
 import { noteSavedObjectType } from '../../saved_object_mappings/notes';
 import { convertSavedObjectToSavedTimeline, pickSavedTimeline } from '../timelines';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts
index 6467d1d43d807b..b3d262b13cbf3b 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts
@@ -18,14 +18,11 @@ import {
   PinnedEventSavedObject,
   PinnedEventSavedObjectRuntimeType,
   SavedPinnedEvent,
+  PinnedEvent as PinnedEventResponse,
 } from '../../../../../common/types/timeline/pinned_event';
+import { PageInfoNote, SortNote } from '../../../../../common/types/timeline/note';
 import { FrameworkRequest } from '../../../framework';
 
-import {
-  PageInfoNote,
-  SortNote,
-  PinnedEvent as PinnedEventResponse,
-} from '../../../../graphql/types';
 import { pickSavedTimeline } from '../../saved_object/timelines';
 import { convertSavedObjectToSavedTimeline } from '../timelines';
 import { pinnedEventSavedObjectType } from '../../saved_object_mappings/pinned_events';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts
index 61e25d419a0e45..1136753bc8316b 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts
@@ -8,15 +8,11 @@
 import { FrameworkRequest } from '../../../framework';
 import { mockGetTimelineValue, mockSavedObject } from '../../__mocks__/import_timelines';
 
-import {
-  convertStringToBase64,
-  getExistingPrepackagedTimelines,
-  getAllTimeline,
-  AllTimelinesResponse,
-} from '.';
+import { convertStringToBase64, getExistingPrepackagedTimelines, getAllTimeline } from '.';
 import { convertSavedObjectToSavedTimeline } from './convert_saved_object_to_savedtimeline';
 import { getNotesByTimelineId } from '../notes/saved_object';
 import { getAllPinnedEventsByTimelineId } from '../pinned_events';
+import { AllTimelinesResponse } from '../../../../../common/types/timeline';
 
 jest.mock('./convert_saved_object_to_savedtimeline', () => ({
   convertSavedObjectToSavedTimeline: jest.fn(),
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.ts
index 0f624ef5420bcf..8904a9103bc023 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.ts
@@ -12,22 +12,21 @@ import { UNAUTHENTICATED_USER } from '../../../../../common/constants';
 import { NoteSavedObject } from '../../../../../common/types/timeline/note';
 import { PinnedEventSavedObject } from '../../../../../common/types/timeline/pinned_event';
 import {
+  AllTimelinesResponse,
+  ExportTimelineNotFoundError,
+  PageInfoTimeline,
+  ResponseTimelines,
+  ResponseFavoriteTimeline,
+  ResponseTimeline,
   SavedTimeline,
+  SortTimeline,
   TimelineSavedObject,
   TimelineTypeLiteralWithNull,
-  ExportTimelineNotFoundError,
   TimelineStatusLiteralWithNull,
-} from '../../../../../common/types/timeline';
-import {
-  ResponseTimeline,
-  PageInfoTimeline,
-  SortTimeline,
-  ResponseFavoriteTimeline,
-  TimelineResult,
   TimelineType,
   TimelineStatus,
-  Maybe,
-} from '../../../../graphql/types';
+  TimelineResult,
+} from '../../../../../common/types/timeline';
 import { FrameworkRequest } from '../../../framework';
 import * as note from '../notes/saved_object';
 import * as pinnedEvent from '../pinned_events';
@@ -36,22 +35,10 @@ import { pickSavedTimeline } from './pick_saved_timeline';
 import { timelineSavedObjectType } from '../../saved_object_mappings/';
 import { draftTimelineDefaults } from '../../utils/default_timeline';
 import { AuthenticatedUser } from '../../../../../../security/server';
+import { Maybe } from '../../../../../common/search_strategy';
 export { pickSavedTimeline } from './pick_saved_timeline';
 export { convertSavedObjectToSavedTimeline } from './convert_saved_object_to_savedtimeline';
 
-interface ResponseTimelines {
-  timeline: TimelineSavedObject[];
-  totalCount: number;
-}
-
-export interface AllTimelinesResponse extends ResponseTimelines {
-  defaultTimelineCount: number;
-  templateTimelineCount: number;
-  elasticTemplateTimelineCount: number;
-  customTemplateTimelineCount: number;
-  favoriteCount: number;
-}
-
 export interface ResponseTemplateTimeline {
   code?: Maybe<number>;
 
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/notes/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/notes/index.ts
index de1e3578963537..b2fc7a0beb065f 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/schemas/notes/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/notes/index.ts
@@ -11,3 +11,14 @@ import { SavedNoteRuntimeType } from '../../../../../common/types/timeline/note'
 
 export const eventNotes = unionWithNullType(runtimeTypes.array(SavedNoteRuntimeType));
 export const globalNotes = unionWithNullType(runtimeTypes.array(SavedNoteRuntimeType));
+
+export const persistNoteSchema = runtimeTypes.intersection([
+  runtimeTypes.type({
+    note: SavedNoteRuntimeType,
+  }),
+  runtimeTypes.partial({
+    overrideOwner: unionWithNullType(runtimeTypes.boolean),
+    noteId: unionWithNullType(runtimeTypes.string),
+    version: unionWithNullType(runtimeTypes.string),
+  }),
+]);
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/pinned_events/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/pinned_events/index.ts
index 29afda10dce800..e0bd1f95f59539 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/schemas/pinned_events/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/pinned_events/index.ts
@@ -9,3 +9,12 @@ import * as runtimeTypes from 'io-ts';
 import { unionWithNullType } from '../../../../../common/utility_types';
 
 export const pinnedEventIds = unionWithNullType(runtimeTypes.array(runtimeTypes.string));
+export const persistPinnedEventSchema = runtimeTypes.intersection([
+  runtimeTypes.type({
+    eventId: runtimeTypes.string,
+  }),
+  runtimeTypes.partial({
+    pinnedEventId: unionWithNullType(runtimeTypes.string),
+    timelineId: unionWithNullType(runtimeTypes.string),
+  }),
+]);
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_to_any/schema.gql.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/delete_timelines_schema.ts
similarity index 68%
rename from x-pack/plugins/security_solution/server/graphql/scalar_to_any/schema.gql.ts
rename to x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/delete_timelines_schema.ts
index 79c4a881c10b9d..4aadb732836761 100644
--- a/x-pack/plugins/security_solution/server/graphql/scalar_to_any/schema.gql.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/delete_timelines_schema.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import gql from 'graphql-tag';
+import * as rt from 'io-ts';
 
-export const toAnySchema = gql`
-  scalar ToAny
-`;
+export const deleteTimelinesSchema = rt.type({
+  savedObjectIds: rt.array(rt.string),
+});
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timeline_by_id_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timeline_schema.ts
similarity index 70%
rename from x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timeline_by_id_schema.ts
rename to x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timeline_schema.ts
index 4e6102e2d87e45..cca6886f420256 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timeline_by_id_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timeline_schema.ts
@@ -7,9 +7,9 @@
 
 import * as rt from 'io-ts';
 
-export const getTimelineByIdSchemaQuery = rt.partial({
+export const getTimelineQuerySchema = rt.partial({
   template_timeline_id: rt.string,
   id: rt.string,
 });
 
-export type GetTimelineByIdSchemaQuery = rt.TypeOf<typeof getTimelineByIdSchemaQuery>;
+export type GetTimelineQuery = rt.TypeOf<typeof getTimelineQuerySchema>;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timelines_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timelines_schema.ts
new file mode 100644
index 00000000000000..7353741128435d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/get_timelines_schema.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as rt from 'io-ts';
+import {
+  direction,
+  sortFieldTimeline,
+  TimelineStatusLiteralRt,
+  TimelineTypeLiteralRt,
+} from '../../../../../common/types/timeline';
+import { unionWithNullType } from '../../../../../common/utility_types';
+
+const BoolFromString = rt.union([rt.literal('true'), rt.literal('false')]);
+
+export const getTimelinesQuerySchema = rt.partial({
+  only_user_favorite: unionWithNullType(BoolFromString),
+  page_index: unionWithNullType(rt.string),
+  page_size: unionWithNullType(rt.string),
+  search: unionWithNullType(rt.string),
+  sort_field: sortFieldTimeline,
+  sort_order: direction,
+  status: unionWithNullType(TimelineStatusLiteralRt),
+  timeline_type: unionWithNullType(TimelineTypeLiteralRt),
+});
+
+export const getTimelinesArgsSchema = rt.partial({
+  onlyUserFavorite: unionWithNullType(BoolFromString),
+  pageIndex: unionWithNullType(rt.string),
+  pageSize: unionWithNullType(rt.string),
+  search: unionWithNullType(rt.string),
+  sortField: sortFieldTimeline,
+  sortOrder: direction,
+  status: unionWithNullType(TimelineStatusLiteralRt),
+  timelineType: unionWithNullType(TimelineTypeLiteralRt),
+});
+
+export type GetTimelinesArgs = rt.TypeOf<typeof getTimelinesQuerySchema>;
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/index.ts
index e85ae2ab4ae865..a88d6a67415170 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/index.ts
@@ -6,5 +6,6 @@
  */
 export * from './create_timelines_schema';
 export * from './export_timelines_schema';
-export * from './get_timeline_by_id_schema';
+export * from './get_timeline_schema';
+export * from './get_timelines_schema';
 export * from './patch_timelines_schema';
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/persist_favorite_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/persist_favorite_schema.ts
new file mode 100644
index 00000000000000..9b96e8ce0ca183
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/persist_favorite_schema.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as rt from 'io-ts';
+
+import { TimelineTypeLiteralRt } from '../../../../../common/types/timeline';
+import { unionWithNullType } from '../../../../../common/utility_types';
+
+export const persistFavoriteSchema = rt.type({
+  timelineId: unionWithNullType(rt.string),
+  templateTimelineId: unionWithNullType(rt.string),
+  templateTimelineVersion: unionWithNullType(rt.number),
+  timelineType: unionWithNullType(TimelineTypeLiteralRt),
+});
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/utils/common.ts b/x-pack/plugins/security_solution/server/lib/timeline/utils/common.ts
index 443742ae88f0de..18fa84c9cf3ae0 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/utils/common.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/utils/common.ts
@@ -4,12 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import * as rt from 'io-ts';
 import { set } from '@elastic/safer-lodash-set/fp';
 import readline from 'readline';
 import fs from 'fs';
 import { Readable } from 'stream';
 import { createListStream } from '@kbn/utils';
+import { schema } from '@kbn/config-schema';
+import { isObject } from 'lodash/fp';
 
 import { KibanaRequest } from 'src/core/server';
 import { SetupPlugins } from '../../../plugin';
@@ -36,6 +38,37 @@ export const buildFrameworkRequest = async (
   );
 };
 
+export const escapeHatch = schema.object({}, { unknowns: 'allow' });
+
+export const formatErrors = (errors: rt.Errors): string[] => {
+  const err = errors.map((error) => {
+    if (error.message != null) {
+      return error.message;
+    } else {
+      const keyContext = error.context
+        .filter(
+          (entry) => entry.key != null && !Number.isInteger(+entry.key) && entry.key.trim() !== ''
+        )
+        .map((entry) => entry.key)
+        .join(',');
+
+      const nameContext = error.context.find((entry) => entry.type?.name?.length > 0);
+      const suppliedValue =
+        keyContext !== '' ? keyContext : nameContext != null ? nameContext.type.name : '';
+      const value = isObject(error.value) ? JSON.stringify(error.value) : error.value;
+      return `Invalid value "${value}" supplied to "${suppliedValue}"`;
+    }
+  });
+
+  return [...new Set(err)];
+};
+
+type ErrorFactory = (message: string) => Error;
+
+export const throwErrors = (createError: ErrorFactory) => (errors: rt.Errors) => {
+  throw createError(formatErrors(errors).join('\n'));
+};
+
 export const getReadables = (dataPath: string): Promise<Readable> =>
   new Promise((resolved, reject) => {
     const contents: string[] = [];
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 003ba4c8cf1908..d0b7e6500c42bd 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -36,7 +36,6 @@ import { SpacesPluginSetup as SpacesSetup } from '../../spaces/server';
 import { ILicense, LicensingPluginStart } from '../../licensing/server';
 import { FleetStartContract } from '../../fleet/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
-import { initServer } from './init_server';
 import { compose } from './lib/compose/kibana';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
@@ -300,8 +299,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       });
     }
 
-    const libs = compose(core, plugins, endpointContext);
-    initServer(libs);
+    compose(core, plugins, endpointContext);
 
     core.getStartServices().then(([_, depsStart]) => {
       const securitySolutionSearchStrategy = securitySolutionSearchStrategyProvider(depsStart.data);
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index 488816cc6ad903..54090dc886cebd 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -33,16 +33,26 @@ import { importRulesRoute } from '../lib/detection_engine/routes/rules/import_ru
 import { exportRulesRoute } from '../lib/detection_engine/routes/rules/export_rules_route';
 import { findRulesStatusesRoute } from '../lib/detection_engine/routes/rules/find_rules_status_route';
 import { getPrepackagedRulesStatusRoute } from '../lib/detection_engine/routes/rules/get_prepackaged_rules_status_route';
-import { importTimelinesRoute } from '../lib/timeline/routes/timelines/import_timelines';
-import { exportTimelinesRoute } from '../lib/timeline/routes/timelines/export_timelines';
-import { createTimelinesRoute } from '../lib/timeline/routes/timelines/create_timelines';
-import { updateTimelinesRoute } from '../lib/timeline/routes/timelines/patch_timelines';
+import {
+  createTimelinesRoute,
+  deleteTimelinesRoute,
+  exportTimelinesRoute,
+  getTimelineRoute,
+  getTimelinesRoute,
+  importTimelinesRoute,
+  patchTimelinesRoute,
+  persistFavoriteRoute,
+} from '../lib/timeline/routes/timelines';
 import { getDraftTimelinesRoute } from '../lib/timeline/routes/draft_timelines/get_draft_timelines';
 import { cleanDraftTimelinesRoute } from '../lib/timeline/routes/draft_timelines/clean_draft_timelines';
+
+import { persistNoteRoute } from '../lib/timeline/routes/notes';
+
+import { persistPinnedEventRoute } from '../lib/timeline/routes/pinned_events';
+
 import { SetupPlugins } from '../plugin';
 import { ConfigType } from '../config';
 import { installPrepackedTimelinesRoute } from '../lib/timeline/routes/prepackaged_timelines/install_prepackaged_timelines';
-import { getTimelineRoute } from '../lib/timeline/routes/timelines/get_timeline';
 
 export const initRoutes = (
   router: SecuritySolutionPluginRouter,
@@ -68,7 +78,7 @@ export const initRoutes = (
   deleteRulesBulkRoute(router);
 
   createTimelinesRoute(router, config, security);
-  updateTimelinesRoute(router, config, security);
+  patchTimelinesRoute(router, config, security);
   importRulesRoute(router, config, ml);
   exportRulesRoute(router, config);
 
@@ -76,10 +86,16 @@ export const initRoutes = (
   exportTimelinesRoute(router, config, security);
   getDraftTimelinesRoute(router, config, security);
   getTimelineRoute(router, config, security);
+  getTimelinesRoute(router, config, security);
   cleanDraftTimelinesRoute(router, config, security);
+  deleteTimelinesRoute(router, config, security);
+  persistFavoriteRoute(router, config, security);
 
   installPrepackedTimelinesRoute(router, config, security);
 
+  persistNoteRoute(router, config, security);
+  persistPinnedEventRoute(router, config, security);
+
   findRulesStatusesRoute(router);
 
   // Detection Engine Signals routes that have the REST endpoints of /api/detection_engine/signals
diff --git a/x-pack/plugins/security_solution/server/utils/build_query/create_options.test.ts b/x-pack/plugins/security_solution/server/utils/build_query/create_options.test.ts
deleted file mode 100644
index 4697f02ad5486f..00000000000000
--- a/x-pack/plugins/security_solution/server/utils/build_query/create_options.test.ts
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { omit } from 'lodash/fp';
-
-import { DEFAULT_INDEX_PATTERN } from '../../../common/constants';
-import { Direction } from '../../graphql/types';
-import { RequestOptions } from '../../lib/framework';
-
-import { Args, Configuration, createOptions, FieldNodes } from './create_options';
-
-describe('createOptions', () => {
-  let source: Configuration;
-  let args: Args;
-  let info: FieldNodes;
-  beforeEach(() => {
-    source = {
-      configuration: {
-        fields: {
-          host: 'host-1',
-          container: 'container-1',
-          message: ['message-1'],
-          pod: 'pod-1',
-          tiebreaker: 'tiebreaker',
-          timestamp: 'timestamp-1',
-        },
-      },
-    };
-    args = {
-      defaultIndex: DEFAULT_INDEX_PATTERN,
-      pagination: {
-        limit: 5,
-      },
-      docValueFields: [
-        {
-          field: '@timestamp',
-          format: 'date_time',
-        },
-        {
-          field: 'event.end',
-          format: 'date_time',
-        },
-      ],
-      timerange: {
-        from: '2020-07-08T08:00:00.000Z',
-        to: '2020-07-08T20:00:00.000Z',
-        interval: '12 hours ago',
-      },
-      sortField: { sortFieldId: 'sort-1', direction: Direction.asc },
-    };
-    info = {
-      fieldNodes: [
-        {
-          name: {
-            kind: 'Name',
-            value: 'value-1',
-          },
-          kind: 'Field',
-        },
-      ],
-    };
-  });
-
-  test('should create options given all input including sort field', () => {
-    const options = createOptions(source, args, info);
-    const expected: RequestOptions = {
-      defaultIndex: DEFAULT_INDEX_PATTERN,
-      sourceConfiguration: {
-        fields: {
-          host: 'host-1',
-          container: 'container-1',
-          message: ['message-1'],
-          pod: 'pod-1',
-          tiebreaker: 'tiebreaker',
-          timestamp: 'timestamp-1',
-        },
-      },
-      sortField: { sortFieldId: 'sort-1', direction: Direction.asc },
-      pagination: {
-        limit: 5,
-      },
-      filterQuery: {},
-      docValueFields: [
-        {
-          field: '@timestamp',
-          format: 'date_time',
-        },
-        {
-          field: 'event.end',
-          format: 'date_time',
-        },
-      ],
-      fields: [],
-      timerange: {
-        from: '2020-07-08T08:00:00.000Z',
-        to: '2020-07-08T20:00:00.000Z',
-        interval: '12 hours ago',
-      },
-    };
-    expect(options).toEqual(expected);
-  });
-
-  test('should create options given all input except sorting', () => {
-    const argsWithoutSort: Args = omit('sortField', args);
-    const options = createOptions(source, argsWithoutSort, info);
-    const expected: RequestOptions = {
-      defaultIndex: DEFAULT_INDEX_PATTERN,
-      sourceConfiguration: {
-        fields: {
-          host: 'host-1',
-          container: 'container-1',
-          message: ['message-1'],
-          pod: 'pod-1',
-          tiebreaker: 'tiebreaker',
-          timestamp: 'timestamp-1',
-        },
-      },
-      pagination: {
-        limit: 5,
-      },
-      filterQuery: {},
-      docValueFields: [
-        {
-          field: '@timestamp',
-          format: 'date_time',
-        },
-        {
-          field: 'event.end',
-          format: 'date_time',
-        },
-      ],
-      fields: [],
-      timerange: {
-        from: '2020-07-08T08:00:00.000Z',
-        to: '2020-07-08T20:00:00.000Z',
-        interval: '12 hours ago',
-      },
-    };
-    expect(options).toEqual(expected);
-  });
-
-  test('should create options given all input except docValueFields', () => {
-    const argsWithoutSort: Args = omit('docValueFields', args);
-    const options = createOptions(source, argsWithoutSort, info);
-    const expected: RequestOptions = {
-      defaultIndex: DEFAULT_INDEX_PATTERN,
-      sourceConfiguration: {
-        fields: {
-          host: 'host-1',
-          container: 'container-1',
-          message: ['message-1'],
-          pod: 'pod-1',
-          tiebreaker: 'tiebreaker',
-          timestamp: 'timestamp-1',
-        },
-      },
-      sortField: { sortFieldId: 'sort-1', direction: Direction.asc },
-      pagination: {
-        limit: 5,
-      },
-      filterQuery: {},
-      docValueFields: [],
-      fields: [],
-      timerange: {
-        from: '2020-07-08T08:00:00.000Z',
-        to: '2020-07-08T20:00:00.000Z',
-        interval: '12 hours ago',
-      },
-    };
-    expect(options).toEqual(expected);
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/utils/build_query/create_options.ts b/x-pack/plugins/security_solution/server/utils/build_query/create_options.ts
deleted file mode 100644
index a882b20f59f470..00000000000000
--- a/x-pack/plugins/security_solution/server/utils/build_query/create_options.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GraphQLResolveInfo } from 'graphql';
-import { getOr } from 'lodash/fp';
-
-import {
-  PaginationInput,
-  PaginationInputPaginated,
-  SortField,
-  Source,
-  TimerangeInput,
-  DocValueFieldsInput,
-} from '../../graphql/types';
-import { RequestOptions, RequestOptionsPaginated } from '../../lib/framework';
-import { parseFilterQuery } from '../serialized_query';
-
-import { getFields } from '.';
-
-export type Configuration = Pick<Source, 'configuration'>;
-
-export type FieldNodes = Pick<GraphQLResolveInfo, 'fieldNodes'>;
-
-// TODO: Once all the widgets are using sortField, this will be swapped out
-// for a generic type Similar to EventsSourceArgs that all GraphQL is using
-// and sortField won't be optional and might support multi-sort
-export interface Args {
-  timerange?: TimerangeInput | null;
-  pagination?: PaginationInput | null;
-  filterQuery?: string | null;
-  sortField?: SortField | null;
-  defaultIndex: string[];
-  docValueFields?: DocValueFieldsInput[];
-}
-export interface ArgsPaginated {
-  timerange?: TimerangeInput | null;
-  pagination?: PaginationInputPaginated | null;
-  filterQuery?: string | null;
-  sortField?: SortField | null;
-  defaultIndex: string[];
-  docValueFields?: DocValueFieldsInput[];
-}
-
-export const createOptions = (
-  source: Configuration,
-  args: Args,
-  info: FieldNodes,
-  fieldReplacement: string = 'edges.node.'
-): RequestOptions => {
-  const fields = getFields(getOr([], 'fieldNodes[0]', info));
-  return {
-    defaultIndex: args.defaultIndex,
-    docValueFields: args.docValueFields ?? [],
-    sourceConfiguration: source.configuration,
-    timerange: args.timerange!,
-    pagination: args.pagination!,
-    sortField: args.sortField!,
-    filterQuery: parseFilterQuery(args.filterQuery || ''),
-    fields: fields
-      .filter((field) => !field.includes('__typename'))
-      .map((field) => field.replace(fieldReplacement, '')),
-  };
-};
-
-export const createOptionsPaginated = (
-  source: Configuration,
-  args: ArgsPaginated,
-  info: FieldNodes,
-  fieldReplacement: string = 'edges.node.'
-): RequestOptionsPaginated => {
-  const fields = getFields(getOr([], 'fieldNodes[0]', info));
-  return {
-    defaultIndex: args.defaultIndex,
-    docValueFields: args.docValueFields ?? [],
-    sourceConfiguration: source.configuration,
-    timerange: args.timerange!,
-    pagination: args.pagination!,
-    sortField: args.sortField!,
-    filterQuery: parseFilterQuery(args.filterQuery || ''),
-    fields: fields
-      .filter((field) => !field.includes('__typename'))
-      .map((field) => field.replace(fieldReplacement, '')),
-  };
-};
diff --git a/x-pack/plugins/security_solution/server/utils/serialized_query.ts b/x-pack/plugins/security_solution/server/utils/serialized_query.ts
index d323e4a8ed8f52..fb5009eefa3180 100644
--- a/x-pack/plugins/security_solution/server/utils/serialized_query.ts
+++ b/x-pack/plugins/security_solution/server/utils/serialized_query.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { UserInputError } from 'apollo-server-errors';
 import { isEmpty, isPlainObject, isString } from 'lodash/fp';
 
 import { JsonObject } from '../../../../../src/plugins/kibana_utils/common';
@@ -25,9 +24,8 @@ export const parseFilterQuery = (filterQuery: string): JsonObject => {
     }
     return {};
   } catch (err) {
-    throw new UserInputError(`Failed to parse query: ${err}`, {
-      query: filterQuery,
-      originalError: err,
-    });
+    throw new Error(
+      `Failed to parse query: ${JSON.stringify(err)}, query: ${JSON.stringify(filterQuery)}`
+    );
   }
 };
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/_home.scss b/x-pack/plugins/snapshot_restore/public/application/sections/home/_home.scss
index 468ada5c2712ad..f9bdaf2bf4b1ad 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/_home.scss
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/_home.scss
@@ -29,18 +29,3 @@
     display: flex;
   }
 }
-
-/*
- * Wraps long snapshot name with ellipsis when it is rendered with an icon
- */
-.snapshotRestorePolicyTableSnapshotFailureContainer {
-  max-width: 200px;
-  > .euiFlexItem:last-child {
-    min-width: 0;
-    .euiText {
-      white-space: nowrap;
-      overflow: hidden;
-      text-overflow: ellipsis;
-    }
-  }
-}
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx
index 830b9985f86fd6..92ee611df61b75 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx
@@ -117,11 +117,7 @@ export const PolicyTable: React.FunctionComponent<Props> = ({
         // Alert user if last snapshot failed
         if (lastSuccess && lastFailure && lastFailure.time > lastSuccess.time) {
           return (
-            <EuiFlexGroup
-              gutterSize="s"
-              alignItems="center"
-              className="snapshotRestorePolicyTableSnapshotFailureContainer"
-            >
+            <EuiFlexGroup gutterSize="s" alignItems="center">
               <EuiFlexItem grow={false}>
                 <EuiToolTip
                   position="top"
diff --git a/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_repository.ts b/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_repository.ts
index 57e2c31d639ce0..45aa5982961166 100644
--- a/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_repository.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/services/validation/validate_repository.ts
@@ -31,7 +31,7 @@ export interface RepositorySettingsValidation {
   [key: string]: string[];
 }
 
-export const INVALID_NAME_CHARS = ['"', '*', '\\', '<', '|', ',', '>', '/', '?'];
+export const INVALID_NAME_CHARS = ['"', '*', '\\', '<', '|', ',', '>', '/', '?', '#'];
 
 const isStringEmpty = (str: string | null): boolean => {
   return str ? !Boolean(str.trim()) : true;
diff --git a/x-pack/plugins/transform/common/api_schemas/field_histograms.ts b/x-pack/plugins/transform/common/api_schemas/field_histograms.ts
index 9f6f4c15d803ae..5a808ab9788b19 100644
--- a/x-pack/plugins/transform/common/api_schemas/field_histograms.ts
+++ b/x-pack/plugins/transform/common/api_schemas/field_histograms.ts
@@ -16,7 +16,7 @@ export const fieldHistogramsRequestSchema = schema.object({
   query: schema.any(),
   /** The fields to return histogram data. */
   fields: schema.arrayOf(schema.any()),
-  /** Optional runtime mappings */
+  /** Optional runtime fields */
   runtimeMappings: runtimeMappingsSchema,
   /** Number of documents to be collected in the sample processed on each shard, or -1 for no sampling. */
   samplerShardSize: schema.number(),
diff --git a/x-pack/plugins/transform/public/app/common/request.test.ts b/x-pack/plugins/transform/public/app/common/request.test.ts
index f25fedb7aaba33..6a64c6af6428fe 100644
--- a/x-pack/plugins/transform/public/app/common/request.test.ts
+++ b/x-pack/plugins/transform/public/app/common/request.test.ts
@@ -266,7 +266,7 @@ describe('Transform: Common', () => {
     });
   });
 
-  test('getCreateTransformRequestBody() with runtime mappings', () => {
+  test('getCreateTransformRequestBody() with runtime fields', () => {
     const runtimeMappings = {
       rt_bytes_bigger: {
         type: 'double',
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_pivot_editor_switch/advanced_pivot_editor_switch.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_pivot_editor_switch/advanced_pivot_editor_switch.tsx
index 3883be6a8bfa80..900af603266b86 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_pivot_editor_switch/advanced_pivot_editor_switch.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_pivot_editor_switch/advanced_pivot_editor_switch.tsx
@@ -26,9 +26,6 @@ export const AdvancedPivotEditorSwitch: FC<StepDefineFormHook> = ({
       isAdvancedPivotEditorApplyButtonEnabled,
     },
   },
-  pivotConfig: {
-    actions: { setAggList, setGroupByList },
-  },
 }) => {
   return (
     <EuiFormRow>
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_query_editor_switch/advanced_query_editor_switch.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_query_editor_switch/advanced_query_editor_switch.tsx
index aedd4a2450f54a..43c6684a5a2bc2 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_query_editor_switch/advanced_query_editor_switch.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_query_editor_switch/advanced_query_editor_switch.tsx
@@ -27,6 +27,8 @@ export const AdvancedQueryEditorSwitch: FC<StepDefineFormHook> = ({
       isAdvancedSourceEditorEnabled,
       isAdvancedSourceEditorSwitchModalVisible,
       sourceConfigUpdated,
+      advancedEditorSourceConfigLastApplied,
+      advancedEditorSourceConfig,
     },
   },
   searchBar: {
@@ -53,7 +55,11 @@ export const AdvancedQueryEditorSwitch: FC<StepDefineFormHook> = ({
         )}
         checked={isAdvancedSourceEditorEnabled}
         onChange={() => {
-          if (isAdvancedSourceEditorEnabled && sourceConfigUpdated) {
+          if (
+            isAdvancedSourceEditorEnabled &&
+            (sourceConfigUpdated ||
+              advancedEditorSourceConfig !== advancedEditorSourceConfigLastApplied)
+          ) {
             setAdvancedSourceEditorSwitchModalVisible(true);
             return;
           }
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/advanced_runtime_mappings_editor_switch.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/advanced_runtime_mappings_editor_switch.tsx
index be297c10a8f88c..2ee8bc9995df61 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/advanced_runtime_mappings_editor_switch.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/advanced_runtime_mappings_editor_switch.tsx
@@ -8,35 +8,58 @@
 import React, { FC } from 'react';
 import { EuiSwitch } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { StepDefineFormHook } from '../step_define';
+import { SwitchModal } from './switch_modal';
+import { useAdvancedRuntimeMappingsEditor } from '../step_define/hooks/use_advanced_runtime_mappings_editor';
 
-export const AdvancedRuntimeMappingsEditorSwitch: FC<
-  StepDefineFormHook['runtimeMappingsEditor']
-> = (props) => {
+type Props = ReturnType<typeof useAdvancedRuntimeMappingsEditor>;
+export const AdvancedRuntimeMappingsEditorSwitch: FC<Props> = (props) => {
   const {
-    actions: { setRuntimeMappingsUpdated, toggleRuntimeMappingsEditor },
-    state: { isRuntimeMappingsEditorEnabled },
+    actions: { toggleRuntimeMappingsEditor, setRuntimeMappingsEditorSwitchModalVisible },
+    state: {
+      isRuntimeMappingsEditorEnabled,
+      isRuntimeMappingsEditorSwitchModalVisible,
+      advancedEditorRuntimeMappingsLastApplied,
+      advancedRuntimeMappingsConfig,
+    },
   } = props;
 
   // If switching to KQL after updating via editor - reset search
   const toggleEditorHandler = (reset = false) => {
-    if (reset === true) {
-      setRuntimeMappingsUpdated(false);
-    }
     toggleRuntimeMappingsEditor(reset);
   };
 
   return (
-    <EuiSwitch
-      label={i18n.translate(
-        'xpack.transform.stepDefineForm.advancedEditorRuntimeMappingsSwitchLabel',
-        {
-          defaultMessage: 'Edit runtime mappings',
-        }
+    <>
+      <EuiSwitch
+        label={i18n.translate(
+          'xpack.transform.stepDefineForm.advancedEditorRuntimeFieldsSwitchLabel',
+          {
+            defaultMessage: 'Edit runtime fields',
+          }
+        )}
+        checked={isRuntimeMappingsEditorEnabled}
+        onChange={() => {
+          if (
+            isRuntimeMappingsEditorEnabled &&
+            advancedRuntimeMappingsConfig !== advancedEditorRuntimeMappingsLastApplied
+          ) {
+            setRuntimeMappingsEditorSwitchModalVisible(true);
+            return;
+          }
+
+          toggleEditorHandler();
+        }}
+        data-test-subj="transformAdvancedRuntimeMappingsEditorSwitch"
+      />
+      {isRuntimeMappingsEditorSwitchModalVisible && (
+        <SwitchModal
+          onCancel={() => setRuntimeMappingsEditorSwitchModalVisible(false)}
+          onConfirm={() => {
+            setRuntimeMappingsEditorSwitchModalVisible(false);
+            toggleEditorHandler(true);
+          }}
+        />
       )}
-      checked={isRuntimeMappingsEditorEnabled}
-      onChange={() => toggleEditorHandler()}
-      data-test-subj="transformAdvancedRuntimeMappingsEditorSwitch"
-    />
+    </>
   );
 };
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/switch_modal.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/switch_modal.tsx
new file mode 100644
index 00000000000000..ff08ab37bb3e6c
--- /dev/null
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_editor_switch/switch_modal.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC } from 'react';
+import { EuiConfirmModal } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+interface Props {
+  onCancel: () => void;
+  onConfirm: () => void;
+}
+
+const modalTitle = i18n.translate('xpack.transform.stepDefineForm.runtimeEditorSwitchModalTitle', {
+  defaultMessage: 'Edits will be lost',
+});
+
+const cancelButtonText = i18n.translate(
+  'xpack.transform.stepDefineForm.runtimeEditorSwitchModalCancelButtonText',
+  {
+    defaultMessage: 'Cancel',
+  }
+);
+
+const applyChangesText = i18n.translate(
+  'xpack.transform.stepDefineForm.runtimeEditorSwitchModalConfirmButtonText',
+  {
+    defaultMessage: 'Close editor',
+  }
+);
+const modalMessage = i18n.translate(
+  'xpack.transform.stepDefineForm.runtimeEditorSwitchModalBodyText',
+  {
+    defaultMessage: `The changes in the advanced editor haven't been applied yet. By closing the editor you will lose your edits.`,
+  }
+);
+
+export const SwitchModal: FC<Props> = ({ onCancel, onConfirm }) => (
+  <EuiConfirmModal
+    title={modalTitle}
+    onCancel={onCancel}
+    onConfirm={onConfirm}
+    cancelButtonText={cancelButtonText}
+    confirmButtonText={applyChangesText}
+    buttonColor="danger"
+    defaultFocusedButton="confirm"
+  >
+    <p>{modalMessage}</p>
+  </EuiConfirmModal>
+);
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_settings/advanced_runtime_mappings_settings.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_settings/advanced_runtime_mappings_settings.tsx
index 7965db99b335b7..29e341fdaeaea9 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_settings/advanced_runtime_mappings_settings.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/advanced_runtime_mappings_settings/advanced_runtime_mappings_settings.tsx
@@ -29,9 +29,9 @@ import { isPivotAggConfigWithUiSupport } from '../../../../common/pivot_group_by
 
 const advancedEditorsSidebarWidth = '220px';
 const COPY_TO_CLIPBOARD_RUNTIME_MAPPINGS = i18n.translate(
-  'xpack.transform.indexPreview.copyRuntimeMappingsClipboardTooltip',
+  'xpack.transform.indexPreview.copyRuntimeFieldsClipboardTooltip',
   {
-    defaultMessage: 'Copy Dev Console statement of the runtime mappings to the clipboard.',
+    defaultMessage: 'Copy Dev Console statement of the runtime fields to the clipboard.',
   }
 );
 
@@ -87,15 +87,15 @@ export const AdvancedRuntimeMappingsSettings: FC<StepDefineFormHook> = (props) =
 
       <EuiFormRow
         fullWidth={true}
-        label={i18n.translate('xpack.transform.stepDefineForm.runtimeMappingsLabel', {
-          defaultMessage: 'Runtime mappings',
+        label={i18n.translate('xpack.transform.stepDefineForm.runtimeFieldsLabel', {
+          defaultMessage: 'Runtime fields',
         })}
       >
         <EuiFlexGroup alignItems="baseline" justifyContent="spaceBetween">
           <EuiFlexItem grow={true}>
             {runtimeMappings !== undefined && Object.keys(runtimeMappings).length > 0 ? (
               <FormattedMessage
-                id="xpack.transform.stepDefineForm.runtimeMappingsListLabel"
+                id="xpack.transform.stepDefineForm.runtimeFieldsListLabel"
                 defaultMessage="{runtimeFields}"
                 values={{
                   runtimeFields: Object.keys(runtimeMappings).join(','),
@@ -104,7 +104,7 @@ export const AdvancedRuntimeMappingsSettings: FC<StepDefineFormHook> = (props) =
             ) : (
               <FormattedMessage
                 id="xpack.transform.stepDefineForm.noRuntimeMappingsLabel"
-                defaultMessage="No runtime mapping"
+                defaultMessage="No runtime field"
               />
             )}
 
@@ -145,10 +145,10 @@ export const AdvancedRuntimeMappingsSettings: FC<StepDefineFormHook> = (props) =
                   <EuiSpacer size="s" />
                   <EuiText size="xs">
                     {i18n.translate(
-                      'xpack.transform.stepDefineForm.advancedRuntimeMappingsEditorHelpText',
+                      'xpack.transform.stepDefineForm.advancedRuntimeFieldsEditorHelpText',
                       {
                         defaultMessage:
-                          'The advanced editor allows you to edit the runtime mappings of the transform configuration.',
+                          'The advanced editor allows you to edit the runtime fields of the transform configuration.',
                       }
                     )}
                   </EuiText>
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/apply_transform_config_to_define_state.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/apply_transform_config_to_define_state.ts
index 6298874a203666..497f37036725cd 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/apply_transform_config_to_define_state.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/apply_transform_config_to_define_state.ts
@@ -37,7 +37,7 @@ export function applyTransformConfigToDefineState(
   transformConfig?: TransformBaseConfig,
   indexPattern?: StepDefineFormProps['searchItems']['indexPattern']
 ): StepDefineExposedState {
-  // apply runtime mappings from both the index pattern and inline configurations
+  // apply runtime fields from both the index pattern and inline configurations
   state.runtimeMappings = getCombinedRuntimeMappings(
     indexPattern,
     transformConfig?.source?.runtime_mappings
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/components/filter_agg_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/components/filter_agg_form.tsx
index 9b349541a78a3e..e3e767a81b01d0 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/components/filter_agg_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/components/filter_agg_form.tsx
@@ -39,7 +39,7 @@ export function getSupportedFilterAggs(
     ];
   }
 
-  throw new Error(`The field ${fieldName} does not exist in the index or runtime mappings`);
+  throw new Error(`The field ${fieldName} does not exist in the index or runtime fields`);
 }
 
 /**
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_advanced_runtime_mappings_editor.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_advanced_runtime_mappings_editor.ts
index 2ad7c4344a101a..dd58456e15adbf 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_advanced_runtime_mappings_editor.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_advanced_runtime_mappings_editor.ts
@@ -62,11 +62,8 @@ export const useAdvancedRuntimeMappingsEditor = (defaults: StepDefineExposedStat
   const toggleRuntimeMappingsEditor = (reset = false) => {
     if (reset === true) {
       setRuntimeMappingsUpdated(false);
+      setAdvancedRuntimeMappingsConfig(advancedEditorRuntimeMappingsLastApplied);
     }
-    if (isRuntimeMappingsEditorEnabled === false) {
-      setAdvancedEditorRuntimeMappingsLastApplied(advancedRuntimeMappingsConfig);
-    }
-
     setRuntimeMappingsEditorEnabled(!isRuntimeMappingsEditorEnabled);
     setRuntimeMappingsEditorApplyButtonEnabled(false);
   };
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_step_define_form.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_step_define_form.ts
index 0ceea070df1b66..b56df5e395c881 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_step_define_form.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/hooks/use_step_define_form.ts
@@ -51,7 +51,7 @@ export const useStepDefineForm = ({ overrides, onChange, searchItems }: StepDefi
   // source config hook
   const advancedSourceEditor = useAdvancedSourceEditor(defaults, previewRequest);
 
-  // runtime mappings config hook
+  // runtime fields config hook
   const runtimeMappingsEditor = useAdvancedRuntimeMappingsEditor(defaults);
 
   useEffect(() => {
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 182f7ef44e8205..f130449090dee8 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -2808,7 +2808,6 @@
     "indexPatternManagement.editIndexPattern.scripted.table.nameHeader": "名前",
     "indexPatternManagement.editIndexPattern.scripted.table.scriptDescription": "フィールドのスクリプトです",
     "indexPatternManagement.editIndexPattern.scripted.table.scriptHeader": "スクリプト",
-    "indexPatternManagement.editIndexPattern.scriptedHeader": "スクリプトフィールド",
     "indexPatternManagement.editIndexPattern.scriptedLabel": "ビジュアライゼーションにスクリプトフィールドを使用し、ドキュメントに表示させることができます。ただし、スクリプトフィールドは検索できません。",
     "indexPatternManagement.editIndexPattern.setDefaultAria": "デフォルトのインデックスに設定します。",
     "indexPatternManagement.editIndexPattern.setDefaultTooltip": "デフォルトのインデックスに設定します。",
@@ -2826,7 +2825,6 @@
     "indexPatternManagement.editIndexPattern.source.table.matchesHeader": "一致",
     "indexPatternManagement.editIndexPattern.source.table.notMatchedLabel": "ソースフィルターが既知のフィールドと一致しません。",
     "indexPatternManagement.editIndexPattern.source.table.saveAria": "保存",
-    "indexPatternManagement.editIndexPattern.sourceHeader": "フィールドフィルター",
     "indexPatternManagement.editIndexPattern.sourceLabel": "フィールドフィルターは、ドキュメントの取得時に 1 つまたは複数のフィールドを除外するのに使用される場合もあります。これは Discover アプリでのドキュメントの表示中、またはダッシュボードアプリの保存された検索の結果を表示する表で起こります。ドキュメントに大きなフィールドや重要ではないフィールドが含まれている場合、この程度の低いレベルでフィルターにより除外すると良いかもしれません。",
     "indexPatternManagement.editIndexPattern.sourcePlaceholder": "フィールドフィルター、ワイルドカード使用可 (例：「user*」と入力して「user」で始まるフィールドをフィルタリング) ",
     "indexPatternManagement.editIndexPattern.tabs.fieldsHeader": "フィールド",
@@ -2904,8 +2902,6 @@
     "indexPatternManagement.testScript.resultsTitle": "結果を表示",
     "indexPatternManagement.testScript.submitButtonLabel": "スクリプトを実行",
     "indexPatternManagement.typeLabel": "型",
-    "indexPatternManagement.warningCallOut.descriptionLabel": "計算値の表示と集約にスクリプトフィールドが使用できます。そのため非常に遅い場合があり、適切に行わないとKibanaが使用できなくなる可能性もあります。この場合安全策はありません。入力ミスがあると、あちこちに予期せぬ例外が起こります！",
-    "indexPatternManagement.warningCallOutHeader": "十分ご注意ください",
     "indexPatternManagement.warningCallOutLabel.callOutDetail": "スクリプトフィールドを使う前に、{scripFields}と{scriptsInAggregation}についてよく理解するようにしてください。",
     "indexPatternManagement.warningCallOutLabel.scripFieldsLink": "スクリプトフィールド",
     "indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink": "集約におけるスクリプト",
@@ -8248,7 +8244,6 @@
     "xpack.fleet.agentList.policyColumnTitle": "エージェントポリシー",
     "xpack.fleet.agentList.policyFilterText": "エージェントポリシー",
     "xpack.fleet.agentList.reassignActionText": "新しいポリシーに割り当てる",
-    "xpack.fleet.agentList.revisionNumber": "rev. {revNumber}",
     "xpack.fleet.agentList.showUpgradeableFilterLabel": "アップグレードが利用可能です",
     "xpack.fleet.agentList.statusColumnTitle": "ステータス",
     "xpack.fleet.agentList.statusFilterText": "ステータス",
@@ -8666,7 +8661,6 @@
     "xpack.fleet.policyForm.generalSettingsGroupDescription": "エージェントポリシーの名前と説明を選択してください。",
     "xpack.fleet.policyForm.generalSettingsGroupTitle": "一般設定",
     "xpack.fleet.policyForm.unableToDeleteDefaultPolicyText": "デフォルトポリシーは削除できません",
-    "xpack.fleet.policyNameLink.revisionNumber": "rev. {revNumber}",
     "xpack.fleet.securityRequiredErrorMessage": "Fleet を使用するには、Kibana と Elasticsearch でセキュリティを有効にする必要があります。",
     "xpack.fleet.securityRequiredErrorTitle": "セキュリティが有効ではありません",
     "xpack.fleet.settings.additionalYamlConfig": "Elasticsearch出力構成",
@@ -11096,7 +11090,6 @@
     "xpack.infra.sourceConfiguration.hostNameFieldDescription": "ホストの識別に使用されるフィールドです",
     "xpack.infra.sourceConfiguration.hostNameFieldLabel": "ホスト名",
     "xpack.infra.sourceConfiguration.indicesSectionTitle": "インデックス",
-    "xpack.infra.sourceConfiguration.logColumnListEmptyErrorMessage": "ログ列リストは未入力のままにできません。",
     "xpack.infra.sourceConfiguration.logColumnsSectionTitle": "ログ列",
     "xpack.infra.sourceConfiguration.logIndicesDescription": "ログデータを含む一致するインデックスのインデックスパターンです",
     "xpack.infra.sourceConfiguration.logIndicesLabel": "ログインデックス",
@@ -12462,8 +12455,6 @@
     "xpack.maps.layerControl.closeLayerTOCButtonAriaLabel": "レイヤーパネルを畳む",
     "xpack.maps.layerControl.layersTitle": "レイヤー",
     "xpack.maps.layerControl.openLayerTOCButtonAriaLabel": "レイヤーパネルを拡張",
-    "xpack.maps.layerControl.tocEntry.editButtonAriaLabel": "レイヤーを編集",
-    "xpack.maps.layerControl.tocEntry.editButtonTitle": "レイヤーを編集",
     "xpack.maps.layerControl.tocEntry.grabButtonAriaLabel": "レイヤーの並べ替え",
     "xpack.maps.layerControl.tocEntry.grabButtonTitle": "レイヤーの並べ替え",
     "xpack.maps.layerControl.tocEntry.hideDetailsButtonAriaLabel": "レイヤー詳細を非表示",
@@ -12521,7 +12512,6 @@
     "xpack.maps.layerPanel.whereExpression.helpText": "右のソースを絞り込むには、クエリを使用します。",
     "xpack.maps.layerPanel.whereExpression.queryBarSubmitButtonLabel": "フィルターを設定",
     "xpack.maps.layerTocActions.cloneLayerTitle": "レイヤーおクローンを作成",
-    "xpack.maps.layerTocActions.editLayerTitle": "レイヤーを編集",
     "xpack.maps.layerTocActions.fitToDataTitle": "データに合わせる",
     "xpack.maps.layerTocActions.hideLayerTitle": "レイヤーの非表示",
     "xpack.maps.layerTocActions.layerActionsTitle": "レイヤー操作",
@@ -18188,8 +18178,6 @@
     "xpack.securitySolution.containers.detectionEngine.createPrePackagedTimelineSuccesDescription": "Elasticから事前にパッケージ化されているタイムラインテンプレートをインストールしました",
     "xpack.securitySolution.containers.detectionEngine.rulesAndTimelines": "ルールとタイムラインを取得できませんでした",
     "xpack.securitySolution.containers.detectionEngine.tagFetchFailDescription": "タグを取得できませんでした",
-    "xpack.securitySolution.containers.errors.dataFetchFailureTitle": "データの取得に失敗",
-    "xpack.securitySolution.containers.errors.networkFailureTitle": "ネットワーク障害",
     "xpack.securitySolution.containers.errors.stopJobFailureTitle": "ジョブ停止エラー",
     "xpack.securitySolution.customizeEventRenderers.customizeEventRenderersDescription": "イベントレンダラーは、イベントで最も関連性が高い詳細情報を自動的に表示し、ストーリーを明らかにします",
     "xpack.securitySolution.customizeEventRenderers.customizeEventRenderersTitle": "イベントレンダラーのカスタマイズ",
@@ -21604,7 +21592,6 @@
     "xpack.transform.groupByLabelForm.editIntervalAriaLabel": "間隔を編集",
     "xpack.transform.home.breadcrumbTitle": "変換",
     "xpack.transform.indexPreview.copyClipboardTooltip": "インデックスプレビューの開発コンソールステートメントをクリップボードにコピーします。",
-    "xpack.transform.indexPreview.copyRuntimeMappingsClipboardTooltip": "ランタイムマッピングの開発コンソールステートメントをクリップボードにコピーします。",
     "xpack.transform.latestPreview.latestPreviewIncompleteConfigCalloutBody": "1 つ以上の一意キーと並べ替えフィールドを選択してください。",
     "xpack.transform.licenseCheckErrorMessage": "ライセンス確認失敗",
     "xpack.transform.list.emptyPromptButtonText": "初めての変換を作成してみましょう。",
@@ -21664,14 +21651,12 @@
     "xpack.transform.stepDefineForm.advancedEditorHelpText": "詳細エディターでは、変換のピボット構成を編集できます。",
     "xpack.transform.stepDefineForm.advancedEditorHelpTextLink": "使用可能なオプションの詳細を確認してください。",
     "xpack.transform.stepDefineForm.advancedEditorLabel": "ピボット構成オブジェクト",
-    "xpack.transform.stepDefineForm.advancedEditorRuntimeMappingsSwitchLabel": "ランタイムマッピングの編集",
     "xpack.transform.stepDefineForm.advancedEditorSourceConfigSwitchLabel": "JSONクエリを編集",
     "xpack.transform.stepDefineForm.advancedEditorSwitchLabel": "JSON構成を編集",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalBodyText": "詳細エディターの変更は適用されませんでした。詳細エディターを無効にすると、編集内容が失われます。",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalCancelButtonText": "キャンセル",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalConfirmButtonText": "詳細エディターを無効にする",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalTitle": "適用されていない変更",
-    "xpack.transform.stepDefineForm.advancedRuntimeMappingsEditorHelpText": "高度なエディターでは、変換構成のランタイムマッピングを編集できます。",
     "xpack.transform.stepDefineForm.advancedSourceEditorApplyButtonText": "変更を適用",
     "xpack.transform.stepDefineForm.advancedSourceEditorAriaLabel": "クエリの詳細エディター",
     "xpack.transform.stepDefineForm.advancedSourceEditorHelpText": "高度なエディターでは、変換構成のソースクエリ句を編集できます。",
@@ -21697,8 +21682,6 @@
     "xpack.transform.stepDefineForm.pivotLabel": "ピボット",
     "xpack.transform.stepDefineForm.queryPlaceholderKql": "例：{example}",
     "xpack.transform.stepDefineForm.queryPlaceholderLucene": "例：{example}",
-    "xpack.transform.stepDefineForm.runtimeMappingsLabel": "ランタイムマッピング",
-    "xpack.transform.stepDefineForm.runtimeMappingsListLabel": "{runtimeFields}",
     "xpack.transform.stepDefineForm.savedSearchLabel": "保存検索",
     "xpack.transform.stepDefineForm.sortFieldOptionsEmptyError": "並べ替えの条件にする日付フィールドがありません。別のフィールド型を使用するには、構成をクリップボードにコピーして、コンソールで変換を作成し続けます。",
     "xpack.transform.stepDefineForm.sortHelpText": "最新のドキュメントを特定するために使用する日付フィールドを選択してます。",
@@ -22373,10 +22356,8 @@
     "xpack.uiActionsEnhanced.drilldowns.components.DrilldownHelloBar.helpText": "ドリルダウンにより、パネルと連携する新しい動作を定義できます。複数のアクションを追加し、デフォルトフィルターを無効化できます。",
     "xpack.uiActionsEnhanced.drilldowns.components.DrilldownHelloBar.hideHelpButtonLabel": "非表示",
     "xpack.uiActionsEnhanced.drilldowns.components.DrilldownHelloBar.viewDocsLinkLabel": "ドキュメントを表示",
-    "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.createDrilldownButtonLabel": "ドリルダウンを作成",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.createDrilldownTitle": "ドリルダウンを作成",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.deleteDrilldownButtonLabel": "ドリルダウンを削除",
-    "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.editDrilldownButtonLabel": "保存",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.editDrilldownTitle": "ドリルダウンを編集",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.insufficientLicenseLevelError": "不十分なライセンスレベル",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.invalidDrilldownType": "ドリルダウンタイプ{type}が存在しません",
@@ -22391,15 +22372,6 @@
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.toast.drilldownsDeletedTitle": "{n}個のドリルダウンが削除されました",
     "xpack.uiActionsEnhanced.drilldowns.components.FlyoutFrame.BackButtonLabel": "戻る",
     "xpack.uiActionsEnhanced.drilldowns.components.FlyoutFrame.CloseButtonLabel": "閉じる",
-    "xpack.uiActionsEnhanced.drilldowns.components.FlyoutListManageDrilldowns.manageDrilldownsTitle": "ドリルダウンを管理",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.drilldownAction": "アクション",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.nameOfDrilldown": "名前",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.untitledDrilldown": "無題のドリルダウン",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormDrilldownWizard.getMoreActionsLinkLabel": "さらにアクションを表示",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.createDrilldownButtonLabel": "新規作成",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.deleteDrilldownsButtonLabel": "削除 ({count}) ",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.editDrilldownButtonLabel": "編集",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.selectThisDrilldownCheckboxLabel": "このドリルダウンを選択",
     "xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.additionalOptions": "その他のオプション",
     "xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.addVariableButtonTitle": "変数を追加",
     "xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.encodeDescription": "有効な場合、URLはパーセントエンコーディングを使用してエスケープされます",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index bf97eab3613f9c..262c7dcd82560c 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -2828,7 +2828,6 @@
     "indexPatternManagement.editIndexPattern.scripted.table.nameHeader": "名称",
     "indexPatternManagement.editIndexPattern.scripted.table.scriptDescription": "字段的脚本",
     "indexPatternManagement.editIndexPattern.scripted.table.scriptHeader": "脚本",
-    "indexPatternManagement.editIndexPattern.scriptedHeader": "脚本字段",
     "indexPatternManagement.editIndexPattern.scriptedLabel": "可以在可视化中使用脚本字段，并在您的文档中显示它们。但是，您不能搜索脚本字段。",
     "indexPatternManagement.editIndexPattern.setDefaultAria": "设置为默认索引。",
     "indexPatternManagement.editIndexPattern.setDefaultTooltip": "设置为默认索引。",
@@ -2846,7 +2845,6 @@
     "indexPatternManagement.editIndexPattern.source.table.matchesHeader": "匹配",
     "indexPatternManagement.editIndexPattern.source.table.notMatchedLabel": "源筛选不匹配任何已知字段。",
     "indexPatternManagement.editIndexPattern.source.table.saveAria": "保存",
-    "indexPatternManagement.editIndexPattern.sourceHeader": "字段筛选",
     "indexPatternManagement.editIndexPattern.sourceLabel": "字段筛选可用于在提取文档时排除一个或多个字段。在 Discover 应用中查看文档时会使用字段筛选，表在 Dashboard 应用中显示已保存搜索的结果时也会使用字段筛选。如果您的文档含有较大或不重要的字段，则通过在此较低层级筛除这些字段可能会更好。",
     "indexPatternManagement.editIndexPattern.sourcePlaceholder": "字段筛选，接受通配符 (例如“user*”用于筛选以“user”开头的字段) ",
     "indexPatternManagement.editIndexPattern.tabs.fieldsHeader": "字段",
@@ -2924,8 +2922,6 @@
     "indexPatternManagement.testScript.resultsTitle": "预览结果",
     "indexPatternManagement.testScript.submitButtonLabel": "运行脚本",
     "indexPatternManagement.typeLabel": "类型",
-    "indexPatternManagement.warningCallOut.descriptionLabel": "脚本字段可用于显示并聚合计算值。因此，它们会很慢，如果操作不当，会导致 Kibana 不可用。此处没有安全网。如果拼写错误，则在任何地方都会引发异常！",
-    "indexPatternManagement.warningCallOutHeader": "谨慎操作",
     "indexPatternManagement.warningCallOutLabel.callOutDetail": "请先熟悉{scripFields}以及{scriptsInAggregation}，然后再使用脚本字段。",
     "indexPatternManagement.warningCallOutLabel.scripFieldsLink": "脚本字段",
     "indexPatternManagement.warningCallOutLabel.scriptsInAggregationLink": "聚合中的脚本",
@@ -8323,7 +8319,6 @@
     "xpack.fleet.agentList.policyColumnTitle": "代理策略",
     "xpack.fleet.agentList.policyFilterText": "代理策略",
     "xpack.fleet.agentList.reassignActionText": "分配到新策略",
-    "xpack.fleet.agentList.revisionNumber": "修订版 {revNumber}",
     "xpack.fleet.agentList.showUpgradeableFilterLabel": "升级可用",
     "xpack.fleet.agentList.statusColumnTitle": "状态",
     "xpack.fleet.agentList.statusFilterText": "状态",
@@ -8751,7 +8746,7 @@
     "xpack.fleet.policyForm.generalSettingsGroupDescription": "为您的代理策略选择名称和描述。",
     "xpack.fleet.policyForm.generalSettingsGroupTitle": "常规设置",
     "xpack.fleet.policyForm.unableToDeleteDefaultPolicyText": "默认策略无法删除",
-    "xpack.fleet.policyNameLink.revisionNumber": "修订版 {revNumber}",
+    "xpack.fleet.agentPolicySummaryLine.revisionNumber": "修订版 {revNumber}",
     "xpack.fleet.securityRequiredErrorMessage": "必须在 Kibana 和 Elasticsearch 启用安全性，才能使用 Fleet。",
     "xpack.fleet.securityRequiredErrorTitle": "安全性未启用",
     "xpack.fleet.settings.additionalYamlConfig": "Elasticsearch 输出配置",
@@ -11249,7 +11244,6 @@
     "xpack.infra.sourceConfiguration.hostNameFieldDescription": "用于标识主机的字段",
     "xpack.infra.sourceConfiguration.hostNameFieldLabel": "主机名",
     "xpack.infra.sourceConfiguration.indicesSectionTitle": "索引",
-    "xpack.infra.sourceConfiguration.logColumnListEmptyErrorMessage": "日志列列表不得为空。",
     "xpack.infra.sourceConfiguration.logColumnsSectionTitle": "日志列",
     "xpack.infra.sourceConfiguration.logIndicesDescription": "用于匹配包含日志数据的索引的索引模式",
     "xpack.infra.sourceConfiguration.logIndicesLabel": "日志索引",
@@ -12629,8 +12623,6 @@
     "xpack.maps.layerControl.closeLayerTOCButtonAriaLabel": "折叠图层面板",
     "xpack.maps.layerControl.layersTitle": "图层",
     "xpack.maps.layerControl.openLayerTOCButtonAriaLabel": "展开图层面板",
-    "xpack.maps.layerControl.tocEntry.editButtonAriaLabel": "编辑图层",
-    "xpack.maps.layerControl.tocEntry.editButtonTitle": "编辑图层",
     "xpack.maps.layerControl.tocEntry.grabButtonAriaLabel": "重新排序图层",
     "xpack.maps.layerControl.tocEntry.grabButtonTitle": "重新排序图层",
     "xpack.maps.layerControl.tocEntry.hideDetailsButtonAriaLabel": "隐藏图层详情",
@@ -12689,7 +12681,6 @@
     "xpack.maps.layerPanel.whereExpression.helpText": "使用查询缩小右源范围。",
     "xpack.maps.layerPanel.whereExpression.queryBarSubmitButtonLabel": "设置筛选",
     "xpack.maps.layerTocActions.cloneLayerTitle": "克隆图层",
-    "xpack.maps.layerTocActions.editLayerTitle": "编辑图层",
     "xpack.maps.layerTocActions.fitToDataTitle": "适应数据",
     "xpack.maps.layerTocActions.hideLayerTitle": "隐藏图层",
     "xpack.maps.layerTocActions.layerActionsTitle": "图层操作",
@@ -18448,8 +18439,6 @@
     "xpack.securitySolution.containers.detectionEngine.createPrePackagedTimelineSuccesDescription": "安装 Elastic 预先打包的时间线模板",
     "xpack.securitySolution.containers.detectionEngine.rulesAndTimelines": "无法提取规则和时间线",
     "xpack.securitySolution.containers.detectionEngine.tagFetchFailDescription": "无法提取标签",
-    "xpack.securitySolution.containers.errors.dataFetchFailureTitle": "数据提取失败",
-    "xpack.securitySolution.containers.errors.networkFailureTitle": "网络故障",
     "xpack.securitySolution.containers.errors.stopJobFailureTitle": "停止作业失败",
     "xpack.securitySolution.customizeEventRenderers.customizeEventRenderersDescription": "事件呈现器自动在事件中传送最相关的详情，以揭示其故事",
     "xpack.securitySolution.customizeEventRenderers.customizeEventRenderersTitle": "定制事件呈现器",
@@ -21949,7 +21938,6 @@
     "xpack.transform.groupByLabelForm.editIntervalAriaLabel": "编辑时间间隔",
     "xpack.transform.home.breadcrumbTitle": "转换",
     "xpack.transform.indexPreview.copyClipboardTooltip": "将索引预览的开发控制台语句复制到剪贴板。",
-    "xpack.transform.indexPreview.copyRuntimeMappingsClipboardTooltip": "将运行时映射的开发控制台语句复制到剪贴板。",
     "xpack.transform.latestPreview.latestPreviewIncompleteConfigCalloutBody": "请选择至少一个唯一键和排序字段。",
     "xpack.transform.licenseCheckErrorMessage": "许可证检查失败",
     "xpack.transform.list.emptyPromptButtonText": "创建您的首个转换",
@@ -22010,14 +21998,12 @@
     "xpack.transform.stepDefineForm.advancedEditorHelpText": "高级编辑器允许您编辑数据帧转换的数据透视表配置。",
     "xpack.transform.stepDefineForm.advancedEditorHelpTextLink": "详细了解可用选项。",
     "xpack.transform.stepDefineForm.advancedEditorLabel": "数据透视表配置对象",
-    "xpack.transform.stepDefineForm.advancedEditorRuntimeMappingsSwitchLabel": "编辑运行时映射",
     "xpack.transform.stepDefineForm.advancedEditorSourceConfigSwitchLabel": "编辑 JSON 查询",
     "xpack.transform.stepDefineForm.advancedEditorSwitchLabel": "编辑 JSON 配置",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalBodyText": "高级编辑器中的更改尚未应用。禁用高级编辑器将会使您的编辑丢失。",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalCancelButtonText": "取消",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalConfirmButtonText": "禁用高级编辑器",
     "xpack.transform.stepDefineForm.advancedEditorSwitchModalTitle": "未应用的更改",
-    "xpack.transform.stepDefineForm.advancedRuntimeMappingsEditorHelpText": "高级编辑器允许您编辑转换配置的运行时映射。",
     "xpack.transform.stepDefineForm.advancedSourceEditorApplyButtonText": "应用更改",
     "xpack.transform.stepDefineForm.advancedSourceEditorAriaLabel": "高级查询编辑器",
     "xpack.transform.stepDefineForm.advancedSourceEditorHelpText": "高级编辑器允许您编辑转换配置的源查询子句。",
@@ -22043,8 +22029,6 @@
     "xpack.transform.stepDefineForm.pivotLabel": "数据透视表",
     "xpack.transform.stepDefineForm.queryPlaceholderKql": "例如，{example}",
     "xpack.transform.stepDefineForm.queryPlaceholderLucene": "例如，{example}",
-    "xpack.transform.stepDefineForm.runtimeMappingsLabel": "运行时映射",
-    "xpack.transform.stepDefineForm.runtimeMappingsListLabel": "{runtimeFields}",
     "xpack.transform.stepDefineForm.savedSearchLabel": "已保存搜索",
     "xpack.transform.stepDefineForm.sortFieldOptionsEmptyError": "没有日期字段可用于排序。要使用其他字段类型，请将配置复制到剪贴板，然后继续在控制台中创建转换。",
     "xpack.transform.stepDefineForm.sortHelpText": "选择要用于标识最新文档的日期字段。",
@@ -22728,10 +22712,8 @@
     "xpack.uiActionsEnhanced.drilldowns.components.DrilldownHelloBar.helpText": "向下钻取允许您定义与面板交互的新行为。您可以添加多个操作并覆盖默认筛选。",
     "xpack.uiActionsEnhanced.drilldowns.components.DrilldownHelloBar.hideHelpButtonLabel": "隐藏",
     "xpack.uiActionsEnhanced.drilldowns.components.DrilldownHelloBar.viewDocsLinkLabel": "查看文档",
-    "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.createDrilldownButtonLabel": "创建向下钻取",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.createDrilldownTitle": "创建向下钻取",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.deleteDrilldownButtonLabel": "删除向下钻取",
-    "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.editDrilldownButtonLabel": "保存",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.editDrilldownTitle": "编辑向下钻取",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.insufficientLicenseLevelError": "许可证级别不够",
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.invalidDrilldownType": "向下钻取类型 {type} 不存在",
@@ -22746,15 +22728,6 @@
     "xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.toast.drilldownsDeletedTitle": "{n} 个向下钻取已删除",
     "xpack.uiActionsEnhanced.drilldowns.components.FlyoutFrame.BackButtonLabel": "返回",
     "xpack.uiActionsEnhanced.drilldowns.components.FlyoutFrame.CloseButtonLabel": "关闭",
-    "xpack.uiActionsEnhanced.drilldowns.components.FlyoutListManageDrilldowns.manageDrilldownsTitle": "管理向下钻取",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.drilldownAction": "操作",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.nameOfDrilldown": "名称",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.untitledDrilldown": "未命名向下钻取",
-    "xpack.uiActionsEnhanced.drilldowns.components.FormDrilldownWizard.getMoreActionsLinkLabel": "获取更多的操作",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.createDrilldownButtonLabel": "新建",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.deleteDrilldownsButtonLabel": "删除 ({count})",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.editDrilldownButtonLabel": "编辑",
-    "xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.selectThisDrilldownCheckboxLabel": "选择此向下钻取",
     "xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.additionalOptions": "其他选项",
     "xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.addVariableButtonTitle": "添加变量",
     "xpack.uiActionsEnhanced.drilldowns.urlDrilldownCollectConfig.encodeDescription": "如果启用，将使用百分比编码转义 URL",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx
index 3d71d5404da2b5..0e1c27c1e67688 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx
@@ -37,7 +37,7 @@ describe('home', () => {
     const documentationLink = wrapper.find('[data-test-subj="documentationLink"]');
     expect(documentationLink.exists()).toBeTruthy();
     expect(documentationLink.first().prop('href')).toEqual(
-      'https://www.elastic.co/guide/en/kibana/mocked-test-branch/managing-alerts-and-actions.html'
+      'https://www.elastic.co/guide/en/kibana/mocked-test-branch/alert-management.html'
     );
   });
 });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_factory_picker/action_factory_picker.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_factory_picker/action_factory_picker.tsx
new file mode 100644
index 00000000000000..dcf99d40017972
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_factory_picker/action_factory_picker.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { ActionFactory, BaseActionFactoryContext } from '../../dynamic_actions';
+import { PresentablePicker, Item } from '../presentable_picker';
+
+export interface ActionFactoryPickerProps {
+  actionFactories: ActionFactory[];
+  context: unknown;
+  onSelect: (actionFactory: ActionFactory) => void;
+}
+
+export const ActionFactoryPicker: React.FC<ActionFactoryPickerProps> = ({
+  actionFactories,
+  context,
+  onSelect,
+}) => {
+  const items = React.useMemo(() => {
+    return actionFactories.map((actionFactory) => {
+      const item: Item = {
+        id: actionFactory.id,
+        order: actionFactory.order,
+        getDisplayName: (ctx: unknown) =>
+          actionFactory.getDisplayName(ctx as BaseActionFactoryContext),
+        getIconType: (ctx: unknown) => actionFactory.getIconType(ctx as BaseActionFactoryContext),
+        getDisplayNameTooltip: () => '',
+        isCompatible: (ctx: unknown) => actionFactory.isCompatible(ctx as BaseActionFactoryContext),
+        MenuItem: actionFactory.MenuItem,
+        isBeta: actionFactory.isBeta,
+        isLicenseCompatible: actionFactory.isCompatibleLicense(),
+      };
+      return item;
+    });
+  }, [actionFactories]);
+
+  const handleSelect = React.useCallback(
+    (id: string) => {
+      if (!onSelect) return;
+      const actionFactory = actionFactories.find((af) => af.id === id);
+      if (!actionFactory) return;
+      onSelect(actionFactory);
+    },
+    [onSelect, actionFactories]
+  );
+
+  return <PresentablePicker items={items} context={context} onSelect={handleSelect} />;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/index.ts b/x-pack/plugins/ui_actions_enhanced/public/components/action_factory_picker/index.ts
similarity index 85%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/index.ts
rename to x-pack/plugins/ui_actions_enhanced/public/components/action_factory_picker/index.ts
index 8c6527e90c709b..3d7ffed3018595 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_factory_picker/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export * from './flyout_drilldown_wizard';
+export * from './action_factory_picker';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
index 1caef68b7e5e87..049adbd09e84ec 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/action_wizard/action_wizard.tsx
@@ -99,23 +99,29 @@ export const ActionWizard: React.FC<ActionWizardProps> = ({
   triggerPickerDocsLink,
 }) => {
   // auto pick action factory if there is only 1 available
-  if (
-    !currentActionFactory &&
-    actionFactories.length === 1 &&
-    actionFactories[0].isCompatibleLicense()
-  ) {
-    onActionFactoryChange(actionFactories[0]);
-  }
+  React.useEffect(() => {
+    if (
+      !currentActionFactory &&
+      actionFactories.length === 1 &&
+      actionFactories[0].isCompatibleLicense()
+    ) {
+      onActionFactoryChange(actionFactories[0]);
+    }
+  }, [currentActionFactory, actionFactories, actionFactories.length, onActionFactoryChange]);
 
   // auto pick selected trigger if none is picked
-  if (currentActionFactory && !((context.triggers?.length ?? 0) > 0)) {
-    const actionTriggers = getTriggersForActionFactory(currentActionFactory, triggers);
-    if (actionTriggers.length > 0) {
-      onSelectedTriggersChange([actionTriggers[0]]);
+  React.useEffect(() => {
+    if (currentActionFactory && !((context.triggers?.length ?? 0) > 0)) {
+      const actionTriggers = getTriggersForActionFactory(currentActionFactory, triggers);
+      if (actionTriggers.length > 0) {
+        onSelectedTriggersChange([actionTriggers[0]]);
+      }
     }
-  }
+  }, [currentActionFactory, triggers, context.triggers?.length, onSelectedTriggersChange]);
+
+  if (currentActionFactory) {
+    if (!config) return null;
 
-  if (currentActionFactory && config) {
     const allTriggers = getTriggersForActionFactory(currentActionFactory, triggers);
     return (
       <SelectedActionFactory
@@ -141,9 +147,7 @@ export const ActionWizard: React.FC<ActionWizardProps> = ({
     <ActionFactorySelector
       context={context}
       actionFactories={actionFactories}
-      onActionFactorySelected={(actionFactory) => {
-        onActionFactoryChange(actionFactory);
-      }}
+      onActionFactorySelected={onActionFactoryChange}
     />
   );
 };
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/i18n.ts
new file mode 100644
index 00000000000000..36ca55901950fb
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/i18n.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const txtBetaActionFactoryLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.betaActionLabel',
+  {
+    defaultMessage: `Beta`,
+  }
+);
+
+export const txtBetaActionFactoryTooltip = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.betaActionTooltip',
+  {
+    defaultMessage: `This action is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Please help us by reporting any bugs or providing other feedback.`,
+  }
+);
+
+export const txtInsufficientLicenseLevel = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.insufficientLicenseLevelTooltip',
+  {
+    defaultMessage: 'Insufficient license level',
+  }
+);
diff --git a/x-pack/plugins/security_solution/common/graphql/root/index.ts b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/index.ts
similarity index 85%
rename from x-pack/plugins/security_solution/common/graphql/root/index.ts
rename to x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/index.ts
index 194a6bc1a12c9c..0259ac6556e64c 100644
--- a/x-pack/plugins/security_solution/common/graphql/root/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { rootSchema } from './schema.gql';
+export * from './presentable_picker';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.stories.tsx
new file mode 100644
index 00000000000000..521d16ad579c14
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.stories.tsx
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { storiesOf } from '@storybook/react';
+import { action } from '@storybook/addon-actions';
+import { PresentablePicker } from './presentable_picker';
+
+storiesOf('components/PresentablePicker', module)
+  .add('One item', () => (
+    <PresentablePicker
+      items={[
+        {
+          id: 'URL',
+          getDisplayName: () => 'Go to URL',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 10,
+          isCompatible: async (context?: object) => true,
+        },
+      ]}
+      context={{}}
+      onSelect={action('onSelect')}
+    />
+  ))
+  .add('Items are sorted', () => (
+    <PresentablePicker
+      items={[
+        {
+          id: 'item2',
+          getDisplayName: () => 'Item 2',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 1,
+          isCompatible: async (context?: object) => true,
+        },
+        {
+          id: 'item1',
+          getDisplayName: () => 'Item 1',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 2,
+          isCompatible: async (context?: object) => true,
+        },
+      ]}
+      context={{}}
+      onSelect={action('onSelect')}
+    />
+  ))
+  .add('Items are sorted - 2', () => (
+    <PresentablePicker
+      items={[
+        {
+          id: 'item1',
+          getDisplayName: () => 'Item 1',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 2,
+          isCompatible: async (context?: object) => true,
+        },
+        {
+          id: 'item2',
+          getDisplayName: () => 'Item 2',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 1,
+          isCompatible: async (context?: object) => true,
+        },
+      ]}
+      context={{}}
+      onSelect={action('onSelect')}
+    />
+  ))
+  .add('Two items', () => (
+    <PresentablePicker
+      items={[
+        {
+          id: 'URL',
+          getDisplayName: () => 'Go to URL',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 2,
+          isCompatible: async (context?: object) => true,
+        },
+        {
+          id: 'DASHBOARD',
+          getDisplayName: () => 'Go to Dashboard',
+          getIconType: () => 'dashboardApp',
+          getDisplayNameTooltip: () => '',
+          order: 1,
+          isCompatible: async (context?: object) => true,
+        },
+      ]}
+      context={{}}
+      onSelect={action('onSelect')}
+    />
+  ))
+  .add('Beta badge', () => (
+    <PresentablePicker
+      items={[
+        {
+          id: 'URL',
+          getDisplayName: () => 'Go to URL',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 2,
+          isCompatible: async (context?: object) => true,
+          isBeta: true,
+        },
+        {
+          id: 'DASHBOARD',
+          getDisplayName: () => 'Go to Dashboard',
+          getIconType: () => 'dashboardApp',
+          getDisplayNameTooltip: () => '',
+          order: 1,
+          isCompatible: async (context?: object) => true,
+        },
+      ]}
+      context={{}}
+      onSelect={action('onSelect')}
+    />
+  ))
+  .add('Incompatible license', () => (
+    <PresentablePicker
+      items={[
+        {
+          id: 'URL',
+          getDisplayName: () => 'Go to URL',
+          getIconType: () => 'link',
+          getDisplayNameTooltip: () => '',
+          order: 2,
+          isCompatible: async (context?: object) => true,
+          isBeta: true,
+          isLicenseCompatible: false,
+        },
+        {
+          id: 'DASHBOARD',
+          getDisplayName: () => 'Go to Dashboard',
+          getIconType: () => 'dashboardApp',
+          getDisplayNameTooltip: () => '',
+          order: 1,
+          isCompatible: async (context?: object) => true,
+        },
+      ]}
+      context={{}}
+      onSelect={action('onSelect')}
+    />
+  ));
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx
new file mode 100644
index 00000000000000..72f9e5aa0bd4ab
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiFlexGroup } from '@elastic/eui';
+import { PresentablePickerItem, Item } from './presentable_picker_item';
+
+export { Item } from './presentable_picker_item';
+
+export interface PresentablePickerProps {
+  items: Item[];
+  context: unknown;
+  onSelect: (itemId: string) => void;
+}
+
+export const TEST_SUBJ_ACTION_FACTORY_ITEM = 'actionFactoryItem';
+
+// The below style is applied to fix Firefox rendering bug.
+// See: https://github.com/elastic/kibana/pull/61219/#pullrequestreview-402903330
+const firefoxBugFix = {
+  willChange: 'opacity',
+};
+
+const sort = (f1: Item, f2: Item): number => f2.order - f1.order;
+
+export const PresentablePicker: React.FC<PresentablePickerProps> = ({
+  items,
+  context,
+  onSelect,
+}) => {
+  /**
+   * Make sure items with incompatible license are at the end.
+   */
+  const itemsSorted = React.useMemo(() => {
+    const compatible = items.filter((f) => f.isLicenseCompatible ?? true);
+    const incompatible = items.filter((f) => !(f.isLicenseCompatible ?? true));
+    return [...compatible.sort(sort), ...incompatible.sort(sort)];
+  }, [items]);
+
+  if (items.length === 0) {
+    // This is not user facing, as it would be impossible to get into this state
+    // just leaving for dev purposes for troubleshooting.
+    return <div>No action factories to pick from.</div>;
+  }
+
+  return (
+    <EuiFlexGroup gutterSize="m" responsive={false} wrap={true} style={firefoxBugFix}>
+      {itemsSorted.map((item) => (
+        <PresentablePickerItem key={item.id} item={item} context={context} onSelect={onSelect} />
+      ))}
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker_item.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker_item.tsx
new file mode 100644
index 00000000000000..7d9232dc793ef0
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker_item.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiFlexItem, EuiIcon, EuiKeyPadMenuItem, EuiToolTip } from '@elastic/eui';
+import {
+  txtBetaActionFactoryLabel,
+  txtBetaActionFactoryTooltip,
+  txtInsufficientLicenseLevel,
+} from './i18n';
+import { UiActionsPresentable as Presentable } from '../../../../../../src/plugins/ui_actions/public';
+
+import './styles.scss';
+
+export interface Item extends Presentable {
+  isLicenseCompatible?: boolean;
+  isBeta?: boolean;
+}
+
+export interface PresentablePickerItemProps {
+  item: Item;
+  context: unknown;
+  onSelect: (itemId: string) => void;
+}
+
+export const TEST_SUBJ_PRESENTABLE_ITEM = 'actionFactoryItem';
+
+export const PresentablePickerItem: React.FC<PresentablePickerItemProps> = ({
+  item,
+  context,
+  onSelect,
+}) => {
+  const isLicenseCompatible = item.isLicenseCompatible ?? true;
+  const showTooltip = !isLicenseCompatible;
+
+  let content = (
+    <EuiKeyPadMenuItem
+      className="auaPresentablePicker__item"
+      label={item.getDisplayName(context)}
+      data-test-subj={`${TEST_SUBJ_PRESENTABLE_ITEM}-${item.id}`}
+      onClick={() => onSelect(item.id)}
+      disabled={!isLicenseCompatible}
+      betaBadgeLabel={item.isBeta ? txtBetaActionFactoryLabel : undefined}
+      betaBadgeTooltipContent={item.isBeta ? txtBetaActionFactoryTooltip : undefined}
+    >
+      {item.getIconType(context) && <EuiIcon type={item.getIconType(context)!} size="m" />}
+    </EuiKeyPadMenuItem>
+  );
+
+  if (showTooltip) {
+    content = <EuiToolTip content={txtInsufficientLicenseLevel}>{content}</EuiToolTip>;
+  }
+
+  return (
+    <EuiFlexItem grow={false} key={item.id}>
+      {content}
+    </EuiFlexItem>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/styles.scss b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/styles.scss
new file mode 100644
index 00000000000000..01f05ffd535767
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/styles.scss
@@ -0,0 +1,5 @@
+.auaPresentablePicker__item {
+  .euiKeyPadMenuItem__label {
+    height: #{$euiSizeXL};
+  }
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.stories.tsx
deleted file mode 100644
index 4249e108e5f5b4..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.stories.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as React from 'react';
-import { EuiFlyout } from '@elastic/eui';
-import { storiesOf } from '@storybook/react';
-import { StubBrowserStorage } from '@kbn/test/jest';
-import { createFlyoutManageDrilldowns } from './connected_flyout_manage_drilldowns';
-import { mockActionFactories } from '../../../components/action_wizard/test_data';
-import { Storage } from '../../../../../../../src/plugins/kibana_utils/public';
-import { mockDynamicActionManager } from './test_data';
-
-const FlyoutManageDrilldowns = createFlyoutManageDrilldowns({
-  actionFactories: mockActionFactories,
-  storage: new Storage(new StubBrowserStorage()),
-  toastService: {
-    addError: (...args: any[]) => {
-      alert(JSON.stringify(args));
-    },
-    addSuccess: (...args: any[]) => {
-      alert(JSON.stringify(args));
-    },
-  } as any,
-  getTrigger: (triggerId) => ({
-    id: triggerId,
-  }),
-});
-
-storiesOf('components/FlyoutManageDrilldowns', module)
-  .add('default (3 triggers)', () => (
-    <EuiFlyout onClose={() => {}}>
-      <FlyoutManageDrilldowns
-        dynamicActionManager={mockDynamicActionManager}
-        triggers={['VALUE_CLICK_TRIGGER', 'SELECT_RANGE_TRIGGER', 'FILTER_TRIGGER']}
-      />
-    </EuiFlyout>
-  ))
-  .add('Only filter is supported', () => (
-    <EuiFlyout onClose={() => {}}>
-      <FlyoutManageDrilldowns
-        dynamicActionManager={mockDynamicActionManager}
-        triggers={['FILTER_TRIGGER']}
-      />
-    </EuiFlyout>
-  ));
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.test.tsx
deleted file mode 100644
index 12e9b86117a115..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.test.tsx
+++ /dev/null
@@ -1,324 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { fireEvent, render, waitFor, cleanup } from '@testing-library/react';
-import { createFlyoutManageDrilldowns } from './connected_flyout_manage_drilldowns';
-import {
-  mockGetTriggerInfo,
-  mockSupportedTriggers,
-  mockActionFactories,
-} from '../../../components/action_wizard/test_data';
-import { StubBrowserStorage } from '@kbn/test/jest';
-import { Storage } from '../../../../../../../src/plugins/kibana_utils/public';
-import { mockDynamicActionManager } from './test_data';
-import { TEST_SUBJ_DRILLDOWN_ITEM } from '../list_manage_drilldowns';
-import { WELCOME_MESSAGE_TEST_SUBJ } from '../drilldown_hello_bar';
-import { coreMock } from '../../../../../../../src/core/public/mocks';
-import { NotificationsStart } from 'kibana/public';
-import { toastDrilldownsCRUDError } from '../../hooks/i18n';
-
-jest.mock('@elastic/eui/lib/services/accessibility/html_id_generator', () => ({
-  htmlIdGenerator: () => () => `id-${Math.random()}`,
-}));
-
-const storage = new Storage(new StubBrowserStorage());
-const toasts = coreMock.createStart().notifications.toasts;
-const FlyoutManageDrilldowns = createFlyoutManageDrilldowns({
-  actionFactories: mockActionFactories,
-  storage: new Storage(new StubBrowserStorage()),
-  toastService: toasts,
-  getTrigger: mockGetTriggerInfo,
-});
-
-beforeEach(() => {
-  storage.clear();
-  mockDynamicActionManager.state.set({ ...mockDynamicActionManager.state.get(), events: [] });
-  (toasts as jest.Mocked<NotificationsStart['toasts']>).addSuccess.mockClear();
-  (toasts as jest.Mocked<NotificationsStart['toasts']>).addError.mockClear();
-});
-
-test('Allows to manage drilldowns', async () => {
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={mockSupportedTriggers}
-    />
-  );
-
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible());
-
-  // no drilldowns in the list
-  expect(screen.queryAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM)).toHaveLength(0);
-
-  fireEvent.click(screen.getByText(/Create new/i));
-
-  let [createHeading] = screen.getAllByText(/Create Drilldown/i);
-  let createButton = screen.getByRole('button', { name: /Create Drilldown/i });
-  expect(createHeading).toBeVisible();
-  expect(screen.getByLabelText(/Back/i)).toBeVisible();
-
-  expect(createButton).toBeDisabled();
-
-  // input drilldown name
-  const name = 'Test name';
-  fireEvent.change(screen.getByLabelText(/name/i), {
-    target: { value: name },
-  });
-
-  // select URL one
-  fireEvent.click(screen.getByText(/Go to URL/i));
-
-  // Input url
-  const URL = 'https://elastic.co';
-  fireEvent.change(screen.getByLabelText(/url/i), {
-    target: { value: URL },
-  });
-
-  [createHeading] = screen.getAllByText(/Create Drilldown/i);
-  createButton = screen.getByRole('button', { name: /Create Drilldown/i });
-
-  expect(createButton).toBeEnabled();
-  fireEvent.click(createButton);
-
-  expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible();
-
-  await waitFor(() => expect(screen.queryAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM)).toHaveLength(1));
-  expect(screen.getByText(name)).toBeVisible();
-  const editButton = screen.getByText(/edit/i);
-  fireEvent.click(editButton);
-
-  expect(screen.getByText(/Edit Drilldown/i)).toBeVisible();
-  // check that wizard is prefilled with current drilldown values
-  expect(screen.getByLabelText(/name/i)).toHaveValue(name);
-  expect(screen.getByLabelText(/url/i)).toHaveValue(URL);
-
-  // input new drilldown name
-  const newName = 'New drilldown name';
-  fireEvent.change(screen.getByLabelText(/name/i), {
-    target: { value: newName },
-  });
-  fireEvent.click(screen.getByText(/save/i));
-
-  expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible();
-  await waitFor(() => screen.getByText(newName));
-
-  // delete drilldown from edit view
-  fireEvent.click(screen.getByText(/edit/i));
-  fireEvent.click(screen.getByText(/delete/i));
-
-  expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible();
-  await waitFor(() => expect(screen.queryAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM)).toHaveLength(0));
-});
-
-test('Can delete multiple drilldowns', async () => {
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={mockSupportedTriggers}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible());
-
-  const createDrilldown = async () => {
-    const oldCount = screen.queryAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM).length;
-    fireEvent.click(screen.getByText(/Create new/i));
-    fireEvent.change(screen.getByLabelText(/name/i), {
-      target: { value: 'test' },
-    });
-    fireEvent.click(screen.getByText(/Go to URL/i));
-    fireEvent.change(screen.getByLabelText(/url/i), {
-      target: { value: 'https://elastic.co' },
-    });
-    fireEvent.click(screen.getAllByText(/Create Drilldown/i)[1]);
-    await waitFor(() =>
-      expect(screen.queryAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM)).toHaveLength(oldCount + 1)
-    );
-  };
-
-  await createDrilldown();
-  await createDrilldown();
-  await createDrilldown();
-
-  const checkboxes = screen.getAllByLabelText(/Select this drilldown/i);
-  expect(checkboxes).toHaveLength(3);
-  checkboxes.forEach((checkbox) => fireEvent.click(checkbox));
-  expect(screen.queryByText(/Create/i)).not.toBeInTheDocument();
-  fireEvent.click(screen.getByText(/Delete \(3\)/i));
-
-  await waitFor(() => expect(screen.queryAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM)).toHaveLength(0));
-});
-
-test('Create only mode', async () => {
-  const onClose = jest.fn();
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      viewMode={'create'}
-      onClose={onClose}
-      triggers={mockSupportedTriggers}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getAllByText(/Create/i).length).toBeGreaterThan(0));
-  fireEvent.change(screen.getByLabelText(/name/i), {
-    target: { value: 'test' },
-  });
-  fireEvent.click(screen.getByText(/Go to URL/i));
-  fireEvent.change(screen.getByLabelText(/url/i), {
-    target: { value: 'https://elastic.co' },
-  });
-  fireEvent.click(screen.getAllByText(/Create Drilldown/i)[1]);
-
-  await waitFor(() => expect(toasts.addSuccess).toBeCalled());
-  expect(onClose).toBeCalled();
-  expect(await mockDynamicActionManager.state.get().events.length).toBe(1);
-});
-
-test('After switching between action factories state is restored', async () => {
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      viewMode={'create'}
-      triggers={mockSupportedTriggers}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getAllByText(/Create/i).length).toBeGreaterThan(0));
-  fireEvent.change(screen.getByLabelText(/name/i), {
-    target: { value: 'test' },
-  });
-  fireEvent.click(screen.getByText(/Go to URL/i));
-  fireEvent.change(screen.getByLabelText(/url/i), {
-    target: { value: 'https://elastic.co' },
-  });
-
-  // change to dashboard
-  fireEvent.click(screen.getByText(/change/i));
-  fireEvent.click(screen.getByText(/Go to Dashboard/i));
-
-  // change back to url
-  fireEvent.click(screen.getByText(/change/i));
-  fireEvent.click(screen.getByText(/Go to URL/i));
-
-  expect(screen.getByLabelText(/url/i)).toHaveValue('https://elastic.co');
-  expect(screen.getByLabelText(/name/i)).toHaveValue('test');
-
-  fireEvent.click(screen.getAllByText(/Create Drilldown/i)[1]);
-  await waitFor(() => expect(toasts.addSuccess).toBeCalled());
-  expect(await (mockDynamicActionManager.state.get().events[0].action.config as any).url).toBe(
-    'https://elastic.co'
-  );
-});
-
-test.todo("Error when can't fetch drilldown list");
-
-test("Error when can't save drilldown changes", async () => {
-  const error = new Error('Oops');
-  jest.spyOn(mockDynamicActionManager, 'createEvent').mockImplementationOnce(async () => {
-    throw error;
-  });
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={mockSupportedTriggers}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible());
-  fireEvent.click(screen.getByText(/Create new/i));
-  fireEvent.change(screen.getByLabelText(/name/i), {
-    target: { value: 'test' },
-  });
-  fireEvent.click(screen.getByText(/Go to URL/i));
-  fireEvent.change(screen.getByLabelText(/url/i), {
-    target: { value: 'https://elastic.co' },
-  });
-  fireEvent.click(screen.getAllByText(/Create Drilldown/i)[1]);
-  await waitFor(() =>
-    expect(toasts.addError).toBeCalledWith(error, { title: toastDrilldownsCRUDError })
-  );
-});
-
-test('Should show drilldown welcome message. Should be able to dismiss it', async () => {
-  let screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={mockSupportedTriggers}
-    />
-  );
-
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible());
-
-  expect(screen.getByTestId(WELCOME_MESSAGE_TEST_SUBJ)).toBeVisible();
-  fireEvent.click(screen.getByText(/hide/i));
-  expect(screen.queryByTestId(WELCOME_MESSAGE_TEST_SUBJ)).toBeNull();
-  cleanup();
-
-  screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={mockSupportedTriggers}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getByText(/Manage Drilldowns/i)).toBeVisible());
-  expect(screen.queryByTestId(WELCOME_MESSAGE_TEST_SUBJ)).toBeNull();
-});
-
-test('Drilldown type is not shown if no supported trigger', async () => {
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={['VALUE_CLICK_TRIGGER']}
-      viewMode={'create'}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getAllByText(/Create/i).length).toBeGreaterThan(0));
-  expect(screen.queryByText(/Go to Dashboard/i)).not.toBeInTheDocument(); // dashboard action is not visible, because APPLY_FILTER_TRIGGER not supported
-  expect(screen.getByTestId('selectedActionFactory-Url')).toBeInTheDocument();
-});
-
-test('Can pick a trigger', async () => {
-  const screen = render(
-    <FlyoutManageDrilldowns
-      dynamicActionManager={mockDynamicActionManager}
-      triggers={mockSupportedTriggers}
-      viewMode={'create'}
-    />
-  );
-  // wait for initial render. It is async because resolving compatible action factories is async
-  await waitFor(() => expect(screen.getAllByText(/Create/i).length).toBeGreaterThan(0));
-
-  // input drilldown name
-  const name = 'Test name';
-  fireEvent.change(screen.getByLabelText(/name/i), {
-    target: { value: name },
-  });
-
-  // select URL one
-  fireEvent.click(screen.getByText(/Go to URL/i));
-
-  // Input url
-  const URL = 'https://elastic.co';
-  fireEvent.change(screen.getByLabelText(/url/i), {
-    target: { value: URL },
-  });
-
-  fireEvent.click(screen.getByTestId('triggerPicker-SELECT_RANGE_TRIGGER').querySelector('input')!);
-
-  const [, createButton] = screen.getAllByText(/Create Drilldown/i);
-
-  expect(createButton).toBeEnabled();
-  fireEvent.click(createButton);
-  await waitFor(() => expect(toasts.addSuccess).toBeCalled());
-  expect(mockDynamicActionManager.state.get().events[0].triggers).toEqual(['SELECT_RANGE_TRIGGER']);
-});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
deleted file mode 100644
index 9eed7cd428bdb5..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState, useMemo } from 'react';
-import { ToastsStart } from 'kibana/public';
-import { intersection } from 'lodash';
-import { DrilldownWizardConfig, FlyoutDrilldownWizard } from '../flyout_drilldown_wizard';
-import { FlyoutListManageDrilldowns } from '../flyout_list_manage_drilldowns';
-import { IStorageWrapper } from '../../../../../../../src/plugins/kibana_utils/public';
-import { Trigger } from '../../../../../../../src/plugins/ui_actions/public';
-import { DrilldownListItem } from '../list_manage_drilldowns';
-import { insufficientLicenseLevel, invalidDrilldownType } from './i18n';
-import {
-  ActionFactory,
-  BaseActionConfig,
-  BaseActionFactoryContext,
-  DynamicActionManager,
-  SerializedEvent,
-} from '../../../dynamic_actions';
-import { useWelcomeMessage } from '../../hooks/use_welcome_message';
-import { useCompatibleActionFactoriesForCurrentContext } from '../../hooks/use_compatible_action_factories_for_current_context';
-import { useDrilldownsStateManager } from '../../hooks/use_drilldown_state_manager';
-import { ActionFactoryPlaceContext } from '../types';
-
-interface ConnectedFlyoutManageDrilldownsProps<
-  ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
-> {
-  dynamicActionManager: DynamicActionManager;
-  viewMode?: 'create' | 'manage';
-  onClose?: () => void;
-
-  /**
-   * List of possible triggers in current context
-   */
-  triggers: string[];
-
-  /**
-   * Extra action factory context passed into action factories CollectConfig, getIconType, getDisplayName and etc...
-   */
-  placeContext?: ActionFactoryPlaceContext<ActionFactoryContext>;
-}
-
-/**
- * Represent current state (route) of FlyoutManageDrilldowns
- */
-enum Routes {
-  Manage = 'manage',
-  Create = 'create',
-  Edit = 'edit',
-}
-
-export function createFlyoutManageDrilldowns({
-  actionFactories: allActionFactories,
-  storage,
-  toastService,
-  docsLink,
-  triggerPickerDocsLink,
-  getTrigger,
-}: {
-  actionFactories: ActionFactory[];
-  getTrigger: (triggerId: string) => Trigger;
-  storage: IStorageWrapper;
-  toastService: ToastsStart;
-  docsLink?: string;
-  triggerPickerDocsLink?: string;
-}): React.FC<ConnectedFlyoutManageDrilldownsProps> {
-  const allActionFactoriesById = allActionFactories.reduce((acc, next) => {
-    acc[next.id] = next;
-    return acc;
-  }, {} as Record<string, ActionFactory>);
-
-  return (props: ConnectedFlyoutManageDrilldownsProps) => {
-    const isCreateOnly = props.viewMode === 'create';
-
-    const factoryContext: BaseActionFactoryContext = useMemo(
-      () => ({ ...props.placeContext, triggers: props.triggers }),
-      [props.placeContext, props.triggers]
-    );
-    const actionFactories = useCompatibleActionFactoriesForCurrentContext(
-      allActionFactories,
-      factoryContext
-    );
-
-    const [route, setRoute] = useState<Routes>(
-      () => (isCreateOnly ? Routes.Create : Routes.Manage) // initial state is different depending on `viewMode`
-    );
-    const [currentEditId, setCurrentEditId] = useState<string | null>(null);
-
-    const [shouldShowWelcomeMessage, onHideWelcomeMessage] = useWelcomeMessage(storage);
-
-    const {
-      drilldowns,
-      createDrilldown,
-      editDrilldown,
-      deleteDrilldown,
-    } = useDrilldownsStateManager(props.dynamicActionManager, toastService);
-
-    /**
-     * isCompatible promise is not yet resolved.
-     * Skip rendering until it is resolved
-     */
-    if (!actionFactories) return null;
-    /**
-     * Drilldowns are not fetched yet or error happened during fetching
-     * In case of error user is notified with toast
-     */
-    if (!drilldowns) return null;
-
-    /**
-     * Needed for edit mode to prefill wizard fields with data from current edited drilldown
-     */
-    function resolveInitialDrilldownWizardConfig(): DrilldownWizardConfig | undefined {
-      if (route !== Routes.Edit) return undefined;
-      if (!currentEditId) return undefined;
-      const drilldownToEdit = drilldowns?.find((d) => d.eventId === currentEditId);
-      if (!drilldownToEdit) return undefined;
-
-      return {
-        actionFactory: allActionFactoriesById[drilldownToEdit.action.factoryId],
-        actionConfig: drilldownToEdit.action.config as BaseActionConfig,
-        name: drilldownToEdit.action.name,
-        selectedTriggers: (drilldownToEdit.triggers ?? []) as string[],
-      };
-    }
-
-    /**
-     * Maps drilldown to list item view model
-     */
-    function mapToDrilldownToDrilldownListItem(drilldown: SerializedEvent): DrilldownListItem {
-      const actionFactory = allActionFactoriesById[drilldown.action.factoryId];
-      const drilldownFactoryContext: BaseActionFactoryContext = {
-        ...props.placeContext,
-        triggers: drilldown.triggers as string[],
-      };
-      return {
-        id: drilldown.eventId,
-        drilldownName: drilldown.action.name,
-        actionName:
-          actionFactory?.getDisplayName(drilldownFactoryContext) ?? drilldown.action.factoryId,
-        icon: actionFactory?.getIconType(drilldownFactoryContext),
-        error: !actionFactory
-          ? invalidDrilldownType(drilldown.action.factoryId) // this shouldn't happen for the end user, but useful during development
-          : !actionFactory.isCompatibleLicense()
-          ? insufficientLicenseLevel
-          : undefined,
-        triggers: drilldown.triggers.map((trigger) => getTrigger(trigger as string)),
-      };
-    }
-
-    switch (route) {
-      case Routes.Create:
-      case Routes.Edit:
-        return (
-          <FlyoutDrilldownWizard
-            docsLink={docsLink}
-            triggerPickerDocsLink={triggerPickerDocsLink}
-            showWelcomeMessage={shouldShowWelcomeMessage}
-            onWelcomeHideClick={onHideWelcomeMessage}
-            drilldownActionFactories={actionFactories}
-            onClose={props.onClose}
-            mode={route === Routes.Create ? 'create' : 'edit'}
-            onBack={isCreateOnly ? undefined : () => setRoute(Routes.Manage)}
-            onSubmit={({ actionConfig, actionFactory, name, selectedTriggers }) => {
-              if (route === Routes.Create) {
-                createDrilldown(
-                  {
-                    name,
-                    config: actionConfig,
-                    factoryId: actionFactory.id,
-                  },
-                  selectedTriggers
-                );
-              } else {
-                editDrilldown(
-                  currentEditId!,
-                  {
-                    name,
-                    config: actionConfig,
-                    factoryId: actionFactory.id,
-                  },
-                  selectedTriggers
-                );
-              }
-
-              if (isCreateOnly) {
-                if (props.onClose) {
-                  props.onClose();
-                }
-              } else {
-                setRoute(Routes.Manage);
-              }
-
-              setCurrentEditId(null);
-            }}
-            onDelete={() => {
-              deleteDrilldown(currentEditId!);
-              setRoute(Routes.Manage);
-              setCurrentEditId(null);
-            }}
-            actionFactoryPlaceContext={props.placeContext}
-            initialDrilldownWizardConfig={resolveInitialDrilldownWizardConfig()}
-            supportedTriggers={props.triggers}
-            getTrigger={getTrigger}
-          />
-        );
-
-      case Routes.Manage:
-      default:
-        // show trigger column in case if there is more then 1 possible trigger in current context
-        const showTriggerColumn =
-          intersection(
-            props.triggers,
-            actionFactories
-              .map((factory) => factory.supportedTriggers())
-              .reduce((res, next) => res.concat(next), [])
-          ).length > 1;
-        return (
-          <FlyoutListManageDrilldowns
-            docsLink={docsLink}
-            showWelcomeMessage={shouldShowWelcomeMessage}
-            onWelcomeHideClick={onHideWelcomeMessage}
-            drilldowns={drilldowns.map(mapToDrilldownToDrilldownListItem)}
-            onDelete={(ids) => {
-              setCurrentEditId(null);
-              deleteDrilldown(ids);
-            }}
-            onEdit={(id) => {
-              setCurrentEditId(id);
-              setRoute(Routes.Edit);
-            }}
-            onCreate={() => {
-              setCurrentEditId(null);
-              setRoute(Routes.Create);
-            }}
-            onClose={props.onClose}
-            showTriggerColumn={showTriggerColumn}
-          />
-        );
-    }
-  };
-}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts
deleted file mode 100644
index e93ff84e709d78..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/i18n.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const insufficientLicenseLevel = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.insufficientLicenseLevelError',
-  {
-    defaultMessage: 'Insufficient license level',
-    description:
-      'User created drilldown with higher license type, but then downgraded the license. This error is shown in the list near created drilldown',
-  }
-);
-
-export const invalidDrilldownType = (type: string) =>
-  i18n.translate(
-    'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.invalidDrilldownType',
-    {
-      defaultMessage: "Drilldown type {type} doesn't exist",
-      values: {
-        type,
-      },
-    }
-  );
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/test_data.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/test_data.ts
deleted file mode 100644
index cb039587b5b085..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/test_data.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import uuid from 'uuid';
-import type { PublicMethodsOf } from '@kbn/utility-types';
-import {
-  UiActionsEnhancedDynamicActionManager as DynamicActionManager,
-  UiActionsEnhancedDynamicActionManagerState as DynamicActionManagerState,
-  UiActionsEnhancedSerializedAction,
-} from '../../../index';
-import { createStateContainer } from '../../../../../../../src/plugins/kibana_utils/common';
-
-class MockDynamicActionManager implements PublicMethodsOf<DynamicActionManager> {
-  public readonly state = createStateContainer<DynamicActionManagerState>({
-    isFetchingEvents: false,
-    fetchCount: 0,
-    events: [],
-  });
-
-  async count() {
-    return this.state.get().events.length;
-  }
-
-  async list() {
-    return this.state.get().events;
-  }
-
-  async createEvent(action: UiActionsEnhancedSerializedAction<any>, triggers: string[]) {
-    const event = {
-      action,
-      triggers,
-      eventId: uuid(),
-    };
-    const state = this.state.get();
-    this.state.set({
-      ...state,
-      events: [...state.events, event],
-    });
-  }
-
-  async deleteEvents(eventIds: string[]) {
-    const state = this.state.get();
-    let events = state.events;
-
-    eventIds.forEach((id) => {
-      events = events.filter((e) => e.eventId !== id);
-    });
-
-    this.state.set({
-      ...state,
-      events,
-    });
-  }
-
-  async updateEvent(
-    eventId: string,
-    action: UiActionsEnhancedSerializedAction,
-    triggers: string[]
-  ) {
-    const state = this.state.get();
-    const events = state.events;
-    const idx = events.findIndex((e) => e.eventId === eventId);
-    const event = {
-      eventId,
-      action,
-      triggers,
-    };
-
-    this.state.set({
-      ...state,
-      events: [...events.slice(0, idx), event, ...events.slice(idx + 1)],
-    });
-  }
-
-  async deleteEvent() {
-    throw new Error('not implemented');
-  }
-
-  async start() {}
-  async stop() {}
-}
-
-export const mockDynamicActionManager = (new MockDynamicActionManager() as unknown) as DynamicActionManager;
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.stories.tsx
deleted file mode 100644
index b339fac85ba616..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.stories.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as React from 'react';
-import { EuiFlyout } from '@elastic/eui';
-import { storiesOf } from '@storybook/react';
-import { FlyoutDrilldownWizard } from './index';
-import { mockActionFactories } from '../../../components/action_wizard/test_data';
-import { Trigger } from '../../../../../../../src/plugins/ui_actions/public';
-
-const otherProps = {
-  supportedTriggers: ['VALUE_CLICK_TRIGGER', 'SELECT_RANGE_TRIGGER', 'FILTER_TRIGGER'] as string[],
-  onClose: () => {},
-  getTrigger: (id: string) => ({ id } as Trigger),
-};
-
-storiesOf('components/FlyoutDrilldownWizard', module)
-  .add('default', () => {
-    return <FlyoutDrilldownWizard drilldownActionFactories={mockActionFactories} {...otherProps} />;
-  })
-  .add('open in flyout - create', () => {
-    return (
-      <EuiFlyout onClose={() => {}}>
-        <FlyoutDrilldownWizard drilldownActionFactories={mockActionFactories} {...otherProps} />
-      </EuiFlyout>
-    );
-  })
-  .add('open in flyout - edit', () => {
-    return (
-      <EuiFlyout onClose={() => {}}>
-        <FlyoutDrilldownWizard
-          drilldownActionFactories={mockActionFactories}
-          initialDrilldownWizardConfig={{
-            name: 'My fancy drilldown',
-            actionFactory: mockActionFactories[1],
-            actionConfig: {
-              url: 'https://elastic.co',
-              openInNewTab: true,
-            },
-          }}
-          mode={'edit'}
-          {...otherProps}
-        />
-      </EuiFlyout>
-    );
-  })
-  .add('open in flyout - edit, just 1 action type', () => {
-    return (
-      <EuiFlyout onClose={() => {}}>
-        <FlyoutDrilldownWizard
-          drilldownActionFactories={[mockActionFactories[1]]}
-          initialDrilldownWizardConfig={{
-            name: 'My fancy drilldown',
-            actionFactory: mockActionFactories[1],
-            actionConfig: {
-              url: 'https://elastic.co',
-              openInNewTab: true,
-            },
-          }}
-          mode={'edit'}
-          {...otherProps}
-        />
-      </EuiFlyout>
-    );
-  });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
deleted file mode 100644
index daa895de9e46bc..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
+++ /dev/null
@@ -1,248 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useMemo, useState } from 'react';
-import { EuiButton, EuiSpacer } from '@elastic/eui';
-import { FormDrilldownWizard } from '../form_drilldown_wizard';
-import { FlyoutFrame } from '../flyout_frame';
-import {
-  txtCreateDrilldownButtonLabel,
-  txtCreateDrilldownTitle,
-  txtDeleteDrilldownButtonLabel,
-  txtEditDrilldownButtonLabel,
-  txtEditDrilldownTitle,
-} from './i18n';
-import { DrilldownHelloBar } from '../drilldown_hello_bar';
-import {
-  ActionFactory,
-  BaseActionConfig,
-  BaseActionFactoryContext,
-} from '../../../dynamic_actions';
-import { Trigger } from '../../../../../../../src/plugins/ui_actions/public';
-import { ActionFactoryPlaceContext } from '../types';
-
-export interface DrilldownWizardConfig<ActionConfig extends BaseActionConfig = BaseActionConfig> {
-  name: string;
-  actionFactory?: ActionFactory;
-  actionConfig?: ActionConfig;
-  selectedTriggers?: string[];
-}
-
-export interface FlyoutDrilldownWizardProps<
-  CurrentActionConfig extends BaseActionConfig = BaseActionConfig,
-  ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
-> {
-  drilldownActionFactories: ActionFactory[];
-
-  onSubmit?: (drilldownWizardConfig: Required<DrilldownWizardConfig>) => void;
-  onDelete?: () => void;
-  onClose?: () => void;
-  onBack?: () => void;
-
-  mode?: 'create' | 'edit';
-  initialDrilldownWizardConfig?: DrilldownWizardConfig<CurrentActionConfig>;
-
-  showWelcomeMessage?: boolean;
-  onWelcomeHideClick?: () => void;
-
-  actionFactoryPlaceContext?: ActionFactoryPlaceContext<ActionFactoryContext>;
-
-  /**
-   * General overview of drilldowns
-   */
-  docsLink?: string;
-
-  /**
-   * Link that explains different triggers
-   */
-  triggerPickerDocsLink?: string;
-
-  getTrigger: (triggerId: string) => Trigger;
-
-  /**
-   * List of possible triggers in current context
-   */
-  supportedTriggers: string[];
-}
-
-function useWizardConfigState(
-  actionFactoryContext: BaseActionFactoryContext,
-  initialDrilldownWizardConfig?: DrilldownWizardConfig
-): [
-  DrilldownWizardConfig,
-  {
-    setName: (name: string) => void;
-    setActionConfig: (actionConfig: BaseActionConfig) => void;
-    setActionFactory: (actionFactory?: ActionFactory) => void;
-    setSelectedTriggers: (triggers?: string[]) => void;
-  }
-] {
-  const [wizardConfig, setWizardConfig] = useState<DrilldownWizardConfig>(
-    () =>
-      initialDrilldownWizardConfig ?? {
-        name: '',
-      }
-  );
-  const [actionConfigCache, setActionConfigCache] = useState<Record<string, object>>(
-    initialDrilldownWizardConfig?.actionFactory
-      ? {
-          [initialDrilldownWizardConfig.actionFactory
-            .id]: initialDrilldownWizardConfig.actionConfig!,
-        }
-      : {}
-  );
-
-  return [
-    wizardConfig,
-    {
-      setName: (name: string) => {
-        setWizardConfig({
-          ...wizardConfig,
-          name,
-        });
-      },
-      setActionConfig: (actionConfig: BaseActionConfig) => {
-        setWizardConfig({
-          ...wizardConfig,
-          actionConfig,
-        });
-      },
-      setActionFactory: (actionFactory?: ActionFactory) => {
-        if (actionFactory) {
-          const actionConfig = (actionConfigCache[actionFactory.id] ??
-            actionFactory.createConfig(actionFactoryContext)) as BaseActionConfig;
-          setWizardConfig({
-            ...wizardConfig,
-            actionFactory,
-            actionConfig,
-            selectedTriggers: [],
-          });
-        } else {
-          if (wizardConfig.actionFactory?.id) {
-            setActionConfigCache({
-              ...actionConfigCache,
-              [wizardConfig.actionFactory.id]: wizardConfig.actionConfig!,
-            });
-          }
-
-          setWizardConfig({
-            ...wizardConfig,
-            actionFactory: undefined,
-            actionConfig: undefined,
-          });
-        }
-      },
-      setSelectedTriggers: (selectedTriggers: string[] = []) => {
-        setWizardConfig({
-          ...wizardConfig,
-          selectedTriggers,
-        });
-      },
-    },
-  ];
-}
-
-export function FlyoutDrilldownWizard<
-  CurrentActionConfig extends BaseActionConfig = BaseActionConfig
->({
-  onClose,
-  onBack,
-  onSubmit = () => {},
-  initialDrilldownWizardConfig,
-  mode = 'create',
-  onDelete = () => {},
-  showWelcomeMessage = true,
-  onWelcomeHideClick,
-  drilldownActionFactories,
-  actionFactoryPlaceContext,
-  docsLink,
-  triggerPickerDocsLink,
-  getTrigger,
-  supportedTriggers,
-}: FlyoutDrilldownWizardProps<CurrentActionConfig>) {
-  const [
-    wizardConfig,
-    { setActionFactory, setActionConfig, setName, setSelectedTriggers },
-  ] = useWizardConfigState(
-    { ...actionFactoryPlaceContext, triggers: supportedTriggers },
-    initialDrilldownWizardConfig
-  );
-
-  const actionFactoryContext: BaseActionFactoryContext = useMemo(
-    () => ({
-      ...actionFactoryPlaceContext,
-      triggers: wizardConfig.selectedTriggers ?? [],
-    }),
-    [actionFactoryPlaceContext, wizardConfig.selectedTriggers]
-  );
-
-  const isActionValid = (
-    config: DrilldownWizardConfig
-  ): config is Required<DrilldownWizardConfig> => {
-    if (!wizardConfig.name) return false;
-    if (!wizardConfig.actionFactory) return false;
-    if (!wizardConfig.actionConfig) return false;
-    if (!wizardConfig.selectedTriggers || wizardConfig.selectedTriggers.length === 0) return false;
-
-    return wizardConfig.actionFactory.isConfigValid(
-      wizardConfig.actionConfig,
-      actionFactoryContext
-    );
-  };
-
-  const footer = (
-    <EuiButton
-      onClick={() => {
-        if (isActionValid(wizardConfig)) {
-          onSubmit(wizardConfig);
-        }
-      }}
-      fill
-      isDisabled={!isActionValid(wizardConfig)}
-      data-test-subj={'drilldownWizardSubmit'}
-    >
-      {mode === 'edit' ? txtEditDrilldownButtonLabel : txtCreateDrilldownButtonLabel}
-    </EuiButton>
-  );
-
-  return (
-    <FlyoutFrame
-      title={mode === 'edit' ? txtEditDrilldownTitle : txtCreateDrilldownTitle}
-      footer={footer}
-      onClose={onClose}
-      onBack={onBack}
-      banner={
-        showWelcomeMessage && (
-          <DrilldownHelloBar docsLink={docsLink} onHideClick={onWelcomeHideClick} />
-        )
-      }
-    >
-      <FormDrilldownWizard
-        name={wizardConfig.name}
-        onNameChange={setName}
-        actionConfig={wizardConfig.actionConfig}
-        onActionConfigChange={setActionConfig}
-        currentActionFactory={wizardConfig.actionFactory}
-        onActionFactoryChange={setActionFactory}
-        actionFactories={drilldownActionFactories}
-        actionFactoryContext={actionFactoryContext}
-        onSelectedTriggersChange={setSelectedTriggers}
-        triggers={supportedTriggers}
-        getTriggerInfo={getTrigger}
-        triggerPickerDocsLink={triggerPickerDocsLink}
-      />
-      {mode === 'edit' && (
-        <>
-          <EuiSpacer size={'xl'} />
-          <EuiButton onClick={onDelete} color={'danger'}>
-            {txtDeleteDrilldownButtonLabel}
-          </EuiButton>
-        </>
-      )}
-    </FlyoutFrame>
-  );
-}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.stories.tsx
deleted file mode 100644
index 9a27dfad431b10..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.stories.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as React from 'react';
-import { EuiFlyout } from '@elastic/eui';
-import { storiesOf } from '@storybook/react';
-import { FlyoutListManageDrilldowns } from './flyout_list_manage_drilldowns';
-
-storiesOf('components/FlyoutListManageDrilldowns', module).add('default', () => (
-  <EuiFlyout onClose={() => {}}>
-    <FlyoutListManageDrilldowns
-      drilldowns={[
-        { id: '1', actionName: 'Dashboard', drilldownName: 'Drilldown 1' },
-        { id: '2', actionName: 'Dashboard', drilldownName: 'Drilldown 2' },
-        { id: '3', actionName: 'Dashboard', drilldownName: 'Drilldown 3', error: 'Some error...' },
-      ]}
-    />
-  </EuiFlyout>
-));
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx
deleted file mode 100644
index af5b687fb56a91..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { FlyoutFrame } from '../flyout_frame';
-import { DrilldownListItem, ListManageDrilldowns } from '../list_manage_drilldowns';
-import { txtManageDrilldowns } from './i18n';
-import { DrilldownHelloBar } from '../drilldown_hello_bar';
-
-export interface FlyoutListManageDrilldownsProps {
-  docsLink?: string;
-  drilldowns: DrilldownListItem[];
-  onClose?: () => void;
-  onCreate?: () => void;
-  onEdit?: (drilldownId: string) => void;
-  onDelete?: (drilldownIds: string[]) => void;
-  showWelcomeMessage?: boolean;
-  onWelcomeHideClick?: () => void;
-  showTriggerColumn?: boolean;
-}
-
-export function FlyoutListManageDrilldowns({
-  docsLink,
-  drilldowns,
-  onClose = () => {},
-  onCreate,
-  onDelete,
-  onEdit,
-  showWelcomeMessage = true,
-  onWelcomeHideClick,
-  showTriggerColumn,
-}: FlyoutListManageDrilldownsProps) {
-  return (
-    <FlyoutFrame
-      title={txtManageDrilldowns}
-      onClose={onClose}
-      banner={
-        showWelcomeMessage && (
-          <DrilldownHelloBar docsLink={docsLink} onHideClick={onWelcomeHideClick} />
-        )
-      }
-    >
-      <ListManageDrilldowns
-        drilldowns={drilldowns}
-        onCreate={onCreate}
-        onEdit={onEdit}
-        onDelete={onDelete}
-        showTriggerColumn={showTriggerColumn}
-      />
-    </FlyoutFrame>
-  );
-}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.stories.tsx
deleted file mode 100644
index e5af260733bb46..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.stories.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as React from 'react';
-import { storiesOf } from '@storybook/react';
-import { FormDrilldownWizard } from './index';
-import { Trigger } from '../../../../../../../src/plugins/ui_actions/public';
-
-const otherProps = {
-  triggers: ['VALUE_CLICK_TRIGGER', 'SELECT_RANGE_TRIGGER', 'FILTER_TRIGGER'],
-  getTriggerInfo: (id: string) => ({ id } as Trigger),
-  onSelectedTriggersChange: () => {},
-  actionFactoryContext: { triggers: [] as string[] },
-};
-
-const DemoEditName: React.FC = () => {
-  const [name, setName] = React.useState('');
-
-  return (
-    <>
-      <FormDrilldownWizard name={name} onNameChange={setName} {...otherProps} />{' '}
-      <div>name: {name}</div>
-    </>
-  );
-};
-
-storiesOf('components/FormDrilldownWizard', module)
-  .add('default', () => {
-    return <FormDrilldownWizard {...otherProps} />;
-  })
-  .add('[name=foobar]', () => {
-    return <FormDrilldownWizard name={'foobar'} {...otherProps} />;
-  })
-  .add('can edit name', () => <DemoEditName />);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.test.tsx
deleted file mode 100644
index 2bcfc42c865c15..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.test.tsx
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { render } from 'react-dom';
-import { FormDrilldownWizard } from './form_drilldown_wizard';
-import { render as renderTestingLibrary, fireEvent } from '@testing-library/react';
-import { txtNameOfDrilldown } from './i18n';
-import { Trigger } from '../../../../../../../src/plugins/ui_actions/public';
-
-const otherProps = {
-  actionFactoryContext: { triggers: [] as string[] },
-  triggers: ['VALUE_CLICK_TRIGGER', 'SELECT_RANGE_TRIGGER', 'FILTER_TRIGGER'] as string[],
-  getTriggerInfo: (id: string) => ({ id } as Trigger),
-  onSelectedTriggersChange: () => {},
-};
-
-describe('<FormDrilldownWizard>', () => {
-  test('renders without crashing', () => {
-    const div = document.createElement('div');
-    render(<FormDrilldownWizard onNameChange={() => {}} {...otherProps} />, div);
-  });
-
-  describe('[name=]', () => {
-    test('if name not provided, uses to empty string', () => {
-      const div = document.createElement('div');
-
-      render(<FormDrilldownWizard {...otherProps} />, div);
-
-      const input = div.querySelector('[data-test-subj="drilldownNameInput"]') as HTMLInputElement;
-
-      expect(input?.value).toBe('');
-    });
-
-    test('can set initial name input field value', () => {
-      const div = document.createElement('div');
-
-      render(<FormDrilldownWizard name={'foo'} {...otherProps} />, div);
-
-      const input = div.querySelector('[data-test-subj="drilldownNameInput"]') as HTMLInputElement;
-
-      expect(input?.value).toBe('foo');
-
-      render(<FormDrilldownWizard name={'bar'} {...otherProps} />, div);
-
-      expect(input?.value).toBe('bar');
-    });
-
-    test('fires onNameChange callback on name change', () => {
-      const onNameChange = jest.fn();
-      const utils = renderTestingLibrary(
-        <FormDrilldownWizard name={''} onNameChange={onNameChange} {...otherProps} />
-      );
-      const input = utils.getByLabelText(txtNameOfDrilldown);
-
-      expect(onNameChange).toHaveBeenCalledTimes(0);
-
-      fireEvent.change(input, { target: { value: 'qux' } });
-
-      expect(onNameChange).toHaveBeenCalledTimes(1);
-      expect(onNameChange).toHaveBeenCalledWith('qux');
-
-      fireEvent.change(input, { target: { value: 'quxx' } });
-
-      expect(onNameChange).toHaveBeenCalledTimes(2);
-      expect(onNameChange).toHaveBeenCalledWith('quxx');
-    });
-  });
-});
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
deleted file mode 100644
index 68cf6509d00590..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/form_drilldown_wizard.tsx
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { EuiFieldText, EuiForm, EuiFormRow, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
-import { EuiCallOut } from '@elastic/eui';
-import { EuiCode } from '@elastic/eui';
-import { txtDrilldownAction, txtNameOfDrilldown, txtUntitledDrilldown } from './i18n';
-import {
-  ActionFactory,
-  BaseActionConfig,
-  BaseActionFactoryContext,
-} from '../../../dynamic_actions';
-import { ActionWizard } from '../../../components/action_wizard';
-import { Trigger } from '../../../../../../../src/plugins/ui_actions/public';
-import { txtGetMoreActions } from './i18n';
-
-const GET_MORE_ACTIONS_LINK = 'https://www.elastic.co/subscriptions';
-
-const noopFn = () => {};
-
-export interface FormDrilldownWizardProps<
-  ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
-> {
-  name?: string;
-  onNameChange?: (name: string) => void;
-
-  currentActionFactory?: ActionFactory;
-  onActionFactoryChange?: (actionFactory?: ActionFactory) => void;
-  actionFactoryContext: ActionFactoryContext;
-
-  actionConfig?: BaseActionConfig;
-  onActionConfigChange?: (config: BaseActionConfig) => void;
-
-  actionFactories?: ActionFactory[];
-
-  /**
-   * Trigger selection has changed
-   * @param triggers
-   */
-  onSelectedTriggersChange: (triggers?: string[]) => void;
-
-  getTriggerInfo: (triggerId: string) => Trigger;
-
-  /**
-   * List of possible triggers in current context
-   */
-  triggers: string[];
-
-  triggerPickerDocsLink?: string;
-}
-
-export const FormDrilldownWizard: React.FC<FormDrilldownWizardProps> = ({
-  name = '',
-  actionConfig,
-  currentActionFactory,
-  onNameChange = noopFn,
-  onActionConfigChange = noopFn,
-  onActionFactoryChange = noopFn,
-  actionFactories = [],
-  actionFactoryContext,
-  onSelectedTriggersChange,
-  getTriggerInfo,
-  triggers,
-  triggerPickerDocsLink,
-}) => {
-  if (!triggers || !triggers.length) {
-    // Below callout is not translated, because this message is only for developers.
-    return (
-      <EuiCallOut title="Sorry, there was an error" color="danger" iconType="alert">
-        <p>
-          No triggers provided in <EuiCode>trigger</EuiCode> prop.
-        </p>
-      </EuiCallOut>
-    );
-  }
-
-  const nameFragment = (
-    <EuiFormRow label={txtNameOfDrilldown}>
-      <EuiFieldText
-        name="drilldown_name"
-        placeholder={txtUntitledDrilldown}
-        value={name}
-        disabled={onNameChange === noopFn}
-        onChange={(event) => onNameChange(event.target.value)}
-        data-test-subj="drilldownNameInput"
-      />
-    </EuiFormRow>
-  );
-
-  const hasNotCompatibleLicenseFactory = () =>
-    actionFactories?.some((f) => !f.isCompatibleLicense());
-
-  const renderGetMoreActionsLink = () => (
-    <EuiText size="s">
-      <EuiLink
-        href={GET_MORE_ACTIONS_LINK}
-        target="_blank"
-        external
-        data-test-subj={'getMoreActionsLink'}
-      >
-        {txtGetMoreActions}
-      </EuiLink>
-    </EuiText>
-  );
-
-  const actionWizard = (
-    <EuiFormRow
-      label={actionFactories?.length > 1 ? txtDrilldownAction : undefined}
-      fullWidth={true}
-      labelAppend={
-        !currentActionFactory && hasNotCompatibleLicenseFactory() && renderGetMoreActionsLink()
-      }
-    >
-      <ActionWizard
-        actionFactories={actionFactories}
-        currentActionFactory={currentActionFactory}
-        config={actionConfig}
-        onActionFactoryChange={(actionFactory) => onActionFactoryChange(actionFactory)}
-        onConfigChange={(config) => onActionConfigChange(config)}
-        context={actionFactoryContext}
-        onSelectedTriggersChange={onSelectedTriggersChange}
-        getTriggerInfo={getTriggerInfo}
-        triggers={triggers}
-        triggerPickerDocsLink={triggerPickerDocsLink}
-      />
-    </EuiFormRow>
-  );
-
-  return (
-    <>
-      <EuiForm>
-        {nameFragment}
-        <EuiSpacer size={'xl'} />
-        {actionWizard}
-      </EuiForm>
-    </>
-  );
-};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/i18n.ts
deleted file mode 100644
index 9b817917ba0e27..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/i18n.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const txtNameOfDrilldown = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.nameOfDrilldown',
-  {
-    defaultMessage: 'Name',
-  }
-);
-
-export const txtUntitledDrilldown = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.untitledDrilldown',
-  {
-    defaultMessage: 'Untitled drilldown',
-  }
-);
-
-export const txtDrilldownAction = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.FormCreateDrilldown.drilldownAction',
-  {
-    defaultMessage: 'Action',
-  }
-);
-
-export const txtGetMoreActions = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.FormDrilldownWizard.getMoreActionsLinkLabel',
-  {
-    defaultMessage: 'Get more actions',
-  }
-);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/index.ts
deleted file mode 100644
index 8c69e44a90a63e..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export { createFlyoutManageDrilldowns } from './connected_flyout_manage_drilldowns';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/i18n.ts
deleted file mode 100644
index 5985c3208c684e..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/i18n.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const txtCreateDrilldown = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.createDrilldownButtonLabel',
-  {
-    defaultMessage: 'Create new',
-  }
-);
-
-export const txtEditDrilldown = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.editDrilldownButtonLabel',
-  {
-    defaultMessage: 'Edit',
-  }
-);
-
-export const txtDeleteDrilldowns = (count: number) =>
-  i18n.translate(
-    'xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.deleteDrilldownsButtonLabel',
-    {
-      defaultMessage: 'Delete ({count})',
-      values: {
-        count,
-      },
-    }
-  );
-
-export const txtSelectDrilldown = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.ListManageDrilldowns.selectThisDrilldownCheckboxLabel',
-  {
-    defaultMessage: 'Select this drilldown',
-  }
-);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.stories.tsx
deleted file mode 100644
index ad19ee7797e785..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.stories.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import * as React from 'react';
-import { storiesOf } from '@storybook/react';
-import { ListManageDrilldowns } from './list_manage_drilldowns';
-
-storiesOf('components/ListManageDrilldowns', module).add('default', () => (
-  <ListManageDrilldowns
-    drilldowns={[
-      {
-        id: '1',
-        actionName: 'Dashboard',
-        drilldownName: 'Drilldown 1',
-        icon: 'dashboardApp',
-        triggers: [{ title: 'trigger' }],
-      },
-      {
-        id: '2',
-        actionName: 'Dashboard',
-        drilldownName: 'Drilldown 2',
-        icon: 'dashboardApp',
-        triggers: [{ title: 'trigger' }],
-      },
-      {
-        id: '3',
-        actionName: 'Dashboard',
-        drilldownName: 'Drilldown 3',
-        triggers: [{ title: 'trigger', description: 'trigger' }],
-      },
-    ]}
-  />
-));
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts
deleted file mode 100644
index a6134b4bb45bd1..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/types.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { BaseActionFactoryContext } from '../../dynamic_actions';
-
-/**
- * Interface used as piece of ActionFactoryContext that is passed in from drilldown wizard component to action factories
- * Omitted values are added inside the wizard and then full {@link BaseActionFactoryContext} passed into action factory methods
- */
-export type ActionFactoryPlaceContext<
-  ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
-> = Omit<ActionFactoryContext, 'triggers'>;
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/README.md b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/README.md
new file mode 100644
index 00000000000000..7d3916302b29d5
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/README.md
@@ -0,0 +1,12 @@
+# Drilldown Manager
+
+Drilldown Manager is the flyout that opens where drilldowns can be managed using
+a CRUD UI. (It does not necessarily need to be a flyout, you can also embed it
+directly on a page.)
+
+The main React component that this folder exports is `<DrilldownManager>`, which
+should normally be rendered in a flyout.
+
+A new instance of Drilldown Manager is rendered for every place where drilldowns
+are used. For example, for each panel on the dashboard a separate new Drilldown
+Manager is rendered in the flyout.
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/action_factory/action_factory.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/action_factory/action_factory.tsx
new file mode 100644
index 00000000000000..4391254d0a8aab
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/action_factory/action_factory.tsx
@@ -0,0 +1,132 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiBetaBadge,
+  EuiButtonEmpty,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiIcon,
+  EuiLink,
+  EuiText,
+} from '@elastic/eui';
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+
+const txtDrilldownAction = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.drilldownAction',
+  {
+    defaultMessage: 'Action',
+  }
+);
+
+const txtGetMoreActions = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.getMoreActionsLinkLabel',
+  {
+    defaultMessage: 'Get more actions',
+  }
+);
+
+const txtBetaActionFactoryLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.betaActionLabel',
+  {
+    defaultMessage: `Beta`,
+  }
+);
+
+const txtBetaActionFactoryTooltip = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.betaActionTooltip',
+  {
+    defaultMessage: `This action is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Please help us by reporting any bugs or providing other feedback.`,
+  }
+);
+
+const txtChangeButton = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.changeButton',
+  {
+    defaultMessage: 'Change',
+  }
+);
+
+const GET_MORE_ACTIONS_LINK = 'https://www.elastic.co/subscriptions';
+
+const moreActions = (
+  <EuiText size="s">
+    <EuiLink
+      href={GET_MORE_ACTIONS_LINK}
+      target="_blank"
+      external
+      data-test-subj={'getMoreActionsLink'}
+    >
+      {txtGetMoreActions}
+    </EuiLink>
+  </EuiText>
+);
+
+export interface ActionFactoryProps {
+  /** Action factory name. */
+  name?: string;
+
+  /** ID of EUI icon. */
+  icon?: string;
+
+  /** Whether the current drilldown type is in beta. */
+  beta?: boolean;
+
+  /** Whether to show "Get more actions" link to upgrade license. */
+  showMoreLink?: boolean;
+
+  /** On drilldown type change click. */
+  onChange?: () => void;
+}
+
+export const ActionFactory: React.FC<ActionFactoryProps> = ({
+  name,
+  icon,
+  beta,
+  showMoreLink,
+  onChange,
+}) => {
+  return (
+    <EuiFormRow
+      label={txtDrilldownAction}
+      fullWidth={true}
+      labelAppend={showMoreLink && moreActions}
+    >
+      <header>
+        <EuiFlexGroup alignItems="center" responsive={false} gutterSize="s">
+          {!!icon && (
+            <EuiFlexItem grow={false}>
+              <EuiIcon type={icon} size="m" />
+            </EuiFlexItem>
+          )}
+          <EuiFlexItem grow={true}>
+            <EuiText>
+              <h4>
+                {name}{' '}
+                {beta && (
+                  <EuiBetaBadge
+                    label={txtBetaActionFactoryLabel}
+                    tooltipContent={txtBetaActionFactoryTooltip}
+                  />
+                )}
+              </h4>
+            </EuiText>
+          </EuiFlexItem>
+          {!!onChange && (
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty size="xs" onClick={onChange}>
+                {txtChangeButton}
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+          )}
+        </EuiFlexGroup>
+      </header>
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/action_factory/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/action_factory/index.ts
new file mode 100644
index 00000000000000..25aabcf7e6d2f3
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/action_factory/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './action_factory';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/button_submit/button_submit.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/button_submit/button_submit.tsx
new file mode 100644
index 00000000000000..bf7dfcadd5ef79
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/button_submit/button_submit.tsx
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { EuiButton } from '@elastic/eui';
+
+export interface ButtonSubmitProps {
+  disabled?: boolean;
+  onClick: () => void;
+}
+
+export const ButtonSubmit: React.FC<ButtonSubmitProps> = ({ disabled, onClick, children }) => {
+  return (
+    <EuiButton
+      fill
+      isDisabled={disabled}
+      data-test-subj={'drilldownWizardSubmit'}
+      onClick={onClick}
+    >
+      {children}
+    </EuiButton>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/button_submit/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/button_submit/index.ts
new file mode 100644
index 00000000000000..770c32648591d5
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/button_submit/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './button_submit';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/drilldown_form.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/drilldown_form.stories.tsx
new file mode 100644
index 00000000000000..634436ed40185e
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/drilldown_form.stories.tsx
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { storiesOf } from '@storybook/react';
+import { action } from '@storybook/addon-actions';
+import { DrilldownForm } from '.';
+import type { TriggerPickerProps } from '../trigger_picker';
+
+const triggers: TriggerPickerProps = {
+  items: [
+    {
+      id: 'RANGE_SELECT_TRIGGER',
+      title: 'Range selected',
+      description: 'On chart brush.',
+    },
+    {
+      id: 'VALUE_CLICK_TRIGGER',
+      title: 'Value click',
+      description: 'On point click in chart',
+    },
+  ],
+  selected: ['RANGE_SELECT_TRIGGER'],
+  docs: 'http://example.com',
+  onChange: () => {},
+};
+
+storiesOf('components/DrilldownForm', module)
+  .add('Default', () => {
+    return (
+      <DrilldownForm name={'...'} triggers={triggers} onNameChange={action('onNameChange')}>
+        children...
+      </DrilldownForm>
+    );
+  })
+  .add('With license link', () => {
+    return (
+      <DrilldownForm name={'...'} triggers={triggers} onNameChange={action('onNameChange')}>
+        children...
+      </DrilldownForm>
+    );
+  })
+  .add('No triggers', () => {
+    return (
+      <DrilldownForm
+        name={'...'}
+        triggers={{
+          items: [],
+          selected: ['RANGE_SELECT_TRIGGER'],
+          docs: 'http://example.com',
+          onChange: () => {},
+        }}
+        onNameChange={action('onNameChange')}
+      >
+        children...
+      </DrilldownForm>
+    );
+  });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/drilldown_form.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/drilldown_form.tsx
new file mode 100644
index 00000000000000..a4dd8f853b16c1
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/drilldown_form.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiFieldText, EuiForm, EuiFormRow, EuiSpacer, EuiCallOut, EuiCode } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { TriggerPicker, TriggerPickerProps } from '../trigger_picker';
+
+const txtNameOfDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.nameOfDrilldown',
+  {
+    defaultMessage: 'Name',
+  }
+);
+
+const txtUntitledDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownForm.untitledDrilldown',
+  {
+    defaultMessage: 'Untitled drilldown',
+  }
+);
+
+const txtTrigger = i18n.translate('xpack.uiActionsEnhanced.components.DrilldownForm.trigger', {
+  defaultMessage: 'Trigger',
+});
+
+export interface FormDrilldownWizardProps {
+  /** Value of name field. */
+  name?: string;
+
+  /** Callback called on name change. */
+  onNameChange?: (name: string) => void;
+
+  /** Trigger picker props. */
+  triggers?: TriggerPickerProps;
+
+  /** Whether the form elements should be disabled. */
+  disabled?: boolean;
+}
+
+export const DrilldownForm: React.FC<FormDrilldownWizardProps> = ({
+  name = '',
+  onNameChange,
+  triggers,
+  disabled,
+  children,
+}) => {
+  if (!!triggers && !triggers.items.length) {
+    // Below callout is not translated, because this message is only for developers.
+    return (
+      <EuiCallOut title="Sorry, there was an error" color="danger" iconType="alert">
+        <p>
+          No triggers provided in <EuiCode>triggers</EuiCode> prop.
+        </p>
+      </EuiCallOut>
+    );
+  }
+
+  const nameFragment = (
+    <EuiFormRow label={txtNameOfDrilldown}>
+      <EuiFieldText
+        name="drilldown_name"
+        placeholder={txtUntitledDrilldown}
+        value={name}
+        disabled={!onNameChange || disabled}
+        onChange={!!onNameChange ? (event) => onNameChange(event.target.value) : undefined}
+        data-test-subj="drilldownNameInput"
+      />
+    </EuiFormRow>
+  );
+
+  const triggersFragment = !!triggers && triggers.items.length > 1 && (
+    <EuiFormRow label={txtTrigger} fullWidth={true}>
+      <TriggerPicker {...triggers} disabled={disabled} />
+    </EuiFormRow>
+  );
+
+  return (
+    <EuiForm data-test-subj={`DrilldownForm`}>
+      <EuiSpacer size={'m'} />
+      {nameFragment}
+      <EuiSpacer size={'m'} />
+      {triggersFragment}
+      <EuiSpacer size={'m'} />
+      <div>{children}</div>
+    </EuiForm>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/index.tsx
similarity index 85%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/index.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/index.tsx
index 242fb44f2e235b..e17aca73a6d4d8 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/index.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_form/index.tsx
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export * from './list_manage_drilldowns';
+export * from './drilldown_form';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/drilldown_hello_bar.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/drilldown_hello_bar.stories.tsx
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/drilldown_hello_bar.stories.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/drilldown_hello_bar.stories.tsx
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/drilldown_hello_bar.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/drilldown_hello_bar.tsx
similarity index 84%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/drilldown_hello_bar.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/drilldown_hello_bar.tsx
index 01aad0ae37f3f2..af9c78c9a5484b 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/drilldown_hello_bar.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/drilldown_hello_bar.tsx
@@ -26,10 +26,7 @@ export interface DrilldownHelloBarProps {
 
 export const WELCOME_MESSAGE_TEST_SUBJ = 'drilldownsWelcomeMessage';
 
-export const DrilldownHelloBar: React.FC<DrilldownHelloBarProps> = ({
-  docsLink,
-  onHideClick = () => {},
-}) => {
+export const DrilldownHelloBar: React.FC<DrilldownHelloBarProps> = ({ docsLink, onHideClick }) => {
   return (
     <EuiCallOut data-test-subj={WELCOME_MESSAGE_TEST_SUBJ}>
       <EuiFlexGroup responsive={false}>
@@ -49,11 +46,13 @@ export const DrilldownHelloBar: React.FC<DrilldownHelloBarProps> = ({
             </>
           )}
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiButtonEmpty size="xs" onClick={onHideClick}>
-            {txtHideHelpButtonLabel}
-          </EuiButtonEmpty>
-        </EuiFlexItem>
+        {!!onHideClick && (
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty size="xs" onClick={onHideClick}>
+              {txtHideHelpButtonLabel}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+        )}
       </EuiFlexGroup>
     </EuiCallOut>
   );
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/i18n.ts
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/i18n.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/i18n.ts
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/index.tsx
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/drilldown_hello_bar/index.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_hello_bar/index.tsx
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.stories.tsx
new file mode 100644
index 00000000000000..57e2e04807a6ac
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.stories.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { storiesOf } from '@storybook/react';
+import { action } from '@storybook/addon-actions';
+import { DrilldownTable } from './drilldown_table';
+import { FlyoutFrame } from '../flyout_frame';
+
+storiesOf('components/ListManageDrilldowns', module)
+  .add('Default', () => (
+    <DrilldownTable
+      items={[
+        {
+          id: '1',
+          actionName: 'Dashboard',
+          drilldownName: 'Drilldown 1',
+          icon: 'dashboardApp',
+          triggers: [{ title: 'trigger' }],
+        },
+        {
+          id: '2',
+          actionName: 'Dashboard',
+          drilldownName: 'Drilldown 2',
+          icon: 'dashboardApp',
+          triggers: [{ title: 'trigger' }],
+        },
+        {
+          id: '3',
+          actionName: 'Dashboard',
+          drilldownName: 'Drilldown 3',
+          triggers: [{ title: 'trigger', description: 'trigger' }],
+        },
+      ]}
+      onCreate={action('onCreate')}
+      onDelete={action('onDelete')}
+      onEdit={action('onEdit')}
+    />
+  ))
+  .add('Empty list', () => (
+    <DrilldownTable
+      items={[]}
+      onCreate={action('onCreate')}
+      onDelete={action('onDelete')}
+      onEdit={action('onEdit')}
+    />
+  ))
+  .add('A single drilldown', () => (
+    <DrilldownTable
+      items={[
+        {
+          id: '1',
+          actionName: 'Dashboard',
+          drilldownName: 'Drilldown 1',
+          icon: 'dashboardApp',
+          triggers: [{ title: 'trigger' }],
+        },
+      ]}
+      onCreate={action('onCreate')}
+      onDelete={action('onDelete')}
+      onEdit={action('onEdit')}
+    />
+  ))
+  .add('Inside a flyout frame', () => (
+    <FlyoutFrame title={'Some Title'} onClose={action('onClose')} banner={null}>
+      <DrilldownTable
+        items={[
+          { id: '1', actionName: 'Dashboard', drilldownName: 'Drilldown 1' },
+          { id: '2', actionName: 'Dashboard', drilldownName: 'Drilldown 2' },
+          {
+            id: '3',
+            actionName: 'Dashboard',
+            drilldownName: 'Drilldown 3',
+            error: 'Some error...',
+          },
+        ]}
+        onCreate={action('onCreate')}
+        onDelete={action('onDelete')}
+        onEdit={action('onEdit')}
+      />
+    </FlyoutFrame>
+  ));
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.test.tsx
similarity index 74%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.test.tsx
index d4c497c4a3e4ee..ee485f8aee0c03 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.test.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.test.tsx
@@ -7,26 +7,22 @@
 
 import React from 'react';
 import { fireEvent, render } from '@testing-library/react';
-import {
-  DrilldownListItem,
-  ListManageDrilldowns,
-  TEST_SUBJ_DRILLDOWN_ITEM,
-} from './list_manage_drilldowns';
+import { DrilldownTable, DrilldownTableItem, TEST_SUBJ_DRILLDOWN_ITEM } from './drilldown_table';
 
-const drilldowns: DrilldownListItem[] = [
+const drilldowns: DrilldownTableItem[] = [
   { id: '1', actionName: 'Dashboard', drilldownName: 'Drilldown 1' },
   { id: '2', actionName: 'Dashboard', drilldownName: 'Drilldown 2' },
   { id: '3', actionName: 'Dashboard', drilldownName: 'Drilldown 3', error: 'an error' },
 ];
 
 test('Render list of drilldowns', () => {
-  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} />);
+  const screen = render(<DrilldownTable items={drilldowns} />);
   expect(screen.getAllByTestId(TEST_SUBJ_DRILLDOWN_ITEM)).toHaveLength(drilldowns.length);
 });
 
 test('Emit onEdit() when clicking on edit drilldown', () => {
   const fn = jest.fn();
-  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} onEdit={fn} />);
+  const screen = render(<DrilldownTable items={drilldowns} onEdit={fn} />);
 
   const editButtons = screen.getAllByText('Edit');
   expect(editButtons).toHaveLength(drilldowns.length);
@@ -36,21 +32,21 @@ test('Emit onEdit() when clicking on edit drilldown', () => {
 
 test('Emit onCreate() when clicking on create drilldown', () => {
   const fn = jest.fn();
-  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} onCreate={fn} />);
+  const screen = render(<DrilldownTable items={drilldowns} onCreate={fn} />);
   fireEvent.click(screen.getByText('Create new'));
   expect(fn).toBeCalled();
 });
 
 test('Delete button is not visible when non is selected', () => {
   const fn = jest.fn();
-  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} onCreate={fn} />);
+  const screen = render(<DrilldownTable items={drilldowns} onCreate={fn} />);
   expect(screen.queryByText(/Delete/i)).not.toBeInTheDocument();
   expect(screen.queryByText(/Create/i)).toBeInTheDocument();
 });
 
 test('Can delete drilldowns', () => {
   const fn = jest.fn();
-  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} onDelete={fn} />);
+  const screen = render(<DrilldownTable items={drilldowns} onDelete={fn} />);
 
   const checkboxes = screen.getAllByLabelText(/Select this drilldown/i);
   expect(checkboxes).toHaveLength(3);
@@ -66,6 +62,6 @@ test('Can delete drilldowns', () => {
 });
 
 test('Error is displayed', () => {
-  const screen = render(<ListManageDrilldowns drilldowns={drilldowns} />);
+  const screen = render(<DrilldownTable items={drilldowns} />);
   expect(screen.getByLabelText('an error')).toBeInTheDocument();
 });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.tsx
similarity index 51%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.tsx
index 207c4f5037354c..2cf4745cbbec46 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/list_manage_drilldowns/list_manage_drilldowns.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/drilldown_table.tsx
@@ -6,32 +6,36 @@
  */
 
 import {
-  EuiBasicTable,
+  EuiInMemoryTable,
   EuiBasicTableColumn,
   EuiButton,
   EuiButtonEmpty,
-  EuiFlexGroup,
-  EuiFlexItem,
   EuiIcon,
   EuiSpacer,
-  EuiTextColor,
   EuiToolTip,
 } from '@elastic/eui';
 import React, { useState } from 'react';
+import { TextWithIcon } from '../text_with_icon';
+import { TriggerLineItem } from '../trigger_line_item';
 import {
   txtCreateDrilldown,
   txtDeleteDrilldowns,
   txtEditDrilldown,
+  txtCloneDrilldown,
   txtSelectDrilldown,
+  txtName,
+  txtAction,
+  txtTrigger,
 } from './i18n';
 
-export interface DrilldownListItem {
+export interface DrilldownTableItem {
   id: string;
   actionName: string;
   drilldownName: string;
   icon?: string;
   error?: string;
   triggers?: Trigger[];
+  triggerIncompatible?: boolean;
 }
 
 interface Trigger {
@@ -39,36 +43,34 @@ interface Trigger {
   description?: string;
 }
 
-export interface ListManageDrilldownsProps {
-  drilldowns: DrilldownListItem[];
+export const TEST_SUBJ_DRILLDOWN_ITEM = 'listManageDrilldownsItem';
 
-  onEdit?: (id: string) => void;
+export interface DrilldownTableProps {
+  items: DrilldownTableItem[];
   onCreate?: () => void;
   onDelete?: (ids: string[]) => void;
-
-  showTriggerColumn?: boolean;
+  onEdit?: (id: string) => void;
+  onCopy?: (id: string) => void;
 }
 
-const noop = () => {};
-
-export const TEST_SUBJ_DRILLDOWN_ITEM = 'listManageDrilldownsItem';
-
-export function ListManageDrilldowns({
-  drilldowns,
-  onEdit = noop,
-  onCreate = noop,
-  onDelete = noop,
-  showTriggerColumn = true,
-}: ListManageDrilldownsProps) {
+export const DrilldownTable: React.FC<DrilldownTableProps> = ({
+  items: drilldowns,
+  onCreate,
+  onDelete,
+  onEdit,
+  onCopy,
+}) => {
   const [selectedDrilldowns, setSelectedDrilldowns] = useState<string[]>([]);
 
-  const columns: Array<EuiBasicTableColumn<DrilldownListItem>> = [
+  const columns: Array<EuiBasicTableColumn<DrilldownTableItem>> = [
     {
-      name: 'Name',
+      field: 'drilldownName',
+      name: txtName,
+      sortable: true,
       'data-test-subj': 'drilldownListItemName',
-      render: (drilldown: DrilldownListItem) => (
+      render: (drilldownName: string, drilldown: DrilldownTableItem) => (
         <div>
-          {drilldown.drilldownName}{' '}
+          {drilldownName}{' '}
           {drilldown.error && (
             <EuiToolTip id={`drilldownError-${drilldown.id}`} content={drilldown.error}>
               <EuiIcon
@@ -85,50 +87,62 @@ export function ListManageDrilldowns({
       ),
     },
     {
-      name: 'Action',
-      render: (drilldown: DrilldownListItem) => (
-        <EuiFlexGroup responsive={false} alignItems="center" gutterSize={'s'}>
-          {drilldown.icon && (
-            <EuiFlexItem grow={false}>
-              <EuiIcon type={drilldown.icon} />
-            </EuiFlexItem>
-          )}
-          <EuiFlexItem grow={false} style={{ flexWrap: 'wrap' }}>
-            <EuiTextColor color="subdued">{drilldown.actionName}</EuiTextColor>
-          </EuiFlexItem>
-        </EuiFlexGroup>
+      name: txtAction,
+      render: (drilldown: DrilldownTableItem) => (
+        <TextWithIcon icon={drilldown.icon} color={'subdued'}>
+          {drilldown.actionName}
+        </TextWithIcon>
       ),
     },
-    showTriggerColumn && {
-      name: 'Trigger',
+    {
+      field: 'triggers',
+      name: txtTrigger,
       textOnly: true,
-      render: (drilldown: DrilldownListItem) =>
-        drilldown.triggers?.map((trigger, idx) =>
-          trigger.description ? (
-            <EuiToolTip content={trigger.description} key={idx}>
-              <EuiTextColor color="subdued">{trigger.title ?? 'unknown'}</EuiTextColor>
-            </EuiToolTip>
-          ) : (
-            <EuiTextColor color="subdued" key={idx}>
-              {trigger.title ?? 'unknown'}
-            </EuiTextColor>
-          )
-        ),
+      sortable: (drilldown: DrilldownTableItem) =>
+        drilldown.triggers ? drilldown.triggers[0].title : '',
+      render: (triggers: unknown, drilldown: DrilldownTableItem) => {
+        if (!drilldown.triggers) return null;
+        const trigger = drilldown.triggers[0];
+        return (
+          <TriggerLineItem
+            incompatible={drilldown.triggerIncompatible}
+            tooltip={trigger.description}
+          >
+            {trigger.title ?? 'unknown'}
+          </TriggerLineItem>
+        );
+      },
     },
     {
       align: 'right',
-      width: '64px',
-      render: (drilldown: DrilldownListItem) => (
-        <EuiButtonEmpty size="xs" onClick={() => onEdit(drilldown.id)}>
-          {txtEditDrilldown}
-        </EuiButtonEmpty>
+      render: (drilldown: DrilldownTableItem) => (
+        <>
+          {!!onEdit && (
+            <EuiButtonEmpty
+              size="xs"
+              disabled={!!selectedDrilldowns.length}
+              onClick={() => onEdit(drilldown.id)}
+            >
+              {txtEditDrilldown}
+            </EuiButtonEmpty>
+          )}
+          {!!onCopy && (
+            <EuiButtonEmpty
+              size="xs"
+              disabled={!!selectedDrilldowns.length}
+              onClick={() => onCopy(drilldown.id)}
+            >
+              {txtCloneDrilldown}
+            </EuiButtonEmpty>
+          )}
+        </>
       ),
     },
-  ].filter(Boolean) as Array<EuiBasicTableColumn<DrilldownListItem>>;
+  ].filter(Boolean) as Array<EuiBasicTableColumn<DrilldownTableItem>>;
 
   return (
     <>
-      <EuiBasicTable
+      <EuiInMemoryTable
         items={drilldowns}
         itemId="id"
         columns={columns}
@@ -144,13 +158,20 @@ export function ListManageDrilldowns({
           'data-test-subj': TEST_SUBJ_DRILLDOWN_ITEM,
         }}
         hasActions={true}
+        sorting={{
+          sort: {
+            field: 'drilldownName',
+            direction: 'asc',
+          },
+        }}
       />
       <EuiSpacer />
-      {selectedDrilldowns.length === 0 ? (
+      {!!onCreate && !selectedDrilldowns.length && (
         <EuiButton fill onClick={() => onCreate()}>
           {txtCreateDrilldown}
         </EuiButton>
-      ) : (
+      )}
+      {!!onDelete && selectedDrilldowns.length > 0 && (
         <EuiButton
           color="danger"
           fill
@@ -162,4 +183,4 @@ export function ListManageDrilldowns({
       )}
     </>
   );
-}
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/i18n.ts
new file mode 100644
index 00000000000000..d465167555c314
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/i18n.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const txtCreateDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.createDrilldownButtonLabel',
+  {
+    defaultMessage: 'Create new',
+  }
+);
+
+export const txtEditDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.editDrilldownButtonLabel',
+  {
+    defaultMessage: 'Edit',
+  }
+);
+
+export const txtCloneDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.copyDrilldownButtonLabel',
+  {
+    defaultMessage: 'Copy',
+  }
+);
+
+export const txtDeleteDrilldowns = (count: number) =>
+  i18n.translate('xpack.uiActionsEnhanced.components.DrilldownTable.deleteDrilldownsButtonLabel', {
+    defaultMessage: 'Delete ({count})',
+    values: {
+      count,
+    },
+  });
+
+export const txtSelectDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.selectThisDrilldownCheckboxLabel',
+  {
+    defaultMessage: 'Select this drilldown',
+  }
+);
+
+export const txtName = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.nameColumnTitle',
+  {
+    defaultMessage: 'Name',
+  }
+);
+
+export const txtAction = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.actionColumnTitle',
+  {
+    defaultMessage: 'Action',
+  }
+);
+
+export const txtTrigger = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTable.triggerColumnTitle',
+  {
+    defaultMessage: 'Trigger',
+  }
+);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/index.tsx
new file mode 100644
index 00000000000000..1600cd63f47687
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_table/index.tsx
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_table';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/drilldown_template_table.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/drilldown_template_table.tsx
new file mode 100644
index 00000000000000..85d629dae9a1ba
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/drilldown_template_table.tsx
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+import {
+  EuiInMemoryTable,
+  EuiBasicTableColumn,
+  EuiButtonEmpty,
+  EuiSpacer,
+  EuiButton,
+  EuiText,
+  EuiSearchBarProps,
+} from '@elastic/eui';
+import {
+  txtNameColumnTitle,
+  txtSelectableMessage,
+  txtCopyButtonLabel,
+  txtSingleItemCopyActionLabel,
+  txtActionColumnTitle,
+  txtTriggerColumnTitle,
+} from './i18n';
+import { TextWithIcon } from '../text_with_icon';
+import { TriggerLineItem } from '../trigger_line_item';
+
+export interface DrilldownTemplateTableItem {
+  id: string;
+  name: string;
+  icon?: string;
+  description?: string;
+  actionName?: string;
+  actionIcon?: string;
+  trigger?: string;
+  triggerIncompatible?: boolean;
+}
+
+export interface DrilldownTemplateTableProps {
+  items: DrilldownTemplateTableItem[];
+  onCreate?: (id: string) => void;
+  onClone?: (ids: string[]) => void;
+}
+
+export const DrilldownTemplateTable: React.FC<DrilldownTemplateTableProps> = ({
+  items,
+  onCreate,
+  onClone,
+}) => {
+  const [selected, setSelected] = useState<string[]>([]);
+
+  const columns: Array<EuiBasicTableColumn<DrilldownTemplateTableItem>> = [
+    {
+      field: 'name',
+      name: txtNameColumnTitle,
+      sortable: true,
+      render: (omit, item: DrilldownTemplateTableItem) => (
+        <div style={{ display: 'block' }}>
+          <div style={{ display: 'block' }}>{item.name}</div>
+          <EuiText size={'xs'} color={'subdued'}>
+            {item.description}
+          </EuiText>
+        </div>
+      ),
+    },
+    {
+      name: txtActionColumnTitle,
+      render: (item: DrilldownTemplateTableItem) => (
+        <TextWithIcon icon={item.actionIcon || 'empty'} color={'subdued'}>
+          {item.actionName}
+        </TextWithIcon>
+      ),
+    },
+    {
+      field: 'trigger',
+      name: txtTriggerColumnTitle,
+      sortable: true,
+      render: (omit, item: DrilldownTemplateTableItem) => (
+        <TriggerLineItem incompatible={item.triggerIncompatible}>{item.trigger}</TriggerLineItem>
+      ),
+    },
+    {
+      align: 'right',
+      render: (drilldown: DrilldownTemplateTableItem) =>
+        !!onCreate && (
+          <EuiButtonEmpty
+            size="xs"
+            disabled={!!selected.length}
+            onClick={() => onCreate(drilldown.id)}
+          >
+            {txtSingleItemCopyActionLabel}
+          </EuiButtonEmpty>
+        ),
+    },
+  ];
+
+  const search: EuiSearchBarProps = {
+    box: {
+      incremental: true,
+    },
+    defaultQuery: '',
+  };
+
+  return (
+    <>
+      <EuiInMemoryTable
+        itemId="id"
+        tableLayout={'auto'}
+        items={items}
+        columns={columns}
+        isSelectable={!!onClone}
+        responsive={false}
+        search={search}
+        sorting={{
+          sort: {
+            field: 'nameCol',
+            direction: 'asc',
+          },
+        }}
+        selection={{
+          onSelectionChange: (selection) => {
+            setSelected(selection.map((drilldown) => drilldown.id));
+          },
+          selectableMessage: () => txtSelectableMessage,
+        }}
+        hasActions={true}
+      />
+      <EuiSpacer />
+      {!!onClone && !!selected.length && (
+        <EuiButton fill onClick={() => onClone(selected)}>
+          {txtCopyButtonLabel(selected.length)}
+        </EuiButton>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/i18n.ts
new file mode 100644
index 00000000000000..cfdc5b99f338de
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/i18n.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const txtSelectableMessage = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTemplateTable.selectableMessage',
+  {
+    defaultMessage: 'Select this template',
+  }
+);
+
+export const txtNameColumnTitle = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTemplateTable.nameColumnTitle',
+  {
+    defaultMessage: 'Name',
+    description: 'Title of the first column in drilldown template cloning table.',
+  }
+);
+
+export const txtSourceColumnTitle = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTemplateTable.sourceColumnTitle',
+  {
+    defaultMessage: 'Panel',
+    description: 'Column title which describes from where the drilldown is cloned.',
+  }
+);
+
+export const txtActionColumnTitle = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTemplateTable.actionColumnTitle',
+  {
+    defaultMessage: 'Action',
+  }
+);
+
+export const txtTriggerColumnTitle = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTemplateTable.triggerColumnTitle',
+  {
+    defaultMessage: 'Trigger',
+  }
+);
+
+export const txtSingleItemCopyActionLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.components.DrilldownTemplateTable.singleItemCopyAction',
+  {
+    defaultMessage: 'Copy',
+    description: '"Copy" action button label in drilldown template cloning table last column.',
+  }
+);
+
+export const txtCopyButtonLabel = (count: number) =>
+  i18n.translate('xpack.uiActionsEnhanced.components.DrilldownTemplateTable.copyButtonLabel', {
+    defaultMessage: 'Copy ({count})',
+    description: 'Label of drilldown template table bottom copy button.',
+    values: {
+      count,
+    },
+  });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/index.tsx
new file mode 100644
index 00000000000000..0753e03a44e6f9
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/drilldown_template_table/index.tsx
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_template_table';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/flyout_frame.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/flyout_frame.stories.tsx
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/flyout_frame.stories.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/flyout_frame.stories.tsx
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/flyout_frame.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/flyout_frame.test.tsx
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/flyout_frame.test.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/flyout_frame.test.tsx
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/flyout_frame.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/flyout_frame.tsx
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/flyout_frame.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/flyout_frame.tsx
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/i18n.ts
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/i18n.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/i18n.ts
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/index.tsx
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_frame/index.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/flyout_frame/index.tsx
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/text_with_icon/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/text_with_icon/index.tsx
new file mode 100644
index 00000000000000..bf312643597f0c
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/text_with_icon/index.tsx
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './text_with_icon';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/text_with_icon/text_with_icon.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/text_with_icon/text_with_icon.tsx
new file mode 100644
index 00000000000000..9b7fe346547b1d
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/text_with_icon/text_with_icon.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import {
+  EuiTextColor,
+  EuiTextColorProps,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiToolTip,
+} from '@elastic/eui';
+
+export interface TextWithIconProps {
+  color?: EuiTextColorProps['color'];
+  tooltip?: React.ReactNode;
+  icon?: string;
+  iconColor?: string;
+  iconTooltip?: React.ReactNode;
+}
+
+export const TextWithIcon: React.FC<TextWithIconProps> = ({
+  color,
+  tooltip,
+  icon,
+  iconColor,
+  iconTooltip,
+  children,
+}) => {
+  return (
+    <EuiFlexGroup responsive={false} alignItems="center" gutterSize={'s'}>
+      {!!icon && (
+        <EuiFlexItem grow={false}>
+          {!!iconTooltip ? (
+            <EuiToolTip content={iconTooltip}>
+              <EuiIcon color={iconColor} type={icon} />
+            </EuiToolTip>
+          ) : (
+            <EuiIcon color={iconColor} type={icon} />
+          )}
+        </EuiFlexItem>
+      )}
+      {!!children && (
+        <EuiFlexItem grow={false} style={{ flexWrap: 'wrap' }}>
+          {tooltip ? (
+            <EuiToolTip content={tooltip}>
+              <EuiTextColor color={color}>{children}</EuiTextColor>
+            </EuiToolTip>
+          ) : (
+            <EuiTextColor color={color}>{children}</EuiTextColor>
+          )}
+        </EuiFlexItem>
+      )}
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_line_item/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_line_item/index.tsx
new file mode 100644
index 00000000000000..12a55d19d8fa13
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_line_item/index.tsx
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './trigger_line_item';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_line_item/trigger_line_item.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_line_item/trigger_line_item.tsx
new file mode 100644
index 00000000000000..c8f4ccdd2fbf33
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_line_item/trigger_line_item.tsx
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { i18n } from '@kbn/i18n';
+import { TextWithIcon } from '../text_with_icon';
+
+export const txtIncompatibleTooltip = i18n.translate(
+  'xpack.uiActionsEnhanced.components.TriggerLineItem.incompatibleTooltip',
+  {
+    defaultMessage: 'This trigger type not supported by this panel',
+  }
+);
+
+export interface TriggerLineItemProps {
+  tooltip?: React.ReactNode;
+  incompatible?: boolean;
+}
+
+export const TriggerLineItem: React.FC<TriggerLineItemProps> = ({
+  tooltip,
+  incompatible,
+  children,
+}) => {
+  return (
+    <TextWithIcon
+      color={'subdued'}
+      tooltip={tooltip}
+      icon={incompatible ? 'alert' : undefined}
+      iconColor={incompatible ? 'danger' : undefined}
+      iconTooltip={incompatible ? txtIncompatibleTooltip : undefined}
+    >
+      {children}
+    </TextWithIcon>
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/graphql/note/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts
similarity index 70%
rename from x-pack/plugins/security_solution/server/graphql/note/index.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts
index f15ab97ca76767..cdb6fbe54698df 100644
--- a/x-pack/plugins/security_solution/server/graphql/note/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts
@@ -5,5 +5,5 @@
  * 2.0.
  */
 
-export { createNoteResolvers } from './resolvers';
-export { noteSchema } from './schema.gql';
+export { TriggerPickerItemDescription } from './trigger_picker_item';
+export * from './trigger_picker';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker.stories.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker.stories.tsx
new file mode 100644
index 00000000000000..77f3eadcc0bca7
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker.stories.tsx
@@ -0,0 +1,102 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { storiesOf } from '@storybook/react';
+import { action } from '@storybook/addon-actions';
+import { TriggerPicker } from '.';
+
+const Demo: React.FC = () => {
+  const [triggers, setTriggers] = React.useState<string[]>(['RANGE_SELECT_TRIGGER']);
+
+  return (
+    <TriggerPicker
+      docs={'http://example.com'}
+      items={[
+        {
+          id: 'RANGE_SELECT_TRIGGER',
+          title: 'Range selected',
+          description: 'On chart brush.',
+        },
+        {
+          id: 'VALUE_CLICK_TRIGGER',
+          title: 'Value click',
+          description: 'On point click in chart',
+        },
+      ]}
+      selected={triggers}
+      onChange={setTriggers}
+    />
+  );
+};
+
+storiesOf('components/TriggerPicker', module)
+  .add('Default', () => {
+    return (
+      <TriggerPicker
+        items={[
+          {
+            id: 'RANGE_SELECT_TRIGGER',
+            title: 'Range selected',
+            description: 'On chart brush.',
+          },
+          {
+            id: 'VALUE_CLICK_TRIGGER',
+            title: 'Value click',
+            description: 'On point click in chart',
+          },
+        ]}
+        selected={[]}
+        onChange={action('onChange')}
+      />
+    );
+  })
+  .add('With docs', () => {
+    return (
+      <TriggerPicker
+        docs={'http://example.com'}
+        items={[
+          {
+            id: 'RANGE_SELECT_TRIGGER',
+            title: 'Range selected',
+            description: 'On chart brush.',
+          },
+          {
+            id: 'VALUE_CLICK_TRIGGER',
+            title: 'Value click',
+            description: 'On point click in chart',
+          },
+        ]}
+        selected={[]}
+        onChange={action('onChange')}
+      />
+    );
+  })
+  .add('Selected trigger', () => {
+    return (
+      <TriggerPicker
+        docs={'http://example.com'}
+        items={[
+          {
+            id: 'RANGE_SELECT_TRIGGER',
+            title: 'Range selected',
+            description: 'On chart brush.',
+          },
+          {
+            id: 'VALUE_CLICK_TRIGGER',
+            title: 'Value click',
+            description: 'On point click in chart',
+          },
+        ]}
+        selected={['VALUE_CLICK_TRIGGER']}
+        onChange={action('onChange')}
+      />
+    );
+  })
+  .add('Interactive', () => {
+    return <Demo />;
+  });
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker.tsx
new file mode 100644
index 00000000000000..728b144b4db0ef
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiText, EuiToolTip, EuiFormFieldset, EuiLink } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { TriggerPickerItemDescription, TriggerPickerItem } from './trigger_picker_item';
+
+const txtTriggerPickerLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.triggerPickerLabel',
+  {
+    defaultMessage: 'Show option on:',
+  }
+);
+
+const txtTriggerPickerHelpText = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.triggerPickerHelpText',
+  {
+    defaultMessage: "What's this?",
+  }
+);
+
+const txtTriggerPickerHelpTooltip = i18n.translate(
+  'xpack.uiActionsEnhanced.components.actionWizard.triggerPickerHelpTooltip',
+  {
+    defaultMessage: 'Determines when the drilldown appears in context menu',
+  }
+);
+
+export interface TriggerPickerProps {
+  /** List of available triggers. */
+  items: TriggerPickerItemDescription[];
+
+  /** List of IDs of selected triggers. */
+  selected?: string[];
+
+  /** Link to documentation. */
+  docs?: string;
+
+  /** Whether user interactions should be disabled. */
+  disabled?: boolean;
+
+  /** Called on trigger selection change. */
+  onChange: (selected: string[]) => void;
+}
+
+export const TriggerPicker: React.FC<TriggerPickerProps> = ({
+  items,
+  selected = [],
+  docs,
+  disabled,
+  onChange,
+}) => {
+  return (
+    <EuiFormFieldset
+      data-test-subj={`triggerPicker`}
+      legend={{
+        children: !!docs && (
+          <EuiText size="s">
+            <h5>
+              <span>{txtTriggerPickerLabel}</span>{' '}
+              <EuiToolTip content={txtTriggerPickerHelpTooltip}>
+                <EuiLink href={docs} target={'blank'} external>
+                  {txtTriggerPickerHelpText}
+                </EuiLink>
+              </EuiToolTip>
+            </h5>
+          </EuiText>
+        ),
+      }}
+      style={{ maxWidth: `80%` }}
+    >
+      {items.map((trigger) => (
+        <TriggerPickerItem
+          key={trigger.id}
+          id={trigger.id}
+          title={trigger.title}
+          description={trigger.description}
+          checked={trigger.id === selected[0]}
+          disabled={disabled}
+          onSelect={(id) => onChange([id])}
+        />
+      ))}
+    </EuiFormFieldset>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker_item.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker_item.tsx
new file mode 100644
index 00000000000000..70ab08d20f0c12
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/trigger_picker_item.tsx
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiSpacer, EuiText, EuiCheckableCard, EuiTextColor, EuiTitle } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+const txtUnknown = i18n.translate('xpack.uiActionsEnhanced.components.TriggerPickerItem.unknown', {
+  defaultMessage: 'Unknown',
+});
+
+export interface TriggerPickerItemDescription {
+  id: string;
+  title?: string;
+  description?: string;
+}
+
+export interface TriggerPickerItemProps extends TriggerPickerItemDescription {
+  /** Whether the item is selected. */
+  checked?: boolean;
+
+  /** Whether to disable user interaction. */
+  disabled?: boolean;
+
+  /** Called when item is selected by user. */
+  onSelect: (id: string) => void;
+}
+
+export const TriggerPickerItem: React.FC<TriggerPickerItemProps> = ({
+  id,
+  title = txtUnknown,
+  description,
+  checked,
+  disabled,
+  onSelect,
+}) => {
+  const descriptionFragment = !!description && (
+    <div>
+      <EuiText size={'s'}>
+        <EuiTextColor color={'subdued'}>{description}</EuiTextColor>
+      </EuiText>
+    </div>
+  );
+
+  const label = (
+    <>
+      <EuiTitle size={'xxs'}>
+        <span>{title}</span>
+      </EuiTitle>
+      {descriptionFragment}
+    </>
+  );
+
+  return (
+    <>
+      <EuiCheckableCard
+        id={id}
+        label={label}
+        name={id}
+        value={id}
+        checked={checked}
+        disabled={disabled}
+        onChange={() => onSelect(id)}
+        data-test-subj={`triggerPicker-${id}`}
+      />
+      <EuiSpacer size={'s'} />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts
similarity index 82%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/index.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts
index a9d957c9852879..4d6e5354604a1f 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/connected_flyout_manage_drilldowns/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export * from './connected_flyout_manage_drilldowns';
+export { ActionFactoryPlaceContext } from '../types';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_picker/action_factory_picker.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_picker/action_factory_picker.tsx
new file mode 100644
index 00000000000000..db9951f235dfc6
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_picker/action_factory_picker.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { ActionFactoryPicker as ActionFactoryPickerUi } from '../../../../components/action_factory_picker';
+import { useDrilldownManager } from '../context';
+import { ActionFactoryView } from '../action_factory_view';
+
+export const ActionFactoryPicker: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const factory = drilldowns.useActionFactory();
+  const context = React.useMemo(() => drilldowns.getActionFactoryContext(), [drilldowns]);
+
+  if (!!factory) {
+    return <ActionFactoryView factory={factory} context={context} />;
+  }
+
+  return (
+    <ActionFactoryPickerUi
+      actionFactories={drilldowns.deps.actionFactories}
+      context={context}
+      onSelect={(actionFactory) => {
+        drilldowns.setActionFactory(actionFactory);
+      }}
+    />
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_picker/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_picker/index.ts
new file mode 100644
index 00000000000000..3d7ffed3018595
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_picker/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './action_factory_picker';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_view/action_factory_view.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_view/action_factory_view.tsx
new file mode 100644
index 00000000000000..0a389d6f1f6158
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_view/action_factory_view.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { ActionFactory as ActionFactoryUi } from '../../components/action_factory';
+import { ActionFactory, BaseActionFactoryContext } from '../../../../dynamic_actions';
+import { useDrilldownManager } from '../context';
+
+export interface ActionFactoryViewProps {
+  factory: ActionFactory;
+  context: BaseActionFactoryContext;
+  constant?: boolean;
+}
+
+export const ActionFactoryView: React.FC<ActionFactoryViewProps> = ({
+  factory,
+  context,
+  constant,
+}) => {
+  const drilldowns = useDrilldownManager();
+  const name = React.useMemo(() => factory.getDisplayName(context), [factory, context]);
+  const icon = React.useMemo(() => factory.getIconType(context), [factory, context]);
+  const handleChange = React.useMemo(() => {
+    if (constant) return undefined;
+    return () => drilldowns.setActionFactory(undefined);
+  }, [drilldowns, constant]);
+
+  return <ActionFactoryUi name={name} icon={icon} beta={factory.isBeta} onChange={handleChange} />;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_view/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_view/index.ts
new file mode 100644
index 00000000000000..d56fb06510fff3
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/action_factory_view/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './action_factory_view';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/context/context.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/context/context.tsx
new file mode 100644
index 00000000000000..cc0434b86bdcbd
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/context/context.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { DrilldownManagerState, DrilldownManagerStateDeps } from '../../state';
+
+const context = React.createContext<DrilldownManagerState | null>(null);
+
+export const useDrilldownManager = () => React.useContext(context)!;
+
+export type DrilldownManagerProviderProps = DrilldownManagerStateDeps;
+
+export const DrilldownManagerProvider: React.FC<DrilldownManagerProviderProps> = ({
+  children,
+  ...deps
+}) => {
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  const value = React.useMemo(() => new DrilldownManagerState(deps), []);
+
+  return <context.Provider value={value}>{children}</context.Provider>;
+};
diff --git a/x-pack/plugins/security_solution/common/graphql/shared/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/context/index.ts
similarity index 89%
rename from x-pack/plugins/security_solution/common/graphql/shared/index.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/context/index.ts
index 4cf18cd629d62e..e9a2f3ab7be995 100644
--- a/x-pack/plugins/security_solution/common/graphql/shared/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/context/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export * from './schema.gql';
+export * from './context';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/create_drilldown_form/create_drilldown_form.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/create_drilldown_form/create_drilldown_form.tsx
new file mode 100644
index 00000000000000..bd4a4fd3d051bb
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/create_drilldown_form/create_drilldown_form.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { i18n } from '@kbn/i18n';
+import useMountedState from 'react-use/lib/useMountedState';
+import { DrilldownManagerTitle } from '../drilldown_manager_title';
+import { useDrilldownManager } from '../context';
+import { ActionFactoryPicker } from '../action_factory_picker';
+import { DrilldownManagerFooter } from '../drilldown_manager_footer';
+import { DrilldownStateForm } from '../drilldown_state_form';
+import { ButtonSubmit } from '../../components/button_submit';
+
+const txtCreateDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.createDrilldownForm.title',
+  {
+    defaultMessage: 'Create Drilldown',
+    description: 'Drilldowns flyout title for new drilldown form.',
+  }
+);
+
+const txtCreateDrilldownButton = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.createDrilldownForm.primaryButton',
+  {
+    defaultMessage: 'Create drilldown',
+    description: 'Primary button on new drilldown creation form.',
+  }
+);
+
+export const CreateDrilldownForm: React.FC = () => {
+  const isMounted = useMountedState();
+  const drilldowns = useDrilldownManager();
+  const drilldownState = drilldowns.getDrilldownState()!;
+  const error = drilldownState.useError();
+  const [disabled, setDisabled] = React.useState(false);
+
+  const handleCreate = () => {
+    setDisabled(true);
+    drilldowns.createDrilldown().finally(() => {
+      if (!isMounted()) return;
+      setDisabled(false);
+    });
+  };
+
+  return (
+    <>
+      <DrilldownManagerTitle>{txtCreateDrilldown}</DrilldownManagerTitle>
+      <ActionFactoryPicker />
+      {!!drilldownState && <DrilldownStateForm state={drilldownState} disabled={disabled} />}
+      {!!drilldownState && (
+        <DrilldownManagerFooter>
+          <ButtonSubmit disabled={disabled || !!error} onClick={handleCreate}>
+            {txtCreateDrilldownButton}
+          </ButtonSubmit>
+        </DrilldownManagerFooter>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/create_drilldown_form/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/create_drilldown_form/index.ts
new file mode 100644
index 00000000000000..0f5fcbca00fe0e
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/create_drilldown_form/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './create_drilldown_form';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/cloning_notification.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/cloning_notification.tsx
new file mode 100644
index 00000000000000..3c292fcb49ff3a
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/cloning_notification.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCallOut, EuiSpacer, EuiLink } from '@elastic/eui';
+import * as React from 'react';
+import { i18n } from '@kbn/i18n';
+
+const txtDismiss = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.drilldownList.copyingNotification.dismiss',
+  {
+    defaultMessage: 'Dismiss',
+    description: 'Dismiss button in cloning notification callout.',
+  }
+);
+
+const txtBody = (count: number) =>
+  i18n.translate(
+    'xpack.uiActionsEnhanced.drilldowns.containers.drilldownList.copyingNotification.body',
+    {
+      defaultMessage: '{count, number} {count, plural, one {drilldown} other {drilldowns}} copied.',
+      description: 'Title of notification show when one or more drilldowns were copied.',
+      values: {
+        count,
+      },
+    }
+  );
+
+export interface CloningNotificationProps {
+  count?: number;
+}
+
+export const CloningNotification: React.FC<CloningNotificationProps> = ({ count = 1 }) => {
+  const [dismissed, setDismissed] = React.useState(false);
+
+  if (dismissed) return null;
+
+  const title = (
+    <>
+      {txtBody(count)} <EuiLink onClick={() => setDismissed(true)}>{txtDismiss}</EuiLink>
+    </>
+  );
+
+  return (
+    <>
+      <EuiCallOut title={title} color="success" size="s" iconType="check" />
+      <EuiSpacer />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/drilldown_list.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/drilldown_list.tsx
new file mode 100644
index 00000000000000..41f062ae873278
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/drilldown_list.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { DrilldownTable } from '../../components/drilldown_table';
+import { useDrilldownManager } from '../context';
+import { CloningNotification } from './cloning_notification';
+
+const FIVE_SECONDS = 5e3;
+
+export const DrilldownList: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const events = drilldowns.useEvents();
+  const cloningNotificationCount = React.useMemo<number>(
+    () =>
+      !!drilldowns.lastCloneRecord && drilldowns.lastCloneRecord.time > Date.now() - FIVE_SECONDS
+        ? drilldowns.lastCloneRecord.templateIds.length
+        : 0,
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    []
+  );
+  React.useEffect(() => {
+    drilldowns.lastCloneRecord = null;
+  });
+
+  const notification = !!cloningNotificationCount && (
+    <CloningNotification count={cloningNotificationCount} />
+  );
+
+  return (
+    <>
+      {notification}
+      <DrilldownTable
+        items={events}
+        onDelete={drilldowns.onDelete}
+        onEdit={(id) => {
+          drilldowns.setRoute(['manage', id]);
+        }}
+        onCopy={drilldowns.onCreateFromDrilldown}
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/index.ts
new file mode 100644
index 00000000000000..40e01173d1cca2
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_list/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_list';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/create_public_drilldown_manager.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/create_public_drilldown_manager.tsx
new file mode 100644
index 00000000000000..6b7d8a7a193606
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/create_public_drilldown_manager.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { DrilldownManagerDependencies, PublicDrilldownManagerProps } from '../../types';
+import { DrilldownManagerProvider } from '../context';
+import { DrilldownManager } from './drilldown_manager';
+
+export type PublicDrilldownManagerComponent = React.FC<PublicDrilldownManagerProps>;
+
+/**
+ * This HOC creates a "public" `<DrilldownManager>` component `PublicDrilldownManagerComponent`,
+ * which can be exported from plugin contract for other plugins to consume.
+ */
+export const createPublicDrilldownManager = (
+  dependencies: DrilldownManagerDependencies
+): PublicDrilldownManagerComponent => {
+  const PublicDrilldownManager: PublicDrilldownManagerComponent = (drilldownManagerProps) => {
+    return (
+      <DrilldownManagerProvider {...dependencies} {...drilldownManagerProps}>
+        <DrilldownManager />
+      </DrilldownManagerProvider>
+    );
+  };
+
+  return PublicDrilldownManager;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/drilldown_manager.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/drilldown_manager.tsx
new file mode 100644
index 00000000000000..a09411a14d83f6
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/drilldown_manager.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { useDrilldownManager } from '../context';
+import { FlyoutFrame } from '../../components/flyout_frame';
+import { DrilldownManagerContent } from './drilldown_manager_content';
+import { RenderDrilldownManagerTitle } from '../drilldown_manager_title';
+import { RenderDrilldownManagerFooter } from '../drilldown_manager_footer';
+import { HelloBar } from '../hello_bar';
+
+export const DrilldownManager: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const route = drilldowns.useRoute();
+
+  const handleBack =
+    route.length < 2 ? undefined : () => drilldowns.setRoute(route.slice(0, route.length - 1));
+
+  return (
+    <FlyoutFrame
+      title={<RenderDrilldownManagerTitle />}
+      banner={<HelloBar />}
+      footer={<RenderDrilldownManagerFooter />}
+      onClose={drilldowns.close}
+      onBack={handleBack}
+    >
+      <DrilldownManagerContent />
+    </FlyoutFrame>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/drilldown_manager_content.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/drilldown_manager_content.tsx
new file mode 100644
index 00000000000000..a0a7d94080ea00
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/drilldown_manager_content.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { CreateDrilldownForm } from '../create_drilldown_form';
+import { Tabs } from '../tabs';
+import { useDrilldownManager } from '../context';
+import { EditDrilldownForm } from '../edit_drilldown_form';
+
+export const DrilldownManagerContent: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const route = drilldowns.useRoute();
+
+  if (route[0] === 'new' && !!route[1]) return <CreateDrilldownForm />;
+  if (route[0] === 'manage' && !!route[1]) return <EditDrilldownForm eventId={route[1]} />;
+
+  return <Tabs />;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/index.ts
new file mode 100644
index 00000000000000..fd2b7adf3e4bc7
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_manager';
+export * from './create_public_drilldown_manager';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_footer/drilldown_manager_footer.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_footer/drilldown_manager_footer.tsx
new file mode 100644
index 00000000000000..5cd5c712a1493f
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_footer/drilldown_manager_footer.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { useDrilldownManager } from '../context';
+
+export const DrilldownManagerFooter: React.FC = ({ children }) => {
+  const drilldowns = useDrilldownManager();
+  React.useEffect(() => {
+    drilldowns.setFooter(children);
+    return () => {
+      drilldowns.setFooter(null);
+    };
+  });
+  return null;
+};
+
+export const RenderDrilldownManagerFooter: React.FC = () => {
+  const drilldowns = useDrilldownManager();
+  const footer = drilldowns.useFooter();
+  return <>{footer}</>;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_footer/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_footer/index.ts
new file mode 100644
index 00000000000000..61e6d642515c88
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_footer/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_manager_footer';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_title/drilldown_manager_title.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_title/drilldown_manager_title.tsx
new file mode 100644
index 00000000000000..63a02f65df9395
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_title/drilldown_manager_title.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { useDrilldownManager } from '../context';
+
+export const DrilldownManagerTitle: React.FC = ({ children }) => {
+  const drilldowns = useDrilldownManager();
+  React.useEffect(() => {
+    drilldowns.setTitle(children);
+    return () => {
+      drilldowns.resetTitle();
+    };
+  });
+  return null;
+};
+
+export const RenderDrilldownManagerTitle: React.FC = () => {
+  const drilldowns = useDrilldownManager();
+  const title = drilldowns.useTitle();
+  return <>{title}</>;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_title/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_title/index.ts
new file mode 100644
index 00000000000000..8e015bd7bca06d
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_manager_title/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_manager_title';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_state_form/drilldown_state_form.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_state_form/drilldown_state_form.tsx
new file mode 100644
index 00000000000000..44b9cf60916fb0
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_state_form/drilldown_state_form.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { useDrilldownManager } from '../context';
+import { DrilldownForm } from '../../components/drilldown_form';
+import type { DrilldownState } from '../../state';
+import type { TriggerPickerProps } from '../../components/trigger_picker';
+
+export interface DrilldownStateFormProps {
+  state: DrilldownState;
+  disabled?: boolean;
+}
+
+export const DrilldownStateForm: React.FC<DrilldownStateFormProps> = ({ state, disabled }) => {
+  const drilldowns = useDrilldownManager();
+  const name = state.useName();
+  const triggers = state.useTriggers();
+  const config = state.useConfig();
+  const triggerPickerProps: TriggerPickerProps = React.useMemo(
+    () => ({
+      items: state.uiTriggers.map((id) => {
+        const trigger = drilldowns.deps.getTrigger(id);
+        return trigger;
+      }),
+      selected: triggers,
+      onChange: state.setTriggers,
+    }),
+    [drilldowns, triggers, state]
+  );
+  const context = state.getFactoryContext();
+
+  return (
+    <DrilldownForm
+      name={name}
+      onNameChange={state.setName}
+      triggers={triggerPickerProps}
+      disabled={disabled}
+    >
+      <state.factory.ReactCollectConfig
+        config={config}
+        onConfig={disabled ? () => {} : state.setConfig}
+        context={context}
+      />
+    </DrilldownForm>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_state_form/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_state_form/index.ts
new file mode 100644
index 00000000000000..e06cb66ff99bc3
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/drilldown_state_form/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_state_form';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/edit_drilldown_form/edit_drilldown_form.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/edit_drilldown_form/edit_drilldown_form.tsx
new file mode 100644
index 00000000000000..421547c8210ddd
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/edit_drilldown_form/edit_drilldown_form.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { i18n } from '@kbn/i18n';
+import useMountedState from 'react-use/lib/useMountedState';
+import { DrilldownManagerTitle } from '../drilldown_manager_title';
+import { useDrilldownManager } from '../context';
+import { ActionFactoryView } from '../action_factory_view';
+import { DrilldownManagerFooter } from '../drilldown_manager_footer';
+import { DrilldownStateForm } from '../drilldown_state_form';
+import { ButtonSubmit } from '../../components/button_submit';
+
+const txtEditDrilldown = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.editDrilldownForm.title',
+  {
+    defaultMessage: 'Edit Drilldown',
+    description: 'Drilldowns flyout title for edit drilldown form.',
+  }
+);
+
+const txtEditDrilldownButton = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.editDrilldownForm.primaryButton',
+  {
+    defaultMessage: 'Save',
+    description: 'Primary button on new drilldown edit form.',
+  }
+);
+
+export interface EditDrilldownFormProps {
+  eventId: string;
+}
+
+export const EditDrilldownForm: React.FC<EditDrilldownFormProps> = ({ eventId }) => {
+  const isMounted = useMountedState();
+  const drilldowns = useDrilldownManager();
+  const drilldownState = React.useMemo(() => drilldowns.createEventDrilldownState(eventId), [
+    drilldowns,
+    eventId,
+  ]);
+  const [disabled, setDisabled] = React.useState(false);
+
+  if (!drilldownState) return null;
+
+  const handleSave = () => {
+    setDisabled(true);
+    drilldowns.updateEvent(eventId, drilldownState).finally(() => {
+      if (!isMounted()) return;
+      setDisabled(false);
+    });
+  };
+
+  return (
+    <>
+      <DrilldownManagerTitle>{txtEditDrilldown}</DrilldownManagerTitle>
+      <ActionFactoryView
+        constant
+        factory={drilldownState.factory}
+        context={drilldownState.getFactoryContext()}
+      />
+      {!!drilldownState && <DrilldownStateForm state={drilldownState} disabled={disabled} />}
+      {!!drilldownState && (
+        <DrilldownManagerFooter>
+          <ButtonSubmit disabled={disabled} onClick={handleSave}>
+            {txtEditDrilldownButton}
+          </ButtonSubmit>
+        </DrilldownManagerFooter>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/edit_drilldown_form/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/edit_drilldown_form/index.ts
new file mode 100644
index 00000000000000..ec10df49a727de
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/edit_drilldown_form/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './edit_drilldown_form';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/create_drilldown_form.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/create_drilldown_form.tsx
new file mode 100644
index 00000000000000..3382a5dd82fbb4
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/create_drilldown_form.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { useDrilldownManager } from '../context';
+import { DrilldownForm } from '../../components/drilldown_form';
+import { DrilldownState } from '../../state';
+import { TriggerPickerProps } from '../../components/trigger_picker';
+
+export interface CreateDrilldownFormProps {
+  state: DrilldownState;
+}
+
+export const CreateDrilldownForm: React.FC<CreateDrilldownFormProps> = ({ state }) => {
+  const drilldowns = useDrilldownManager();
+  const name = state.useName();
+  const triggers = state.useTriggers();
+  const config = state.useConfig();
+  const triggerPickerProps: TriggerPickerProps = React.useMemo(
+    () => ({
+      items: state.uiTriggers.map((id) => {
+        const trigger = drilldowns.deps.getTrigger(id);
+        return trigger;
+      }),
+      selected: triggers,
+      onChange: state.setTriggers,
+    }),
+    [drilldowns, triggers, state]
+  );
+  const context = state.getFactoryContext();
+
+  return (
+    <DrilldownForm name={name} onNameChange={state.setName} triggers={triggerPickerProps}>
+      <state.factory.ReactCollectConfig
+        config={config}
+        onConfig={state.setConfig}
+        context={context}
+      />
+    </DrilldownForm>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/edit_drilldown_form.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/edit_drilldown_form.tsx
new file mode 100644
index 00000000000000..1ee8291b307749
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/edit_drilldown_form.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiButton, EuiSpacer } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { useDrilldownManager } from '../context';
+import { DrilldownForm } from '../../components/drilldown_form';
+import { DrilldownState } from '../../state';
+import { TriggerPickerProps } from '../../components/trigger_picker';
+
+export const txtDeleteDrilldownButtonLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.deleteDrilldownButtonLabel',
+  {
+    defaultMessage: 'Delete drilldown',
+  }
+);
+
+export interface EditDrilldownFormProps {
+  state: DrilldownState;
+}
+
+export const EditDrilldownForm: React.FC<EditDrilldownFormProps> = ({ state }) => {
+  const drilldowns = useDrilldownManager();
+  const name = state.useName();
+  const triggers = state.useTriggers();
+  const config = state.useConfig();
+  const triggerPickerProps: TriggerPickerProps = React.useMemo(
+    () => ({
+      items: state.uiTriggers.map((id) => {
+        const trigger = drilldowns.deps.getTrigger(id);
+        return trigger;
+      }),
+      selected: triggers,
+      onChange: state.setTriggers,
+    }),
+    [drilldowns, triggers, state]
+  );
+  const context = state.getFactoryContext();
+
+  return (
+    <>
+      <DrilldownForm name={name} onNameChange={state.setName} triggers={triggerPickerProps}>
+        <state.factory.ReactCollectConfig
+          config={config}
+          onConfig={state.setConfig}
+          context={context}
+        />
+      </DrilldownForm>
+      <EuiSpacer size={'xl'} />
+      <EuiButton
+        onClick={() => {
+          alert('DELETE!');
+        }}
+        color={'danger'}
+      >
+        {txtDeleteDrilldownButtonLabel}
+      </EuiButton>
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/form_drilldown_wizard.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/form_drilldown_wizard.tsx
new file mode 100644
index 00000000000000..ddb08ee4071184
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/form_drilldown_wizard.tsx
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { ActionFactoryPicker } from '../action_factory_picker';
+import { useDrilldownManager } from '../context';
+import { CreateDrilldownForm } from './create_drilldown_form';
+
+export const FormDrilldownWizard: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const actionFactory = drilldowns.useActionFactory();
+
+  const drilldownState = drilldowns.getDrilldownState();
+  let content: React.ReactNode = null;
+
+  if (!actionFactory) content = null;
+  if (drilldownState) content = <CreateDrilldownForm state={drilldownState} />;
+
+  return (
+    <>
+      <ActionFactoryPicker />
+      {content}
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/i18n.ts
similarity index 68%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/i18n.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/i18n.ts
index 36f3ee6cc23933..28ebe53e05f876 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_drilldown_wizard/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/i18n.ts
@@ -21,20 +21,6 @@ export const txtEditDrilldownTitle = i18n.translate(
   }
 );
 
-export const txtCreateDrilldownButtonLabel = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.createDrilldownButtonLabel',
-  {
-    defaultMessage: 'Create drilldown',
-  }
-);
-
-export const txtEditDrilldownButtonLabel = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.editDrilldownButtonLabel',
-  {
-    defaultMessage: 'Save',
-  }
-);
-
 export const txtDeleteDrilldownButtonLabel = i18n.translate(
   'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.deleteDrilldownButtonLabel',
   {
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/index.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/index.ts
similarity index 100%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/form_drilldown_wizard/index.tsx
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/form_drilldown_wizard/index.ts
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/hello_bar/hello_bar.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/hello_bar/hello_bar.tsx
new file mode 100644
index 00000000000000..08fbcb4ad24210
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/hello_bar/hello_bar.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { useDrilldownManager } from '../context';
+import { DrilldownHelloBar } from '../../components/drilldown_hello_bar';
+
+export const HelloBar: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const hideWelcomeMessage = drilldowns.useWelcomeMessage();
+
+  if (hideWelcomeMessage) return null;
+
+  return (
+    <DrilldownHelloBar
+      docsLink={drilldowns.deps.docsLink}
+      onHideClick={drilldowns.hideWelcomeMessage}
+    />
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/hello_bar/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/hello_bar/index.ts
new file mode 100644
index 00000000000000..54c7f1a8b131b2
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/hello_bar/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './hello_bar';
diff --git a/x-pack/plugins/security_solution/server/graphql/scalar_date/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts
similarity index 71%
rename from x-pack/plugins/security_solution/server/graphql/scalar_date/index.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts
index 6e3fb5adbb6871..85ee5863674066 100644
--- a/x-pack/plugins/security_solution/server/graphql/scalar_date/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts
@@ -5,5 +5,4 @@
  * 2.0.
  */
 
-export { createScalarDateResolvers } from './resolvers';
-export { dateSchema } from './schema.gql';
+export { createPublicDrilldownManager, PublicDrilldownManagerComponent } from './drilldown_manager';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/tabs/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/tabs/index.ts
new file mode 100644
index 00000000000000..dde0170c6f13bb
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/tabs/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './tabs';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/tabs/tabs.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/tabs/tabs.tsx
new file mode 100644
index 00000000000000..c8514d91a343b6
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/tabs/tabs.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { EuiSpacer, EuiTabbedContent, EuiTabbedContentProps } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { useDrilldownManager } from '../context';
+import { FormDrilldownWizard } from '../form_drilldown_wizard';
+import { DrilldownList } from '../drilldown_list';
+import { TemplatePicker } from '../template_picker';
+
+export const txtCreateNew = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.DrilldownManager.createNew',
+  {
+    defaultMessage: 'Create new',
+  }
+);
+
+export const txtManage = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.containers.DrilldownManager.manage',
+  {
+    defaultMessage: 'Manage',
+  }
+);
+
+const tabs: EuiTabbedContentProps['tabs'] = [
+  {
+    id: 'create',
+    name: txtCreateNew,
+    content: (
+      <>
+        <EuiSpacer />
+        <FormDrilldownWizard />
+        <EuiSpacer size={'l'} />
+        <TemplatePicker />
+      </>
+    ),
+  },
+  {
+    id: 'manage',
+    name: txtManage,
+    content: (
+      <>
+        <EuiSpacer />
+        <DrilldownList />
+      </>
+    ),
+  },
+];
+
+export const Tabs: React.FC = ({}) => {
+  const drilldowns = useDrilldownManager();
+  const route = drilldowns.useRoute();
+
+  return (
+    <EuiTabbedContent
+      tabs={tabs}
+      selectedTab={tabs.find(({ id }) => id === route[0])}
+      onTabClick={({ id }) => drilldowns.setRoute([id])}
+    />
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/i18n.ts
similarity index 57%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/i18n.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/i18n.ts
index b6139d02fe5080..e947e246081d59 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/components/flyout_list_manage_drilldowns/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/i18n.ts
@@ -7,9 +7,10 @@
 
 import { i18n } from '@kbn/i18n';
 
-export const txtManageDrilldowns = i18n.translate(
-  'xpack.uiActionsEnhanced.drilldowns.components.FlyoutListManageDrilldowns.manageDrilldownsTitle',
+export const txtLabel = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldownManager.containers.TemplatePicker.label',
   {
-    defaultMessage: 'Manage Drilldowns',
+    defaultMessage: 'Copy existing drilldown',
+    description: 'Label above template picker table.',
   }
 );
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/index.ts
new file mode 100644
index 00000000000000..98b9cf637cf9ec
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './template_picker';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/template_list.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/template_list.tsx
new file mode 100644
index 00000000000000..85422370e88c2e
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/template_list.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiTitle, EuiSpacer } from '@elastic/eui';
+import * as React from 'react';
+import {
+  DrilldownTemplateTable,
+  DrilldownTemplateTableItem,
+} from '../../components/drilldown_template_table';
+import { DrilldownTemplate } from '../../types';
+import { useDrilldownManager } from '../context';
+import { txtLabel } from './i18n';
+
+export interface TemplateListProps {
+  items: DrilldownTemplate[];
+}
+
+export const TemplateList: React.FC<TemplateListProps> = ({ items }) => {
+  const drilldowns = useDrilldownManager();
+  const tableItems: DrilldownTemplateTableItem[] = React.useMemo<
+    DrilldownTemplateTableItem[]
+  >(() => {
+    return items.map((item) => {
+      const factory = drilldowns.deps.actionFactories.find(({ id }) => id === item.factoryId);
+      const trigger = drilldowns.deps.getTrigger(item.triggers[0]);
+      const tableItem: DrilldownTemplateTableItem = {
+        id: item.id,
+        name: item.name,
+        icon: item.icon,
+        description: item.description,
+        triggerIncompatible: !drilldowns.deps.triggers.find((t) => t === trigger.id),
+      };
+
+      if (factory) {
+        const context = drilldowns.getActionFactoryContext();
+        tableItem.actionName = factory.getDisplayName(context);
+        tableItem.actionIcon = factory.getIconType(context);
+      }
+      if (trigger) {
+        tableItem.trigger = trigger.title;
+      }
+      return tableItem;
+    });
+  }, [drilldowns, items]);
+
+  return (
+    <>
+      <EuiTitle size="xs">
+        <h4>{txtLabel}</h4>
+      </EuiTitle>
+      <EuiSpacer size={'s'} />
+      <DrilldownTemplateTable
+        items={tableItems}
+        onCreate={drilldowns.onCreateFromTemplate}
+        onClone={drilldowns.onClone}
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/template_picker.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/template_picker.tsx
new file mode 100644
index 00000000000000..d6004e71ec60a9
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/template_picker/template_picker.tsx
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as React from 'react';
+import { useDrilldownManager } from '../context';
+import { TemplateList } from './template_list';
+
+export const TemplatePicker: React.FC = () => {
+  const drilldowns = useDrilldownManager();
+
+  const { templates } = drilldowns.deps;
+
+  if (!templates || !templates.length) return null;
+
+  return <TemplateList items={templates} />;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/hooks/use_sync_observable.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/hooks/use_sync_observable.ts
new file mode 100644
index 00000000000000..d5c7bda0377f95
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/hooks/use_sync_observable.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useRef, useMemo } from 'react';
+import { Observable, Subscription } from 'rxjs';
+import useIsomorphicLayoutEffect from 'react-use/lib/useIsomorphicLayoutEffect';
+import useUpdate from 'react-use/lib/useUpdate';
+
+export const useSyncObservable = <T>(observable: Observable<T>): T => {
+  const firstRef = useRef<boolean>(true);
+  const valueRef = useRef<T>();
+  const update = useUpdate();
+  const subscriptionRef = useRef<Subscription | undefined>(undefined);
+  subscriptionRef.current = useMemo(() => {
+    if (subscriptionRef.current) {
+      subscriptionRef.current.unsubscribe();
+      subscriptionRef.current = undefined;
+      firstRef.current = true;
+    }
+    return observable.subscribe((value) => {
+      valueRef.current = value;
+      if (firstRef.current) firstRef.current = false;
+      update();
+    });
+  }, [observable, update]);
+  useIsomorphicLayoutEffect(
+    () => () => {
+      if (subscriptionRef.current) {
+        subscriptionRef.current.unsubscribe();
+      }
+    },
+    []
+  );
+  return valueRef.current!;
+};
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/index.ts
new file mode 100644
index 00000000000000..b00fcf5f339592
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './types';
+export * from './containers';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.test.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.test.tsx
new file mode 100644
index 00000000000000..5d0642ec80ced2
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.test.tsx
@@ -0,0 +1,319 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ActionFactory, MemoryActionStorage } from '../../../dynamic_actions';
+import { DrilldownManagerState, DrilldownManagerStateDeps } from './drilldown_manager_state';
+import { DynamicActionManager } from '../../../dynamic_actions/dynamic_action_manager';
+import { uiActionsEnhancedPluginMock } from '../../../mocks';
+import { Trigger } from 'src/plugins/ui_actions/public';
+import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
+import { notificationServiceMock } from 'src/core/public/mocks';
+import { DrilldownState } from './drilldown_state';
+
+class StorageWrapperMock implements IStorageWrapper {
+  public _data = new Map<string, unknown>();
+
+  get = (key: string) => {
+    if (!this._data.has(key)) return null;
+    return this._data.get(key);
+  };
+
+  set = (key: string, value: unknown) => {
+    this._data.set(key, value);
+  };
+
+  remove = (key: string) => {
+    this._data.delete(key);
+  };
+
+  clear = () => {};
+}
+
+const createDrilldownManagerState = () => {
+  const factory1 = new ActionFactory(
+    {
+      id: 'FACTORY1',
+      CollectConfig: () => ({ render: () => {} }),
+      supportedTriggers: () => ['TRIGGER1', 'TRIGGER2'],
+      isConfigValid: () => true,
+      createConfig: () => ({}),
+      create: () => ({
+        id: 'FACTOR1_ACTION',
+        execute: async () => {},
+      }),
+    },
+    {}
+  );
+  const factory2 = new ActionFactory(
+    {
+      id: 'FACTORY2',
+      CollectConfig: () => ({ render: () => {} }),
+      supportedTriggers: () => ['TRIGGER2', 'TRIGGER3'],
+      isConfigValid: () => true,
+      createConfig: () => ({}),
+      create: () => ({
+        id: 'FACTOR2_ACTION',
+        execute: async () => {},
+      }),
+    },
+    {}
+  );
+  const factory3 = new ActionFactory(
+    {
+      id: 'FACTORY3',
+      CollectConfig: () => ({ render: () => {} }),
+      supportedTriggers: () => ['TRIGGER_MISSING'],
+      isConfigValid: () => true,
+      createConfig: () => ({}),
+      create: () => ({
+        id: 'FACTOR3_ACTION',
+        execute: async () => {},
+      }),
+    },
+    {}
+  );
+  const trigger1: Trigger = {
+    id: 'TRIGGER1',
+  };
+  const trigger2: Trigger = {
+    id: 'TRIGGER2',
+  };
+  const trigger3: Trigger = {
+    id: 'TRIGGER3',
+  };
+  const uiActions = uiActionsEnhancedPluginMock.createPlugin();
+  const uiActionsStart = uiActions.doStart();
+  (uiActionsStart as any).attachAction = () => {};
+  (uiActionsStart as any).detachAction = () => {};
+  (uiActionsStart as any).hasActionFactory = (actionFactoryId: string): boolean => {
+    switch (actionFactoryId) {
+      case 'FACTORY1':
+      case 'FACTORY2':
+      case 'FACTORY3':
+        return true;
+    }
+    return false;
+  };
+  (uiActionsStart as any).getActionFactory = (actionFactoryId: string): ActionFactory => {
+    switch (actionFactoryId) {
+      case 'FACTORY1':
+        return factory1;
+      case 'FACTORY2':
+        return factory2;
+      case 'FACTORY3':
+        return factory3;
+    }
+    throw new Error('Action factory not found.');
+  };
+  const dynamicActionManager = new DynamicActionManager({
+    storage: new MemoryActionStorage(),
+    isCompatible: async () => true,
+    uiActions: uiActionsStart,
+  });
+  const storage = new StorageWrapperMock();
+  const toastService = notificationServiceMock.createStartContract().toasts;
+  const deps: DrilldownManagerStateDeps = {
+    actionFactories: [factory1, factory2, factory3],
+    dynamicActionManager,
+    getTrigger: (triggerId: string): Trigger => {
+      if (triggerId === trigger1.id) return trigger1;
+      if (triggerId === trigger2.id) return trigger2;
+      if (triggerId === trigger3.id) return trigger3;
+      throw new Error('Trigger not found');
+    },
+    onClose: () => {},
+    storage,
+    toastService,
+    triggers: ['TRIGGER2', 'TRIGGER3'],
+  };
+  const state = new DrilldownManagerState(deps);
+
+  return {
+    state,
+    deps,
+    factory1,
+    factory2,
+    factory3,
+    trigger1,
+    trigger2,
+    trigger3,
+    uiActionsStart,
+    dynamicActionManager,
+    storage,
+  };
+};
+
+test('can select action factory', () => {
+  const { state, factory1, factory2 } = createDrilldownManagerState();
+  expect(state.actionFactory$.getValue()).toBe(undefined);
+  state.setActionFactory(factory1);
+  expect(state.actionFactory$.getValue()!.id).toBe(factory1.id);
+  state.setActionFactory(factory2);
+  expect(state.actionFactory$.getValue()!.id).toBe(factory2.id);
+});
+
+test('can edit drilldown draft once action factory is selected', () => {
+  const { state, factory1 } = createDrilldownManagerState();
+  expect(state.getDrilldownState()).toBe(undefined);
+  state.setActionFactory(factory1);
+  expect(state.getDrilldownState()).toBeInstanceOf(DrilldownState);
+  const drilldownState = state.getDrilldownState()!;
+  expect(drilldownState.factory).toBe(factory1);
+  expect(drilldownState.name$.getValue()).toBe('');
+  drilldownState.setName('My name');
+  expect(drilldownState.name$.getValue()).toBe('My name');
+});
+
+test('selects intersection of triggers for a drilldown', () => {
+  const { state, factory1, factory2 } = createDrilldownManagerState();
+  state.setActionFactory(factory1);
+  expect(state.getDrilldownState()!.uiTriggers).toEqual(['TRIGGER2']);
+  state.setActionFactory(factory2);
+  expect(state.getDrilldownState()!.uiTriggers).toEqual(['TRIGGER2', 'TRIGGER3']);
+});
+
+test('when drilldown has only one possible trigger, that trigger is automatically selected', () => {
+  const { state, factory1 } = createDrilldownManagerState();
+  state.setActionFactory(factory1);
+  const drilldownState = state.getDrilldownState()!;
+  expect(drilldownState.uiTriggers).toEqual(['TRIGGER2']);
+  expect(drilldownState.triggers$.getValue()).toEqual(['TRIGGER2']);
+});
+
+test('when drilldown has more than one possible trigger, the trigger should be selected', () => {
+  const { state, factory2 } = createDrilldownManagerState();
+  state.setActionFactory(factory2);
+  const drilldownState = state.getDrilldownState()!;
+  expect(drilldownState.uiTriggers).toEqual(['TRIGGER2', 'TRIGGER3']);
+  expect(drilldownState.triggers$.getValue()).toEqual([]);
+  drilldownState.setTriggers(['TRIGGER3']);
+  expect(drilldownState.triggers$.getValue()).toEqual(['TRIGGER3']);
+});
+
+test('can change drilldown config', () => {
+  const { state, factory2 } = createDrilldownManagerState();
+  state.setActionFactory(factory2);
+  const drilldownState = state.getDrilldownState()!;
+  expect(drilldownState.config$.getValue()).toEqual({});
+  drilldownState.setConfig({ foo: 'bar' });
+  expect(drilldownState.config$.getValue()).toEqual({ foo: 'bar' });
+});
+
+test('can create a drilldown', async () => {
+  const { state, factory2 } = createDrilldownManagerState();
+  state.setActionFactory(factory2);
+  const drilldownState = state.getDrilldownState()!;
+  drilldownState.setName('my drill');
+  drilldownState.setTriggers(['TRIGGER3']);
+  drilldownState.setConfig({ foo: 'bar' });
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(0);
+  await state.createDrilldown();
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(1);
+  expect(state.deps.dynamicActionManager.state.get().events[0]).toEqual({
+    eventId: expect.any(String),
+    triggers: ['TRIGGER3'],
+    action: {
+      factoryId: 'FACTORY2',
+      name: 'my drill',
+      config: { foo: 'bar' },
+    },
+  });
+});
+
+test('can delete delete a drilldown', async () => {
+  const { state, factory2 } = createDrilldownManagerState();
+  state.setActionFactory(factory2);
+  const drilldownState = state.getDrilldownState()!;
+  drilldownState.setName('my drill');
+  drilldownState.setTriggers(['TRIGGER3']);
+  drilldownState.setConfig({ foo: 'bar' });
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(0);
+  await state.createDrilldown();
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(1);
+  const eventId = state.deps.dynamicActionManager.state.get().events[0].eventId;
+  await state.onDelete([eventId]);
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(0);
+});
+
+test('can delete multiple drilldowns', async () => {
+  const { state, factory1, factory2 } = createDrilldownManagerState();
+
+  state.setActionFactory(factory2);
+  const drilldownState1 = state.getDrilldownState()!;
+  drilldownState1.setName('my drill 1');
+  drilldownState1.setTriggers(['TRIGGER3']);
+  drilldownState1.setConfig({ foo: 'bar-1' });
+  await state.createDrilldown();
+
+  state.setActionFactory(factory2);
+  const drilldownState2 = state.getDrilldownState()!;
+  drilldownState2.setName('my drill 2');
+  drilldownState2.setTriggers(['TRIGGER2']);
+  drilldownState2.setConfig({ foo: 'bar-2' });
+  await state.createDrilldown();
+
+  state.setActionFactory(factory1);
+  const drilldownState3 = state.getDrilldownState()!;
+  drilldownState3.setName('my drill 0');
+  drilldownState3.setTriggers(['TRIGGER2']);
+  drilldownState3.setConfig({ foo: 'bar-3' });
+  await state.createDrilldown();
+
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(3);
+  const id1 = state.deps.dynamicActionManager.state.get().events[0].eventId;
+  const id2 = state.deps.dynamicActionManager.state.get().events[1].eventId;
+  const id3 = state.deps.dynamicActionManager.state.get().events[2].eventId;
+  await state.onDelete([id1, id3]);
+  expect(state.deps.dynamicActionManager.state.get().events.length).toBe(1);
+  expect(state.deps.dynamicActionManager.state.get().events[0]).toEqual({
+    eventId: id2,
+    triggers: ['TRIGGER2'],
+    action: {
+      factoryId: 'FACTORY2',
+      name: 'my drill 2',
+      config: { foo: 'bar-2' },
+    },
+  });
+});
+
+test('after switching between action factories state is restored', async () => {
+  const { state, factory1, factory2 } = createDrilldownManagerState();
+
+  state.setActionFactory(factory2);
+  const drilldownState1 = state.getDrilldownState()!;
+  drilldownState1.setName('my drill 1');
+  drilldownState1.setTriggers(['TRIGGER3']);
+  drilldownState1.setConfig({ foo: 'bar-1' });
+
+  state.setActionFactory(factory1);
+  const drilldownState2 = state.getDrilldownState()!;
+  drilldownState2.setName('my drill 2');
+  drilldownState2.setTriggers(['TRIGGER2']);
+  drilldownState2.setConfig({ foo: 'bar-2' });
+
+  state.setActionFactory(factory2);
+  const drilldownState3 = state.getDrilldownState()!;
+  expect(drilldownState3.name$.getValue()).toBe('my drill 1');
+  expect(drilldownState3.triggers$.getValue()).toEqual(['TRIGGER3']);
+  expect(drilldownState3.config$.getValue()).toEqual({ foo: 'bar-1' });
+});
+
+describe('welcome message', () => {
+  test('should show welcome message by default', async () => {
+    const { state } = createDrilldownManagerState();
+    expect(state.hideWelcomeMessage$.getValue()).toBe(false);
+  });
+
+  test('can hide welcome message', async () => {
+    const { state, storage } = createDrilldownManagerState();
+    state.hideWelcomeMessage();
+    expect(state.hideWelcomeMessage$.getValue()).toBe(true);
+    expect(storage.get('drilldowns:hidWelcomeMessage')).toBe(true);
+  });
+});
+
+test.todo('drilldown type is not shown if no supported triggers can be picked');
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts
new file mode 100644
index 00000000000000..0e374010139f0d
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts
@@ -0,0 +1,481 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import useObservable from 'react-use/lib/useObservable';
+import { BehaviorSubject } from 'rxjs';
+import { map } from 'rxjs/operators';
+import { SerializableState } from 'src/plugins/kibana_utils/common';
+import {
+  PublicDrilldownManagerProps,
+  DrilldownManagerDependencies,
+  DrilldownTemplate,
+} from '../types';
+import {
+  ActionFactory,
+  BaseActionFactoryContext,
+  SerializedAction,
+  SerializedEvent,
+} from '../../../dynamic_actions';
+import { DrilldownState } from './drilldown_state';
+import {
+  toastDrilldownCreated,
+  toastDrilldownsCRUDError,
+  insufficientLicenseLevel,
+  invalidDrilldownType,
+  txtDefaultTitle,
+  toastDrilldownDeleted,
+  toastDrilldownsDeleted,
+  toastDrilldownEdited,
+} from './i18n';
+import { DrilldownTableItem } from '../components/drilldown_table';
+
+const helloMessageStorageKey = `drilldowns:hidWelcomeMessage`;
+
+export interface DrilldownManagerStateDeps
+  extends DrilldownManagerDependencies,
+    PublicDrilldownManagerProps {}
+
+/**
+ * An instance of this class holds all the state necessary for Drilldown
+ * Manager. It also holds all the necessary controllers to change the state.
+ *
+ * `<DrilldownManager>` and other container components access this state using
+ * the `useDrilldownManager()` React hook:
+ *
+ * ```ts
+ * const state = useDrilldownManager();
+ * ```
+ */
+export class DrilldownManagerState {
+  /**
+   * Title displayed at the top of <DrilldownManager> flyout.
+   */
+  private readonly title$ = new BehaviorSubject<React.ReactNode>(txtDefaultTitle);
+
+  /**
+   * Footer displayed at the bottom of <DrilldownManager> flyout.
+   */
+  private readonly footer$ = new BehaviorSubject<React.ReactNode>(null);
+
+  /**
+   * Route inside Drilldown Manager flyout that is displayed to the user. Some
+   * available routes are:
+   *
+   * - `['create']`
+   * - `['new']`
+   * - `['new', 'DASHBOARD_TO_DASHBOARD_DRILLDOWN']`
+   * - `['manage']`
+   * - `['manage', 'yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy']`
+   */
+  public readonly route$: BehaviorSubject<string[]>;
+
+  /**
+   * Whether a drilldowns welcome message should be displayed to the user at
+   * the very top of the drilldowns manager flyout.
+   */
+  public readonly hideWelcomeMessage$: BehaviorSubject<boolean>;
+
+  /**
+   * Currently selected action factory (drilldown type).
+   */
+  public readonly actionFactory$: BehaviorSubject<undefined | ActionFactory>;
+
+  private readonly mapEventToDrilldownItem = (event: SerializedEvent): DrilldownTableItem => {
+    const actionFactory = this.deps.actionFactories.find(
+      (factory) => factory.id === event.action.factoryId
+    );
+    const drilldownFactoryContext: BaseActionFactoryContext = {
+      ...this.deps.placeContext,
+      triggers: event.triggers as string[],
+    };
+    const firstTrigger = event.triggers[0];
+    return {
+      id: event.eventId,
+      drilldownName: event.action.name,
+      actionName: actionFactory?.getDisplayName(drilldownFactoryContext) ?? event.action.factoryId,
+      icon: actionFactory?.getIconType(drilldownFactoryContext),
+      error: !actionFactory
+        ? invalidDrilldownType(event.action.factoryId) // this shouldn't happen for the end user, but useful during development
+        : !actionFactory.isCompatibleLicense()
+        ? insufficientLicenseLevel
+        : undefined,
+      triggers: event.triggers.map((trigger) => this.deps.getTrigger(trigger as string)),
+      triggerIncompatible: !this.deps.triggers.find((t) => t === firstTrigger),
+    };
+  };
+  public readonly events$ = new BehaviorSubject<DrilldownTableItem[]>(
+    this.deps.dynamicActionManager.state.get().events.map(this.mapEventToDrilldownItem)
+  );
+
+  /**
+   * State for each drilldown type used for new drilldown creation, so when user
+   * switched between drilldown types the configuration of the previous
+   * drilldown is preserved.
+   */
+  public readonly drilldownStateByFactoryId = new Map<string, DrilldownState>();
+
+  /**
+   * Whether user can unlock more drilldown types if they subscribe to a higher
+   * license tier.
+   */
+  public readonly canUnlockMoreDrilldowns: boolean;
+
+  /**
+   * Used to show cloning success notification.
+   */
+  public lastCloneRecord: null | { time: number; templateIds: string[] } = null;
+
+  constructor(public readonly deps: DrilldownManagerStateDeps) {
+    const hideWelcomeMessage = deps.storage.get(helloMessageStorageKey);
+    this.hideWelcomeMessage$ = new BehaviorSubject<boolean>(hideWelcomeMessage ?? false);
+    this.canUnlockMoreDrilldowns = deps.actionFactories.some(
+      (factory) => !factory.isCompatibleLicense
+    );
+
+    deps.dynamicActionManager.state.state$
+      .pipe(map((state) => state.events.map(this.mapEventToDrilldownItem)))
+      .subscribe(this.events$);
+
+    let { initialRoute = '' } = deps;
+    if (!initialRoute) initialRoute = 'manage';
+    else if (initialRoute[0] === '/') initialRoute = initialRoute.substr(1);
+    this.route$ = new BehaviorSubject(initialRoute.split('/'));
+
+    this.actionFactory$ = new BehaviorSubject<undefined | ActionFactory>(
+      this.getActiveActionFactory()
+    );
+    this.route$.pipe(map(() => this.getActiveActionFactory())).subscribe(this.actionFactory$);
+  }
+
+  /**
+   * Set flyout main heading text.
+   * @param title New title.
+   */
+  public setTitle(title: React.ReactNode) {
+    this.title$.next(title);
+  }
+
+  /**
+   * Set the new flyout footer that renders at the very bottom of the Drilldown
+   * Manager flyout.
+   * @param footer New title.
+   */
+  public setFooter(footer: React.ReactNode) {
+    this.footer$.next(footer);
+  }
+
+  /**
+   * Set the flyout main heading back to its default state.
+   */
+  public resetTitle() {
+    this.setTitle(txtDefaultTitle);
+  }
+
+  /**
+   * Change the screen of Drilldown Manager.
+   */
+  public setRoute(route: string[]): void {
+    if (route[0] === 'manage') this.deps.closeAfterCreate = false;
+    this.route$.next(route);
+  }
+
+  /**
+   * Callback called to hide drilldowns welcome message, and remember in local
+   * storage that user opted to hide this message.
+   */
+  public readonly hideWelcomeMessage = (): void => {
+    this.hideWelcomeMessage$.next(true);
+    this.deps.storage.set(helloMessageStorageKey, true);
+  };
+
+  /**
+   * Select a different action factory.
+   */
+  public setActionFactory(actionFactory: undefined | ActionFactory): void {
+    if (!actionFactory) {
+      const route = this.route$.getValue();
+      if (route[0] === 'new' && route.length > 1) this.setRoute(['new']);
+      return;
+    }
+
+    if (!this.drilldownStateByFactoryId.has(actionFactory.id)) {
+      const oldActionFactory = this.getActiveActionFactory();
+      const oldDrilldownState = !!oldActionFactory
+        ? this.drilldownStateByFactoryId.get(oldActionFactory.id)
+        : undefined;
+      const context = this.getActionFactoryContext();
+      const drilldownState = new DrilldownState({
+        factory: actionFactory,
+        placeTriggers: this.deps.triggers,
+        placeContext: this.deps.placeContext || {},
+        name: this.pickName(
+          !!oldDrilldownState
+            ? oldDrilldownState.name$.getValue()
+            : actionFactory.getDisplayName(this.getActionFactoryContext())
+        ),
+        triggers: [],
+        config: actionFactory.createConfig(context),
+      });
+      this.drilldownStateByFactoryId.set(actionFactory.id, drilldownState);
+    }
+
+    this.route$.next(['new', actionFactory.id]);
+  }
+
+  public getActiveActionFactory(): undefined | ActionFactory {
+    const [step1, id] = this.route$.getValue();
+    if (step1 !== 'new' || !id) return undefined;
+    return this.deps.actionFactories.find((factory) => factory.id === id);
+  }
+
+  /**
+   * Close the drilldown flyout.
+   */
+  public readonly close = (): void => {
+    this.deps.onClose();
+  };
+
+  /**
+   * Get action factory context, which also contains a custom place context
+   * provided by the user who triggered rendering of the <DrilldownManager>.
+   */
+  public getActionFactoryContext(): BaseActionFactoryContext {
+    const placeContext = this.deps.placeContext ?? [];
+    const context: BaseActionFactoryContext = {
+      ...placeContext,
+      triggers: [],
+    };
+
+    return context;
+  }
+
+  /**
+   * Get state object of the drilldown which is currently being created.
+   */
+  public getDrilldownState(): undefined | DrilldownState {
+    const actionFactory = this.getActiveActionFactory();
+    if (!actionFactory) return undefined;
+    const drilldownState = this.drilldownStateByFactoryId.get(actionFactory.id);
+    return drilldownState;
+  }
+
+  /**
+   * Called when user presses "Create drilldown" button to save the
+   * currently edited drilldown.
+   */
+  public async createDrilldown(): Promise<void> {
+    const { dynamicActionManager, toastService } = this.deps;
+    const drilldownState = this.getDrilldownState();
+
+    if (!drilldownState) return;
+
+    try {
+      const event = drilldownState.serialize();
+      const triggers = drilldownState.triggers$.getValue();
+
+      await dynamicActionManager.createEvent(event, triggers);
+      toastService.addSuccess({
+        title: toastDrilldownCreated.title(drilldownState.name$.getValue()),
+        text: toastDrilldownCreated.text,
+      });
+      this.drilldownStateByFactoryId.delete(drilldownState.factory.id);
+      if (this.deps.closeAfterCreate) {
+        this.deps.onClose();
+      } else {
+        this.setRoute(['manage']);
+      }
+    } catch (error) {
+      toastService.addError(error, {
+        title: toastDrilldownsCRUDError,
+      });
+      throw error;
+    }
+  }
+
+  /**
+   * Deletes a list of drilldowns and shows toast notifications to the user.
+   *
+   * @param ids Drilldown IDs.
+   */
+  public readonly onDelete = (ids: string[]) => {
+    (async () => {
+      const { dynamicActionManager, toastService } = this.deps;
+      try {
+        await dynamicActionManager.deleteEvents(ids);
+        this.deps.toastService.addSuccess(
+          ids.length === 1
+            ? {
+                title: toastDrilldownDeleted.title,
+                text: toastDrilldownDeleted.text,
+              }
+            : {
+                title: toastDrilldownsDeleted.title(ids.length),
+                text: toastDrilldownsDeleted.text,
+              }
+        );
+      } catch (error) {
+        toastService.addError(error, {
+          title: toastDrilldownsCRUDError,
+        });
+      }
+    })().catch(console.error); // eslint-disable-line
+  };
+
+  /**
+   * Clone a list of selected templates.
+   */
+  public readonly onClone = async (templateIds: string[]) => {
+    const { templates } = this.deps;
+    if (!templates) return;
+    const templatesToClone: DrilldownTemplate[] = templateIds
+      .map((templateId) => templates.find(({ id }) => id === templateId))
+      .filter(Boolean) as DrilldownTemplate[];
+
+    for (const template of templatesToClone) {
+      await this.cloneTemplate(template);
+    }
+
+    this.lastCloneRecord = {
+      time: Date.now(),
+      templateIds,
+    };
+    this.setRoute(['manage']);
+  };
+
+  private async cloneTemplate(template: DrilldownTemplate) {
+    const { dynamicActionManager } = this.deps;
+    const name = this.pickName(template.name);
+    const action: SerializedAction = {
+      factoryId: template.factoryId,
+      name,
+      config: (template.config || {}) as SerializableState,
+    };
+    await dynamicActionManager.createEvent(action, template.triggers);
+  }
+
+  /**
+   * Checks if drilldown with such a name already exists.
+   */
+  private hasDrilldownWithName(name: string): boolean {
+    const { events } = this.deps.dynamicActionManager.state.get();
+    for (const event of events) if (event.action.name === name) return true;
+    return false;
+  }
+
+  /**
+   * Picks a unique name for the cloned drilldown. Adds "(copy)", "(copy 1)",
+   * "(copy 2)", etc. if drilldown with such name already exists.
+   */
+  private pickName(name: string): string {
+    if (this.hasDrilldownWithName(name)) {
+      const matches = name.match(/(.*) (\(copy[^\)]*\))/);
+      if (matches) name = matches[1];
+      for (let i = 0; i < 100; i++) {
+        const proposedName = !i ? `${name} (copy)` : `${name} (copy ${i})`;
+        const exists = this.hasDrilldownWithName(proposedName);
+        if (!exists) return proposedName;
+      }
+    }
+    return name;
+  }
+
+  public readonly onCreateFromTemplate = async (templateId: string) => {
+    const { templates } = this.deps;
+    if (!templates) return;
+    const template = templates.find(({ id }) => id === templateId);
+    if (!template) return;
+    const actionFactory = this.deps.actionFactories.find(({ id }) => id === template.factoryId);
+    if (!actionFactory) return;
+    this.setActionFactory(actionFactory);
+    const drilldownState = this.getDrilldownState();
+    if (drilldownState) {
+      drilldownState.setName(this.pickName(template.name));
+      drilldownState.setTriggers(template.triggers);
+      drilldownState.setConfig(template.config as SerializableState);
+    }
+  };
+
+  public readonly onCreateFromDrilldown = async (eventId: string) => {
+    const { dynamicActionManager } = this.deps;
+    const { events } = dynamicActionManager.state.get();
+    const event = events.find((ev) => ev.eventId === eventId);
+    if (!event) return;
+    const actionFactory = this.deps.actionFactories.find(({ id }) => id === event.action.factoryId);
+    if (!actionFactory) return;
+    this.setActionFactory(actionFactory);
+    const drilldownState = this.getDrilldownState();
+    if (drilldownState) {
+      drilldownState.setName(this.pickName(event.action.name));
+      drilldownState.setTriggers(event.triggers);
+      drilldownState.setConfig(event.action.config);
+    }
+  };
+
+  /**
+   * Returns the state object of an existing drilldown for editing purposes.
+   *
+   * @param eventId ID of the saved dynamic action event.
+   */
+  public createEventDrilldownState(eventId: string): null | DrilldownState {
+    const { dynamicActionManager, actionFactories, triggers: placeTriggers } = this.deps;
+    const { events } = dynamicActionManager.state.get();
+    const event = events.find((ev) => ev.eventId === eventId);
+    if (!event) return null;
+    const factory = actionFactories.find(({ id }) => id === event.action.factoryId);
+    if (!factory) return null;
+    const { action, triggers } = event;
+    const { name, config } = action;
+    const state = new DrilldownState({
+      factory,
+      placeContext: this.getActionFactoryContext(),
+      placeTriggers,
+      name,
+      config,
+      triggers,
+    });
+    return state;
+  }
+
+  /**
+   * Save edits to an existing drilldown.
+   *
+   * @param eventId ID of the saved dynamic action event.
+   * @param drilldownState Latest state of the drilldown as edited by the user.
+   */
+  public async updateEvent(eventId: string, drilldownState: DrilldownState): Promise<void> {
+    const { dynamicActionManager, toastService } = this.deps;
+    const action = drilldownState.serialize();
+
+    try {
+      await dynamicActionManager.updateEvent(eventId, action, drilldownState.triggers$.getValue());
+      toastService.addSuccess({
+        title: toastDrilldownEdited.title(action.name),
+        text: toastDrilldownEdited.text,
+      });
+      this.setRoute(['manage']);
+    } catch (error) {
+      toastService.addError(error, {
+        title: toastDrilldownsCRUDError,
+      });
+      throw error;
+    }
+  }
+
+  // Below are convenience React hooks for consuming observables in connected
+  // React components.
+
+  /* eslint-disable react-hooks/rules-of-hooks */
+  public readonly useTitle = () => useObservable(this.title$, this.title$.getValue());
+  public readonly useFooter = () => useObservable(this.footer$, this.footer$.getValue());
+  public readonly useRoute = () => useObservable(this.route$, this.route$.getValue());
+  public readonly useWelcomeMessage = () =>
+    useObservable(this.hideWelcomeMessage$, this.hideWelcomeMessage$.getValue());
+  public readonly useActionFactory = () =>
+    useObservable(this.actionFactory$, this.actionFactory$.getValue());
+  public readonly useEvents = () => useObservable(this.events$, this.events$.getValue());
+  /* eslint-enable react-hooks/rules-of-hooks */
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts
new file mode 100644
index 00000000000000..f80ad30d34bb87
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts
@@ -0,0 +1,242 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import useObservable from 'react-use/lib/useObservable';
+import { Observable, BehaviorSubject, combineLatest } from 'rxjs';
+import { map } from 'rxjs/operators';
+import {
+  ActionFactory,
+  BaseActionConfig,
+  BaseActionFactoryContext,
+  SerializedAction,
+} from '../../../dynamic_actions';
+import { useSyncObservable } from '../hooks/use_sync_observable';
+import { ActionFactoryPlaceContext } from '../types';
+
+export interface DrilldownStateDeps {
+  /**
+   * Action factory, i.e. drilldown, which we are creating.
+   */
+  factory: ActionFactory;
+
+  /**
+   * List of all triggers the current place supports.
+   */
+  placeTriggers: string[];
+
+  /**
+   * Special opaque context object provided by the place from where the
+   * Drilldown Manager was opened.
+   */
+  placeContext: ActionFactoryPlaceContext<BaseActionFactoryContext>;
+
+  /**
+   * Initial name of the drilldown instance.
+   */
+  name?: string;
+
+  /**
+   * Initially selected triggers of the drilldown instance.
+   */
+  triggers?: string[];
+
+  /**
+   * Initial config of the drilldown instance.
+   */
+  config?: BaseActionConfig;
+}
+
+/**
+ * An instance of this class represents UI states of a single drilldown which
+ * is currently being created or edited.
+ */
+export class DrilldownState {
+  /**
+   * Drilldown type used to configure this drilldown.
+   */
+  public readonly factory: ActionFactory;
+
+  /**
+   * Opaque action factory context object excluding the `triggers` attribute.
+   */
+  public readonly placeContext: ActionFactoryPlaceContext<BaseActionFactoryContext>;
+
+  /**
+   * User entered name of this drilldown.
+   */
+  public readonly name$: BehaviorSubject<string>;
+
+  /**
+   * Whether the `name$` is valid or is in an error state.
+   */
+  public readonly nameError$: Observable<string | undefined>;
+
+  /**
+   * List of all triggers the place which opened the Drilldown Manager supports.
+   */
+  public readonly placeTriggers: string[];
+
+  /**
+   * List of all triggers from which the user can pick in UI for this specific
+   * drilldown. This is the selection list we show to the user. It is an
+   * intersection of all triggers supported by current place with the triggers
+   * that the action factory supports.
+   */
+  public readonly uiTriggers: string[];
+
+  /**
+   * User selected triggers. (Currently in UI we support user picking just one trigger).
+   */
+  public readonly triggers$: BehaviorSubject<string[]>;
+
+  /**
+   * Error identifier, in case `triggers$` is in an error state.
+   */
+  public readonly triggersError$: Observable<string | undefined>;
+
+  /**
+   * Current action factory (drilldown) configuration, i.e. drilldown
+   * configuration object, which will be serialized and persisted in storage.
+   */
+  public readonly config$: BehaviorSubject<BaseActionConfig>;
+
+  /**
+   * Error identifier, in case `config$` is in an error state.
+   */
+  public readonly configError$: Observable<string | undefined>;
+
+  /**
+   * Whether the drilldown state is in an error and should not be saved. I value
+   * is `undefined`, there is no error.
+   */
+  public readonly error$: Observable<string | undefined>;
+
+  constructor({
+    factory,
+    placeTriggers,
+    placeContext,
+    name = '',
+    triggers = [],
+    config = {},
+  }: DrilldownStateDeps) {
+    this.factory = factory;
+    this.placeTriggers = placeTriggers;
+    this.placeContext = placeContext;
+    this.name$ = new BehaviorSubject<string>(name);
+    this.triggers$ = new BehaviorSubject<string[]>(triggers);
+    this.config$ = new BehaviorSubject<BaseActionConfig>(config);
+
+    const triggersFactorySupports = this.factory.supportedTriggers();
+    this.uiTriggers = triggersFactorySupports.filter((trigger) =>
+      this.placeTriggers.includes(trigger)
+    );
+
+    // Pre-select a trigger if there is only one trigger for user to choose from.
+    // In case there is only one possible trigger, UI will not display a trigger picker.
+    if (this.uiTriggers.length === 1) this.triggers$.next([this.uiTriggers[0]]);
+
+    this.nameError$ = this.name$.pipe(
+      map((currentName) => {
+        if (!currentName) return 'NAME_EMPTY';
+        return undefined;
+      })
+    );
+
+    this.triggersError$ = this.triggers$.pipe(
+      map((currentTriggers) => {
+        if (!currentTriggers.length) return 'NO_TRIGGERS_SELECTED';
+        return undefined;
+      })
+    );
+
+    this.configError$ = this.config$.pipe(
+      map((conf) => {
+        if (!this.factory.isConfigValid(conf, this.getFactoryContext())) return 'INVALID_CONFIG';
+        return undefined;
+      })
+    );
+
+    this.error$ = combineLatest([this.nameError$, this.triggersError$, this.configError$]).pipe(
+      map(
+        ([nameError, configError, triggersError]) =>
+          nameError || triggersError || configError || undefined
+      )
+    );
+  }
+
+  /**
+   * Change the name of the drilldown.
+   */
+  public readonly setName = (name: string): void => {
+    this.name$.next(name);
+  };
+
+  /**
+   * Change the list of user selected triggers.
+   */
+  public readonly setTriggers = (triggers: string[]): void => {
+    this.triggers$.next(triggers);
+  };
+
+  /**
+   * Update the current drilldown configuration.
+   */
+  public readonly setConfig = (config: BaseActionConfig): void => {
+    this.config$.next(config);
+  };
+
+  public getFactoryContext(): BaseActionFactoryContext {
+    return {
+      ...this.placeContext,
+      triggers: this.triggers$.getValue(),
+    };
+  }
+
+  /**
+   * Serialize the current drilldown draft into a serializable action which
+   * is persisted to disk.
+   */
+  public serialize(): SerializedAction {
+    return {
+      factoryId: this.factory.id,
+      name: this.name$.getValue(),
+      config: this.config$.getValue(),
+    };
+  }
+
+  /**
+   * Returns a list of all triggers from which user can pick in UI, for this
+   * specific drilldown.
+   */
+  public getAllDrilldownTriggers(): string[] {
+    const triggersFactorySupports = this.factory.supportedTriggers();
+    const uiTriggers = triggersFactorySupports.filter((trigger) =>
+      this.placeTriggers.includes(trigger)
+    );
+    return uiTriggers;
+  }
+
+  public isValid(): boolean {
+    if (!this.name$.getValue()) return false;
+    const config = this.config$.getValue();
+    if (!config) return false;
+    const triggers = this.triggers$.getValue();
+    if (triggers.length < 1) return false;
+    if (!this.factory.isConfigValid(config, this.getFactoryContext())) return false;
+    return true;
+  }
+
+  // Below are convenience React hooks for consuming observables in connected
+  // React components.
+
+  /* eslint-disable react-hooks/rules-of-hooks */
+  public readonly useName = () => useObservable(this.name$, this.name$.getValue());
+  public readonly useTriggers = () => useObservable(this.triggers$, this.triggers$.getValue());
+  public readonly useConfig = () => useObservable(this.config$, this.config$.getValue());
+  public readonly useError = () => useSyncObservable(this.error$);
+  /* eslint-enable react-hooks/rules-of-hooks */
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/i18n.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/i18n.ts
similarity index 76%
rename from x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/i18n.ts
rename to x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/i18n.ts
index b95f69e875ebc1..c9b49b5ff93468 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/i18n.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/i18n.ts
@@ -87,3 +87,31 @@ export const toastDrilldownsCRUDError = i18n.translate(
     description: 'Title for generic error toast when persisting drilldown updates failed',
   }
 );
+
+export const insufficientLicenseLevel = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.insufficientLicenseLevelError',
+  {
+    defaultMessage: 'Insufficient license level',
+    description:
+      'User created drilldown with higher license type, but then downgraded the license. This error is shown in the list near created drilldown',
+  }
+);
+
+export const invalidDrilldownType = (type: string) =>
+  i18n.translate(
+    'xpack.uiActionsEnhanced.drilldowns.components.flyoutDrilldownWizard.invalidDrilldownType',
+    {
+      defaultMessage: "Drilldown type {type} doesn't exist",
+      values: {
+        type,
+      },
+    }
+  );
+
+export const txtDefaultTitle = i18n.translate(
+  'xpack.uiActionsEnhanced.drilldowns.drilldownManager.state.defaultTitle',
+  {
+    defaultMessage: 'Drilldowns',
+    description: 'Drilldowns flyout title.',
+  }
+);
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/index.ts
new file mode 100644
index 00000000000000..42dcc4510622a3
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './drilldown_state';
+export * from './drilldown_manager_state';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/types.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/types.ts
new file mode 100644
index 00000000000000..1ff6053126e1cf
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/types.ts
@@ -0,0 +1,162 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ToastsStart } from 'kibana/public';
+import { IStorageWrapper } from '../../../../../../src/plugins/kibana_utils/public';
+import { Trigger } from '../../../../../../src/plugins/ui_actions/public';
+import {
+  ActionFactory,
+  BaseActionFactoryContext,
+  DynamicActionManager,
+} from '../../dynamic_actions';
+
+/**
+ * Interface used as piece of ActionFactoryContext that is passed in from
+ * drilldown wizard component to action factories. Omitted values are added
+ * inside the wizard and then full {@link BaseActionFactoryContext} passed into
+ * action factory methods
+ */
+export type ActionFactoryPlaceContext<
+  ActionFactoryContext extends BaseActionFactoryContext = BaseActionFactoryContext
+> = Omit<ActionFactoryContext, 'triggers'>;
+
+/**
+ * This are props of the public <DrilldownManager> React component which is
+ * exposed from this plugin's contract, user can change these props every time
+ * the public <DrilldownManager> is re-rendered.
+ */
+export interface PublicDrilldownManagerProps {
+  /**
+   * Implementation of reactive storage interface for drilldowns. Dynamic action
+   * manager is responsible for permanently persisting drilldowns, i.e.
+   * drilldown name, type, and config. It exposes observables for reactive UI
+   * updates.
+   */
+  dynamicActionManager: DynamicActionManager;
+
+  /**
+   * Initial screen which Drilldown Manager should display when it first opens.
+   * Afterwards the state of the currently visible screen is controlled by the
+   * Drilldown Manager.
+   *
+   * Possible values of the route:
+   *
+   * - `/create` --- opens with "Create new" tab selected.
+   * - `/new` --- opens with the "Create new" tab selected showing new drilldown form.
+   * - `/manage` --- opens with selected "Manage" tab.
+   * - `/manage/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy` --- opens in edit mode where
+   *   drilldown with ID `yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy` is being edited.
+   */
+  initialRoute?: string;
+
+  /**
+   * Callback called when drilldown flyout should be closed.
+   */
+  onClose: () => void;
+
+  /**
+   * List of possible triggers in current context
+   */
+  triggers: string[];
+
+  /**
+   * Extra action factory context passed into action factories CollectConfig, getIconType, getDisplayName and etc...
+   */
+  placeContext?: ActionFactoryPlaceContext<BaseActionFactoryContext>;
+
+  /**
+   * List of drilldown templates, which will be displayed to user for fast
+   * drilldown creation flow.
+   */
+  templates?: DrilldownTemplate[];
+
+  /**
+   * Whether to close the drilldown flyout after a drilldown was created
+   */
+  closeAfterCreate?: boolean;
+}
+
+/**
+ * Template for a pre-configured new drilldown, this gives ability to create a
+ * drilldown from a template instead of user creating a drilldown from scratch.
+ * This is used in "drilldown cloning" functionality, where drilldowns can be
+ * cloned from one dashboard panel to another.
+ */
+export interface DrilldownTemplate {
+  /**
+   * Any string that uniquely identifies this item in a list of `DrilldownTemplate[]`.
+   */
+  id: string;
+
+  /**
+   * EUI icon display next to the description.
+   */
+  icon?: string;
+
+  /**
+   * A user facing text that provides information about the source of this template.
+   */
+  description: string;
+
+  /**
+   * Drilldown type, dynamic action factory ID.
+   */
+  factoryId: string;
+
+  /**
+   * Suggested new name of the cloned drilldown. If a drilldown with such suggested
+   * name already exists at current place, a suffix like " (copy 1)" will be added.
+   */
+  name: string;
+
+  /**
+   * Pre-selected triggers.
+   */
+  triggers: string[];
+
+  /**
+   * Preliminary configuration of the new drilldown, to be used in the dynamicaction factory.
+   */
+  config: unknown;
+}
+
+/**
+ * These are static global dependencies of the <DrilldownManager> wired in
+ * during the setup life-cycle of the plugin.
+ */
+export interface DrilldownManagerDependencies {
+  /**
+   * List of registered UI Actions action factories, i.e. drilldowns.
+   */
+  actionFactories: ActionFactory[];
+
+  /**
+   * Trigger getter from UI Actions trigger registry.
+   */
+  getTrigger: (triggerId: string) => Trigger;
+
+  /**
+   * Implementation of local storage interface for persisting user preferences,
+   * e.g. user can dismiss the welcome message.
+   */
+  storage: IStorageWrapper;
+
+  /**
+   * Services for displaying user toast notifications.
+   */
+  toastService: ToastsStart;
+
+  /**
+   * Link to drilldowns user facing docs on corporate website.
+   */
+  docsLink?: string;
+
+  /**
+   * Link to trigger picker user facing docs on corporate website.
+   */
+  triggerPickerDocsLink?: string;
+}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_compatible_action_factories_for_current_context.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_compatible_action_factories_for_current_context.ts
deleted file mode 100644
index edb598ba179a3c..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_compatible_action_factories_for_current_context.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useEffect, useState } from 'react';
-import { ActionFactory, BaseActionFactoryContext } from '../../dynamic_actions';
-
-export function useCompatibleActionFactoriesForCurrentContext<
-  Context extends BaseActionFactoryContext = BaseActionFactoryContext
->(actionFactories: ActionFactory[], context: Context) {
-  const [compatibleActionFactories, setCompatibleActionFactories] = useState<ActionFactory[]>();
-  useEffect(() => {
-    let canceled = false;
-    async function updateCompatibleFactoriesForContext() {
-      const compatibility = await Promise.all(
-        actionFactories.map((factory) => factory.isCompatible(context))
-      );
-      if (canceled) return;
-
-      const compatibleFactories = actionFactories.filter((_, i) => compatibility[i]);
-      const triggerSupportedFactories = compatibleFactories.filter((factory) =>
-        factory.supportedTriggers().some((trigger) => context.triggers.includes(trigger))
-      );
-      setCompatibleActionFactories(triggerSupportedFactories);
-    }
-    updateCompatibleFactoriesForContext();
-    return () => {
-      canceled = true;
-    };
-  }, [context, actionFactories, context.triggers]);
-
-  return compatibleActionFactories;
-}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_drilldown_state_manager.tsx b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_drilldown_state_manager.tsx
deleted file mode 100644
index 6a9dc5fcc34fa6..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_drilldown_state_manager.tsx
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useState } from 'react';
-import { ToastsStart } from 'kibana/public';
-import useMountedState from 'react-use/lib/useMountedState';
-import { useContainerState } from '../../../../../../src/plugins/kibana_utils/public';
-import {
-  toastDrilldownCreated,
-  toastDrilldownDeleted,
-  toastDrilldownEdited,
-  toastDrilldownsCRUDError,
-  toastDrilldownsDeleted,
-} from './i18n';
-import { DynamicActionManager, SerializedAction } from '../../dynamic_actions';
-
-export function useDrilldownsStateManager(
-  actionManager: DynamicActionManager,
-  toastService: ToastsStart
-) {
-  const { events: drilldowns } = useContainerState(actionManager.state);
-  const [isLoading, setIsLoading] = useState(false);
-  const isMounted = useMountedState();
-
-  async function run(op: () => Promise<void>) {
-    setIsLoading(true);
-    try {
-      await op();
-    } catch (e) {
-      toastService.addError(e, {
-        title: toastDrilldownsCRUDError,
-      });
-      if (!isMounted) return;
-      setIsLoading(false);
-      return;
-    }
-  }
-
-  async function createDrilldown(action: SerializedAction, selectedTriggers: string[]) {
-    await run(async () => {
-      await actionManager.createEvent(action, selectedTriggers);
-      toastService.addSuccess({
-        title: toastDrilldownCreated.title(action.name),
-        text: toastDrilldownCreated.text,
-      });
-    });
-  }
-
-  async function editDrilldown(
-    drilldownId: string,
-    action: SerializedAction,
-    selectedTriggers: string[]
-  ) {
-    await run(async () => {
-      await actionManager.updateEvent(drilldownId, action, selectedTriggers);
-      toastService.addSuccess({
-        title: toastDrilldownEdited.title(action.name),
-        text: toastDrilldownEdited.text,
-      });
-    });
-  }
-
-  async function deleteDrilldown(drilldownIds: string | string[]) {
-    await run(async () => {
-      drilldownIds = Array.isArray(drilldownIds) ? drilldownIds : [drilldownIds];
-      await actionManager.deleteEvents(drilldownIds);
-      toastService.addSuccess(
-        drilldownIds.length === 1
-          ? {
-              title: toastDrilldownDeleted.title,
-              text: toastDrilldownDeleted.text,
-            }
-          : {
-              title: toastDrilldownsDeleted.title(drilldownIds.length),
-              text: toastDrilldownsDeleted.text,
-            }
-      );
-    });
-  }
-
-  return { drilldowns, isLoading, createDrilldown, editDrilldown, deleteDrilldown };
-}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_welcome_message.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_welcome_message.ts
deleted file mode 100644
index 324c3b94aa8c21..00000000000000
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/hooks/use_welcome_message.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { useState } from 'react';
-import { IStorageWrapper } from '../../../../../../src/plugins/kibana_utils/public';
-
-export function useWelcomeMessage(storage: IStorageWrapper): [boolean, () => void] {
-  const key = `drilldowns:hidWelcomeMessage`;
-  const [hideWelcomeMessage, setHideWelcomeMessage] = useState<boolean>(storage.get(key) ?? false);
-
-  return [
-    !hideWelcomeMessage,
-    () => {
-      if (hideWelcomeMessage) return;
-      setHideWelcomeMessage(true);
-      storage.set(key, true);
-    },
-  ];
-}
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/index.ts
index b876202068a010..ebaa845409e2aa 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/index.ts
@@ -6,4 +6,4 @@
  */
 
 export * from './drilldown_definition';
-export * from './components';
+export * from './drilldown_manager';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
index 0c67fa807ef031..bd5dc5794cb59d 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/action_factory.ts
@@ -6,23 +6,23 @@
  */
 
 import { uiToReactComponent } from '../../../../../src/plugins/kibana_react/public';
-import { UiActionsPresentable as Presentable } from '../../../../../src/plugins/ui_actions/public';
-import { ActionFactoryDefinition } from './action_factory_definition';
-import { Configurable } from '../../../../../src/plugins/kibana_utils/public';
-import {
+import type { UiActionsPresentable as Presentable } from '../../../../../src/plugins/ui_actions/public';
+import type { ActionFactoryDefinition } from './action_factory_definition';
+import type { Configurable } from '../../../../../src/plugins/kibana_utils/public';
+import type {
   BaseActionConfig,
   BaseActionFactoryContext,
   SerializedAction,
   SerializedEvent,
 } from './types';
-import { ILicense, LicensingPluginStart } from '../../../licensing/public';
-import { UiActionsActionDefinition as ActionDefinition } from '../../../../../src/plugins/ui_actions/public';
-import { SavedObjectReference } from '../../../../../src/core/types';
-import { PersistableState } from '../../../../../src/plugins/kibana_utils/common';
+import type { ILicense, LicensingPluginStart } from '../../../licensing/public';
+import type { UiActionsActionDefinition as ActionDefinition } from '../../../../../src/plugins/ui_actions/public';
+import type { SavedObjectReference } from '../../../../../src/core/types';
+import type { PersistableState } from '../../../../../src/plugins/kibana_utils/common';
 
 export interface ActionFactoryDeps {
-  readonly getLicense: () => ILicense;
-  readonly getFeatureUsageStart: () => LicensingPluginStart['featureUsage'];
+  readonly getLicense?: () => ILicense;
+  readonly getFeatureUsageStart?: () => LicensingPluginStart['featureUsage'];
 }
 
 export class ActionFactory<
@@ -82,7 +82,7 @@ export class ActionFactory<
    * compatible with current license?
    */
   public isCompatibleLicense() {
-    if (!this.minimalLicense) return true;
+    if (!this.minimalLicense || !this.deps.getLicense) return true;
     const license = this.deps.getLicense();
     return license.isAvailable && license.isActive && license.hasAtLeast(this.minimalLicense);
   }
@@ -110,7 +110,7 @@ export class ActionFactory<
   }
 
   private notifyFeatureUsage(): void {
-    if (!this.minimalLicense || !this.licenseFeatureName) return;
+    if (!this.minimalLicense || !this.licenseFeatureName || !this.deps.getFeatureUsageStart) return;
     this.deps
       .getFeatureUsageStart()
       .notifyUsage(this.licenseFeatureName)
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts
index 6821999ee2c751..fbc3d7229df6f8 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/dynamic_action_manager.ts
@@ -213,6 +213,11 @@ export class DynamicActionManager {
    * @param triggers List of triggers to which action should react.
    */
   public async createEvent(action: SerializedAction, triggers: string[]) {
+    if (!triggers.length) {
+      // This error should never happen, hence it is not translated.
+      throw new Error('No triggers selected for event.');
+    }
+
     const event: SerializedEvent = {
       eventId: uuidv4(),
       triggers,
diff --git a/x-pack/plugins/ui_actions_enhanced/public/index.ts b/x-pack/plugins/ui_actions_enhanced/public/index.ts
index e768f829eff69f..b8e4fcbd916e69 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/index.ts
@@ -35,5 +35,8 @@ export {
 
 export { DynamicActionsState } from './services/ui_actions_service_enhancements';
 
-export { DrilldownDefinition as UiActionsEnhancedDrilldownDefinition } from './drilldowns';
+export {
+  DrilldownDefinition as UiActionsEnhancedDrilldownDefinition,
+  DrilldownTemplate as UiActionsEnhancedDrilldownTemplate,
+} from './drilldowns';
 export * from './drilldowns/url_drilldown';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/mocks.ts b/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
index 514569a7ae3362..33591c9383703c 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/mocks.ts
@@ -31,7 +31,7 @@ const createStartContract = (): Start => {
     getActionFactories: jest.fn(),
     getActionFactory: jest.fn(),
     hasActionFactory: jest.fn(),
-    FlyoutManageDrilldowns: jest.fn(),
+    DrilldownManager: jest.fn(),
     telemetry: jest.fn(),
     extract: jest.fn(),
     inject: jest.fn(),
diff --git a/x-pack/plugins/ui_actions_enhanced/public/plugin.ts b/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
index bfb9e47beb014a..b83f3288b05afa 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/plugin.ts
@@ -26,7 +26,7 @@ import { CustomTimeRangeBadge } from './custom_time_range_badge';
 import { CommonlyUsedRange } from './types';
 import { UiActionsServiceEnhancements } from './services';
 import { ILicense, LicensingPluginSetup, LicensingPluginStart } from '../../licensing/public';
-import { createFlyoutManageDrilldowns } from './drilldowns';
+import { createPublicDrilldownManager, PublicDrilldownManagerComponent } from './drilldowns';
 import { createStartServicesGetter, Storage } from '../../../../src/plugins/kibana_utils/public';
 import { dynamicActionEnhancement } from './dynamic_actions/dynamic_action_enhancement';
 
@@ -57,7 +57,7 @@ export interface StartContract
       | 'extract'
       | 'inject'
     > {
-  FlyoutManageDrilldowns: ReturnType<typeof createFlyoutManageDrilldowns>;
+  DrilldownManager: PublicDrilldownManagerComponent;
 }
 
 export class AdvancedUiActionsPublicPlugin
@@ -118,7 +118,7 @@ export class AdvancedUiActionsPublicPlugin
     return {
       ...uiActions,
       ...this.enhancements!,
-      FlyoutManageDrilldowns: createFlyoutManageDrilldowns({
+      DrilldownManager: createPublicDrilldownManager({
         actionFactories: this.enhancements!.getActionFactories(),
         getTrigger: (triggerId) => uiActions.getTrigger(triggerId),
         storage: new Storage(window?.localStorage),
diff --git a/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration.tsx b/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration.tsx
index 9c059441b050e6..8066458dfde1a3 100644
--- a/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiTitle, EuiSpacer } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiTitle, EuiSpacer, EuiButton } from '@elastic/eui';
 import { LocationDurationLine } from '../../../../common/types';
 import { MLIntegrationComponent } from '../ml/ml_integeration';
 import { AnomalyRecords } from '../../../state/actions';
@@ -18,6 +18,7 @@ interface DurationChartProps {
   hasMLJob: boolean;
   anomalies: AnomalyRecords | null;
   locationDurationLines: LocationDurationLine[];
+  exploratoryViewLink: string;
 }
 
 /**
@@ -27,6 +28,7 @@ interface DurationChartProps {
  * @param props The props required for this component to render properly
  */
 export const MonitorDurationComponent = ({
+  exploratoryViewLink,
   locationDurationLines,
   anomalies,
   loading,
@@ -34,7 +36,7 @@ export const MonitorDurationComponent = ({
 }: DurationChartProps) => {
   return (
     <EuiPanel paddingSize="m">
-      <EuiFlexGroup alignItems="center" gutterSize="none" responsive={false}>
+      <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
         <EuiFlexItem>
           <EuiTitle size="s">
             <h3>
@@ -56,6 +58,11 @@ export const MonitorDurationComponent = ({
         <EuiFlexItem grow={false}>
           <MLIntegrationComponent />
         </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiButton size="s" isDisabled={loading} href={exploratoryViewLink}>
+            <FormattedMessage id="xpack.uptime.monitorDuration.analyze" defaultMessage="Analyze" />
+          </EuiButton>
+        </EuiFlexItem>
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <DurationChartComponent
diff --git a/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx b/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx
index 30fbdb431b8625..677d580b6979ac 100644
--- a/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/monitor_duration/monitor_duration_container.tsx
@@ -24,6 +24,8 @@ import { JobStat } from '../../../../../ml/public';
 import { MonitorDurationComponent } from './monitor_duration';
 import { MonitorIdParam } from '../../../../common/types';
 import { getMLJobId } from '../../../../common/lib';
+import { createExploratoryViewUrl } from '../../../../../observability/public';
+import { useUptimeSettingsContext } from '../../../contexts/uptime_settings_context';
 
 export const MonitorDuration: React.FC<MonitorIdParam> = ({ monitorId }) => {
   const {
@@ -49,6 +51,23 @@ export const MonitorDuration: React.FC<MonitorIdParam> = ({ monitorId }) => {
 
   const { lastRefresh } = useContext(UptimeRefreshContext);
 
+  const { basePath } = useUptimeSettingsContext();
+
+  const exploratoryViewLink = createExploratoryViewUrl(
+    {
+      [`monitor-duration`]: {
+        reportType: 'upd',
+        time: { from: dateRangeStart, to: dateRangeEnd },
+        reportDefinitions: {
+          'monitor.id': monitorId as string,
+        },
+        breakdown: 'observer.geo.name',
+        operationType: 'average',
+      },
+    },
+    basePath
+  );
+
   useEffect(() => {
     if (isMLAvailable) {
       const anomalyParams = {
@@ -77,6 +96,7 @@ export const MonitorDuration: React.FC<MonitorIdParam> = ({ monitorId }) => {
       anomalies={anomalies}
       hasMLJob={hasMLJob}
       loading={loading || jobsLoading}
+      exploratoryViewLink={exploratoryViewLink}
       locationDurationLines={durationLines?.locationDurationLines ?? []}
     />
   );
diff --git a/x-pack/plugins/uptime/public/components/overview/empty_state/__snapshots__/empty_state.test.tsx.snap b/x-pack/plugins/uptime/public/components/overview/empty_state/__snapshots__/empty_state.test.tsx.snap
deleted file mode 100644
index c106d5d12e54b8..00000000000000
--- a/x-pack/plugins/uptime/public/components/overview/empty_state/__snapshots__/empty_state.test.tsx.snap
+++ /dev/null
@@ -1,2056 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`EmptyState component does not render empty state with appropriate base path and no docs 1`] = `
-<Router
-  history={
-    Object {
-      "action": "POP",
-      "block": [Function],
-      "canGo": [Function],
-      "createHref": [Function],
-      "entries": Array [
-        Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-      ],
-      "go": [Function],
-      "goBack": [Function],
-      "goForward": [Function],
-      "index": 0,
-      "length": 1,
-      "listen": [Function],
-      "location": Object {
-        "hash": "",
-        "key": "TestKeyForTesting",
-        "pathname": "/",
-        "search": "",
-        "state": undefined,
-      },
-      "push": [Function],
-      "replace": [Function],
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EmptyStateComponent
-    loading={false}
-    statesIndexStatus={
-      Object {
-        "docCount": 0,
-        "indexExists": true,
-      }
-    }
-  >
-    <DataOrIndexMissing
-      headingMessage={
-        <FormattedMessage
-          defaultMessage="No uptime data found in index {indexName}"
-          id="xpack.uptime.emptyState.noDataMessage"
-          values={
-            Object {
-              "indexName": <em />,
-            }
-          }
-        />
-      }
-    >
-      <EuiFlexGroup
-        data-test-subj="data-missing"
-        justifyContent="center"
-      >
-        <div
-          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
-          data-test-subj="data-missing"
-        >
-          <EuiFlexItem
-            grow={false}
-            style={
-              Object {
-                "flexBasis": 700,
-              }
-            }
-          >
-            <div
-              className="euiFlexItem euiFlexItem--flexGrowZero"
-              style={
-                Object {
-                  "flexBasis": 700,
-                }
-              }
-            >
-              <EuiSpacer
-                size="m"
-              >
-                <div
-                  className="euiSpacer euiSpacer--m"
-                />
-              </EuiSpacer>
-              <EuiPanel>
-                <div
-                  className="euiPanel euiPanel--paddingMedium euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow"
-                >
-                  <EuiEmptyPrompt
-                    actions={
-                      <EuiFlexGroup>
-                        <EuiFlexItem>
-                          <EuiButton
-                            color="primary"
-                            fill={true}
-                            href="/app/home#/tutorial/uptimeMonitors"
-                          >
-                            <FormattedMessage
-                              defaultMessage="View setup instructions"
-                              id="xpack.uptime.emptyState.viewSetupInstructions"
-                              values={Object {}}
-                            />
-                          </EuiButton>
-                        </EuiFlexItem>
-                        <EuiFlexItem>
-                          <EuiButton
-                            color="primary"
-                            href="/app/uptime/settings"
-                          >
-                            <FormattedMessage
-                              defaultMessage="Update index pattern settings"
-                              id="xpack.uptime.emptyState.updateIndexPattern"
-                              values={Object {}}
-                            />
-                          </EuiButton>
-                        </EuiFlexItem>
-                      </EuiFlexGroup>
-                    }
-                    body={
-                      <React.Fragment>
-                        <p>
-                          <FormattedMessage
-                            defaultMessage="If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services."
-                            id="xpack.uptime.emptyState.configureHeartbeatToGetStartedMessage"
-                            values={Object {}}
-                          />
-                        </p>
-                        <p>
-                          <FormattedMessage
-                            defaultMessage="If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config."
-                            id="xpack.uptime.emptyState.configureHeartbeatIndexSettings"
-                            values={Object {}}
-                          />
-                        </p>
-                      </React.Fragment>
-                    }
-                    iconType="logoUptime"
-                    title={
-                      <EuiTitle
-                        size="l"
-                      >
-                        <h3>
-                          <FormattedMessage
-                            defaultMessage="No uptime data found in index {indexName}"
-                            id="xpack.uptime.emptyState.noDataMessage"
-                            values={
-                              Object {
-                                "indexName": <em />,
-                              }
-                            }
-                          />
-                        </h3>
-                      </EuiTitle>
-                    }
-                  >
-                    <div
-                      className="euiEmptyPrompt"
-                    >
-                      <EuiIcon
-                        color="subdued"
-                        size="xxl"
-                        type="logoUptime"
-                      >
-                        <span
-                          color="subdued"
-                          data-euiicon-type="logoUptime"
-                          size="xxl"
-                        />
-                      </EuiIcon>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiTextColor
-                        color="subdued"
-                      >
-                        <span
-                          className="euiTextColor euiTextColor--subdued"
-                        >
-                          <EuiTitle
-                            size="m"
-                          >
-                            <EuiTitle
-                              className="euiTitle euiTitle--medium"
-                              size="l"
-                            >
-                              <h3
-                                className="euiTitle euiTitle--large euiTitle euiTitle--medium"
-                              >
-                                <FormattedMessage
-                                  defaultMessage="No uptime data found in index {indexName}"
-                                  id="xpack.uptime.emptyState.noDataMessage"
-                                  values={
-                                    Object {
-                                      "indexName": <em />,
-                                    }
-                                  }
-                                >
-                                  No uptime data found in index 
-                                  <em />
-                                </FormattedMessage>
-                              </h3>
-                            </EuiTitle>
-                          </EuiTitle>
-                          <EuiSpacer
-                            size="m"
-                          >
-                            <div
-                              className="euiSpacer euiSpacer--m"
-                            />
-                          </EuiSpacer>
-                          <EuiText>
-                            <div
-                              className="euiText euiText--medium"
-                            >
-                              <p>
-                                <FormattedMessage
-                                  defaultMessage="If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services."
-                                  id="xpack.uptime.emptyState.configureHeartbeatToGetStartedMessage"
-                                  values={Object {}}
-                                >
-                                  If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services.
-                                </FormattedMessage>
-                              </p>
-                              <p>
-                                <FormattedMessage
-                                  defaultMessage="If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config."
-                                  id="xpack.uptime.emptyState.configureHeartbeatIndexSettings"
-                                  values={Object {}}
-                                >
-                                  If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config.
-                                </FormattedMessage>
-                              </p>
-                            </div>
-                          </EuiText>
-                        </span>
-                      </EuiTextColor>
-                      <EuiSpacer
-                        size="l"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--l"
-                        />
-                      </EuiSpacer>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiFlexGroup>
-                        <div
-                          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
-                        >
-                          <EuiFlexItem>
-                            <div
-                              className="euiFlexItem"
-                            >
-                              <EuiButton
-                                color="primary"
-                                fill={true}
-                                href="/app/home#/tutorial/uptimeMonitors"
-                              >
-                                <EuiButtonDisplay
-                                  baseClassName="euiButton"
-                                  color="primary"
-                                  element="a"
-                                  fill={true}
-                                  href="/app/home#/tutorial/uptimeMonitors"
-                                  isDisabled={false}
-                                  rel="noreferrer"
-                                >
-                                  <a
-                                    className="euiButton euiButton--primary euiButton--fill"
-                                    disabled={false}
-                                    href="/app/home#/tutorial/uptimeMonitors"
-                                    rel="noreferrer"
-                                    style={
-                                      Object {
-                                        "minWidth": undefined,
-                                      }
-                                    }
-                                  >
-                                    <EuiButtonContent
-                                      className="euiButton__content"
-                                      iconSide="left"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButton__text",
-                                        }
-                                      }
-                                    >
-                                      <span
-                                        className="euiButtonContent euiButton__content"
-                                      >
-                                        <span
-                                          className="euiButton__text"
-                                        >
-                                          <FormattedMessage
-                                            defaultMessage="View setup instructions"
-                                            id="xpack.uptime.emptyState.viewSetupInstructions"
-                                            values={Object {}}
-                                          >
-                                            View setup instructions
-                                          </FormattedMessage>
-                                        </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </a>
-                                </EuiButtonDisplay>
-                              </EuiButton>
-                            </div>
-                          </EuiFlexItem>
-                          <EuiFlexItem>
-                            <div
-                              className="euiFlexItem"
-                            >
-                              <EuiButton
-                                color="primary"
-                                href="/app/uptime/settings"
-                              >
-                                <EuiButtonDisplay
-                                  baseClassName="euiButton"
-                                  color="primary"
-                                  element="a"
-                                  href="/app/uptime/settings"
-                                  isDisabled={false}
-                                  rel="noreferrer"
-                                >
-                                  <a
-                                    className="euiButton euiButton--primary"
-                                    disabled={false}
-                                    href="/app/uptime/settings"
-                                    rel="noreferrer"
-                                    style={
-                                      Object {
-                                        "minWidth": undefined,
-                                      }
-                                    }
-                                  >
-                                    <EuiButtonContent
-                                      className="euiButton__content"
-                                      iconSide="left"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButton__text",
-                                        }
-                                      }
-                                    >
-                                      <span
-                                        className="euiButtonContent euiButton__content"
-                                      >
-                                        <span
-                                          className="euiButton__text"
-                                        >
-                                          <FormattedMessage
-                                            defaultMessage="Update index pattern settings"
-                                            id="xpack.uptime.emptyState.updateIndexPattern"
-                                            values={Object {}}
-                                          >
-                                            Update index pattern settings
-                                          </FormattedMessage>
-                                        </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </a>
-                                </EuiButtonDisplay>
-                              </EuiButton>
-                            </div>
-                          </EuiFlexItem>
-                        </div>
-                      </EuiFlexGroup>
-                    </div>
-                  </EuiEmptyPrompt>
-                </div>
-              </EuiPanel>
-            </div>
-          </EuiFlexItem>
-        </div>
-      </EuiFlexGroup>
-    </DataOrIndexMissing>
-  </EmptyStateComponent>
-</Router>
-`;
-
-exports[`EmptyState component doesn't render child components when count is falsy 1`] = `
-<Router
-  history={
-    Object {
-      "action": "POP",
-      "block": [Function],
-      "canGo": [Function],
-      "createHref": [Function],
-      "entries": Array [
-        Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-      ],
-      "go": [Function],
-      "goBack": [Function],
-      "goForward": [Function],
-      "index": 0,
-      "length": 1,
-      "listen": [Function],
-      "location": Object {
-        "hash": "",
-        "key": "TestKeyForTesting",
-        "pathname": "/",
-        "search": "",
-        "state": undefined,
-      },
-      "push": [Function],
-      "replace": [Function],
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EmptyStateComponent
-    loading={false}
-    statesIndexStatus={null}
-  >
-    <DataOrIndexMissing
-      headingMessage={
-        <FormattedMessage
-          defaultMessage="No indices found matching pattern {indexName}"
-          id="xpack.uptime.emptyState.noIndexTitle"
-          values={
-            Object {
-              "indexName": <em />,
-            }
-          }
-        />
-      }
-    >
-      <EuiFlexGroup
-        data-test-subj="data-missing"
-        justifyContent="center"
-      >
-        <div
-          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
-          data-test-subj="data-missing"
-        >
-          <EuiFlexItem
-            grow={false}
-            style={
-              Object {
-                "flexBasis": 700,
-              }
-            }
-          >
-            <div
-              className="euiFlexItem euiFlexItem--flexGrowZero"
-              style={
-                Object {
-                  "flexBasis": 700,
-                }
-              }
-            >
-              <EuiSpacer
-                size="m"
-              >
-                <div
-                  className="euiSpacer euiSpacer--m"
-                />
-              </EuiSpacer>
-              <EuiPanel>
-                <div
-                  className="euiPanel euiPanel--paddingMedium euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow"
-                >
-                  <EuiEmptyPrompt
-                    actions={
-                      <EuiFlexGroup>
-                        <EuiFlexItem>
-                          <EuiButton
-                            color="primary"
-                            fill={true}
-                            href="/app/home#/tutorial/uptimeMonitors"
-                          >
-                            <FormattedMessage
-                              defaultMessage="View setup instructions"
-                              id="xpack.uptime.emptyState.viewSetupInstructions"
-                              values={Object {}}
-                            />
-                          </EuiButton>
-                        </EuiFlexItem>
-                        <EuiFlexItem>
-                          <EuiButton
-                            color="primary"
-                            href="/app/uptime/settings"
-                          >
-                            <FormattedMessage
-                              defaultMessage="Update index pattern settings"
-                              id="xpack.uptime.emptyState.updateIndexPattern"
-                              values={Object {}}
-                            />
-                          </EuiButton>
-                        </EuiFlexItem>
-                      </EuiFlexGroup>
-                    }
-                    body={
-                      <React.Fragment>
-                        <p>
-                          <FormattedMessage
-                            defaultMessage="If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services."
-                            id="xpack.uptime.emptyState.configureHeartbeatToGetStartedMessage"
-                            values={Object {}}
-                          />
-                        </p>
-                        <p>
-                          <FormattedMessage
-                            defaultMessage="If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config."
-                            id="xpack.uptime.emptyState.configureHeartbeatIndexSettings"
-                            values={Object {}}
-                          />
-                        </p>
-                      </React.Fragment>
-                    }
-                    iconType="logoUptime"
-                    title={
-                      <EuiTitle
-                        size="l"
-                      >
-                        <h3>
-                          <FormattedMessage
-                            defaultMessage="No indices found matching pattern {indexName}"
-                            id="xpack.uptime.emptyState.noIndexTitle"
-                            values={
-                              Object {
-                                "indexName": <em />,
-                              }
-                            }
-                          />
-                        </h3>
-                      </EuiTitle>
-                    }
-                  >
-                    <div
-                      className="euiEmptyPrompt"
-                    >
-                      <EuiIcon
-                        color="subdued"
-                        size="xxl"
-                        type="logoUptime"
-                      >
-                        <span
-                          color="subdued"
-                          data-euiicon-type="logoUptime"
-                          size="xxl"
-                        />
-                      </EuiIcon>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiTextColor
-                        color="subdued"
-                      >
-                        <span
-                          className="euiTextColor euiTextColor--subdued"
-                        >
-                          <EuiTitle
-                            size="m"
-                          >
-                            <EuiTitle
-                              className="euiTitle euiTitle--medium"
-                              size="l"
-                            >
-                              <h3
-                                className="euiTitle euiTitle--large euiTitle euiTitle--medium"
-                              >
-                                <FormattedMessage
-                                  defaultMessage="No indices found matching pattern {indexName}"
-                                  id="xpack.uptime.emptyState.noIndexTitle"
-                                  values={
-                                    Object {
-                                      "indexName": <em />,
-                                    }
-                                  }
-                                >
-                                  No indices found matching pattern 
-                                  <em />
-                                </FormattedMessage>
-                              </h3>
-                            </EuiTitle>
-                          </EuiTitle>
-                          <EuiSpacer
-                            size="m"
-                          >
-                            <div
-                              className="euiSpacer euiSpacer--m"
-                            />
-                          </EuiSpacer>
-                          <EuiText>
-                            <div
-                              className="euiText euiText--medium"
-                            >
-                              <p>
-                                <FormattedMessage
-                                  defaultMessage="If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services."
-                                  id="xpack.uptime.emptyState.configureHeartbeatToGetStartedMessage"
-                                  values={Object {}}
-                                >
-                                  If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services.
-                                </FormattedMessage>
-                              </p>
-                              <p>
-                                <FormattedMessage
-                                  defaultMessage="If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config."
-                                  id="xpack.uptime.emptyState.configureHeartbeatIndexSettings"
-                                  values={Object {}}
-                                >
-                                  If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config.
-                                </FormattedMessage>
-                              </p>
-                            </div>
-                          </EuiText>
-                        </span>
-                      </EuiTextColor>
-                      <EuiSpacer
-                        size="l"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--l"
-                        />
-                      </EuiSpacer>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiFlexGroup>
-                        <div
-                          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
-                        >
-                          <EuiFlexItem>
-                            <div
-                              className="euiFlexItem"
-                            >
-                              <EuiButton
-                                color="primary"
-                                fill={true}
-                                href="/app/home#/tutorial/uptimeMonitors"
-                              >
-                                <EuiButtonDisplay
-                                  baseClassName="euiButton"
-                                  color="primary"
-                                  element="a"
-                                  fill={true}
-                                  href="/app/home#/tutorial/uptimeMonitors"
-                                  isDisabled={false}
-                                  rel="noreferrer"
-                                >
-                                  <a
-                                    className="euiButton euiButton--primary euiButton--fill"
-                                    disabled={false}
-                                    href="/app/home#/tutorial/uptimeMonitors"
-                                    rel="noreferrer"
-                                    style={
-                                      Object {
-                                        "minWidth": undefined,
-                                      }
-                                    }
-                                  >
-                                    <EuiButtonContent
-                                      className="euiButton__content"
-                                      iconSide="left"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButton__text",
-                                        }
-                                      }
-                                    >
-                                      <span
-                                        className="euiButtonContent euiButton__content"
-                                      >
-                                        <span
-                                          className="euiButton__text"
-                                        >
-                                          <FormattedMessage
-                                            defaultMessage="View setup instructions"
-                                            id="xpack.uptime.emptyState.viewSetupInstructions"
-                                            values={Object {}}
-                                          >
-                                            View setup instructions
-                                          </FormattedMessage>
-                                        </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </a>
-                                </EuiButtonDisplay>
-                              </EuiButton>
-                            </div>
-                          </EuiFlexItem>
-                          <EuiFlexItem>
-                            <div
-                              className="euiFlexItem"
-                            >
-                              <EuiButton
-                                color="primary"
-                                href="/app/uptime/settings"
-                              >
-                                <EuiButtonDisplay
-                                  baseClassName="euiButton"
-                                  color="primary"
-                                  element="a"
-                                  href="/app/uptime/settings"
-                                  isDisabled={false}
-                                  rel="noreferrer"
-                                >
-                                  <a
-                                    className="euiButton euiButton--primary"
-                                    disabled={false}
-                                    href="/app/uptime/settings"
-                                    rel="noreferrer"
-                                    style={
-                                      Object {
-                                        "minWidth": undefined,
-                                      }
-                                    }
-                                  >
-                                    <EuiButtonContent
-                                      className="euiButton__content"
-                                      iconSide="left"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButton__text",
-                                        }
-                                      }
-                                    >
-                                      <span
-                                        className="euiButtonContent euiButton__content"
-                                      >
-                                        <span
-                                          className="euiButton__text"
-                                        >
-                                          <FormattedMessage
-                                            defaultMessage="Update index pattern settings"
-                                            id="xpack.uptime.emptyState.updateIndexPattern"
-                                            values={Object {}}
-                                          >
-                                            Update index pattern settings
-                                          </FormattedMessage>
-                                        </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </a>
-                                </EuiButtonDisplay>
-                              </EuiButton>
-                            </div>
-                          </EuiFlexItem>
-                        </div>
-                      </EuiFlexGroup>
-                    </div>
-                  </EuiEmptyPrompt>
-                </div>
-              </EuiPanel>
-            </div>
-          </EuiFlexItem>
-        </div>
-      </EuiFlexGroup>
-    </DataOrIndexMissing>
-  </EmptyStateComponent>
-</Router>
-`;
-
-exports[`EmptyState component notifies when index does not exist 1`] = `
-<Router
-  history={
-    Object {
-      "action": "POP",
-      "block": [Function],
-      "canGo": [Function],
-      "createHref": [Function],
-      "entries": Array [
-        Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-      ],
-      "go": [Function],
-      "goBack": [Function],
-      "goForward": [Function],
-      "index": 0,
-      "length": 1,
-      "listen": [Function],
-      "location": Object {
-        "hash": "",
-        "key": "TestKeyForTesting",
-        "pathname": "/",
-        "search": "",
-        "state": undefined,
-      },
-      "push": [Function],
-      "replace": [Function],
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EmptyStateComponent
-    loading={false}
-    statesIndexStatus={
-      Object {
-        "docCount": 1,
-        "indexExists": false,
-      }
-    }
-  >
-    <DataOrIndexMissing
-      headingMessage={
-        <FormattedMessage
-          defaultMessage="No indices found matching pattern {indexName}"
-          id="xpack.uptime.emptyState.noIndexTitle"
-          values={
-            Object {
-              "indexName": <em />,
-            }
-          }
-        />
-      }
-    >
-      <EuiFlexGroup
-        data-test-subj="data-missing"
-        justifyContent="center"
-      >
-        <div
-          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
-          data-test-subj="data-missing"
-        >
-          <EuiFlexItem
-            grow={false}
-            style={
-              Object {
-                "flexBasis": 700,
-              }
-            }
-          >
-            <div
-              className="euiFlexItem euiFlexItem--flexGrowZero"
-              style={
-                Object {
-                  "flexBasis": 700,
-                }
-              }
-            >
-              <EuiSpacer
-                size="m"
-              >
-                <div
-                  className="euiSpacer euiSpacer--m"
-                />
-              </EuiSpacer>
-              <EuiPanel>
-                <div
-                  className="euiPanel euiPanel--paddingMedium euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow"
-                >
-                  <EuiEmptyPrompt
-                    actions={
-                      <EuiFlexGroup>
-                        <EuiFlexItem>
-                          <EuiButton
-                            color="primary"
-                            fill={true}
-                            href="/app/home#/tutorial/uptimeMonitors"
-                          >
-                            <FormattedMessage
-                              defaultMessage="View setup instructions"
-                              id="xpack.uptime.emptyState.viewSetupInstructions"
-                              values={Object {}}
-                            />
-                          </EuiButton>
-                        </EuiFlexItem>
-                        <EuiFlexItem>
-                          <EuiButton
-                            color="primary"
-                            href="/app/uptime/settings"
-                          >
-                            <FormattedMessage
-                              defaultMessage="Update index pattern settings"
-                              id="xpack.uptime.emptyState.updateIndexPattern"
-                              values={Object {}}
-                            />
-                          </EuiButton>
-                        </EuiFlexItem>
-                      </EuiFlexGroup>
-                    }
-                    body={
-                      <React.Fragment>
-                        <p>
-                          <FormattedMessage
-                            defaultMessage="If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services."
-                            id="xpack.uptime.emptyState.configureHeartbeatToGetStartedMessage"
-                            values={Object {}}
-                          />
-                        </p>
-                        <p>
-                          <FormattedMessage
-                            defaultMessage="If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config."
-                            id="xpack.uptime.emptyState.configureHeartbeatIndexSettings"
-                            values={Object {}}
-                          />
-                        </p>
-                      </React.Fragment>
-                    }
-                    iconType="logoUptime"
-                    title={
-                      <EuiTitle
-                        size="l"
-                      >
-                        <h3>
-                          <FormattedMessage
-                            defaultMessage="No indices found matching pattern {indexName}"
-                            id="xpack.uptime.emptyState.noIndexTitle"
-                            values={
-                              Object {
-                                "indexName": <em />,
-                              }
-                            }
-                          />
-                        </h3>
-                      </EuiTitle>
-                    }
-                  >
-                    <div
-                      className="euiEmptyPrompt"
-                    >
-                      <EuiIcon
-                        color="subdued"
-                        size="xxl"
-                        type="logoUptime"
-                      >
-                        <span
-                          color="subdued"
-                          data-euiicon-type="logoUptime"
-                          size="xxl"
-                        />
-                      </EuiIcon>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiTextColor
-                        color="subdued"
-                      >
-                        <span
-                          className="euiTextColor euiTextColor--subdued"
-                        >
-                          <EuiTitle
-                            size="m"
-                          >
-                            <EuiTitle
-                              className="euiTitle euiTitle--medium"
-                              size="l"
-                            >
-                              <h3
-                                className="euiTitle euiTitle--large euiTitle euiTitle--medium"
-                              >
-                                <FormattedMessage
-                                  defaultMessage="No indices found matching pattern {indexName}"
-                                  id="xpack.uptime.emptyState.noIndexTitle"
-                                  values={
-                                    Object {
-                                      "indexName": <em />,
-                                    }
-                                  }
-                                >
-                                  No indices found matching pattern 
-                                  <em />
-                                </FormattedMessage>
-                              </h3>
-                            </EuiTitle>
-                          </EuiTitle>
-                          <EuiSpacer
-                            size="m"
-                          >
-                            <div
-                              className="euiSpacer euiSpacer--m"
-                            />
-                          </EuiSpacer>
-                          <EuiText>
-                            <div
-                              className="euiText euiText--medium"
-                            >
-                              <p>
-                                <FormattedMessage
-                                  defaultMessage="If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services."
-                                  id="xpack.uptime.emptyState.configureHeartbeatToGetStartedMessage"
-                                  values={Object {}}
-                                >
-                                  If you have not setup heartbeat yet, you can setup heartbeat to start monitoring your services.
-                                </FormattedMessage>
-                              </p>
-                              <p>
-                                <FormattedMessage
-                                  defaultMessage="If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config."
-                                  id="xpack.uptime.emptyState.configureHeartbeatIndexSettings"
-                                  values={Object {}}
-                                >
-                                  If you have setup heartbeat and confirmed data is being sent to Elasticsearch, update your index pattern settings and insure they are aligned with your Heartbeat config.
-                                </FormattedMessage>
-                              </p>
-                            </div>
-                          </EuiText>
-                        </span>
-                      </EuiTextColor>
-                      <EuiSpacer
-                        size="l"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--l"
-                        />
-                      </EuiSpacer>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiFlexGroup>
-                        <div
-                          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
-                        >
-                          <EuiFlexItem>
-                            <div
-                              className="euiFlexItem"
-                            >
-                              <EuiButton
-                                color="primary"
-                                fill={true}
-                                href="/app/home#/tutorial/uptimeMonitors"
-                              >
-                                <EuiButtonDisplay
-                                  baseClassName="euiButton"
-                                  color="primary"
-                                  element="a"
-                                  fill={true}
-                                  href="/app/home#/tutorial/uptimeMonitors"
-                                  isDisabled={false}
-                                  rel="noreferrer"
-                                >
-                                  <a
-                                    className="euiButton euiButton--primary euiButton--fill"
-                                    disabled={false}
-                                    href="/app/home#/tutorial/uptimeMonitors"
-                                    rel="noreferrer"
-                                    style={
-                                      Object {
-                                        "minWidth": undefined,
-                                      }
-                                    }
-                                  >
-                                    <EuiButtonContent
-                                      className="euiButton__content"
-                                      iconSide="left"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButton__text",
-                                        }
-                                      }
-                                    >
-                                      <span
-                                        className="euiButtonContent euiButton__content"
-                                      >
-                                        <span
-                                          className="euiButton__text"
-                                        >
-                                          <FormattedMessage
-                                            defaultMessage="View setup instructions"
-                                            id="xpack.uptime.emptyState.viewSetupInstructions"
-                                            values={Object {}}
-                                          >
-                                            View setup instructions
-                                          </FormattedMessage>
-                                        </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </a>
-                                </EuiButtonDisplay>
-                              </EuiButton>
-                            </div>
-                          </EuiFlexItem>
-                          <EuiFlexItem>
-                            <div
-                              className="euiFlexItem"
-                            >
-                              <EuiButton
-                                color="primary"
-                                href="/app/uptime/settings"
-                              >
-                                <EuiButtonDisplay
-                                  baseClassName="euiButton"
-                                  color="primary"
-                                  element="a"
-                                  href="/app/uptime/settings"
-                                  isDisabled={false}
-                                  rel="noreferrer"
-                                >
-                                  <a
-                                    className="euiButton euiButton--primary"
-                                    disabled={false}
-                                    href="/app/uptime/settings"
-                                    rel="noreferrer"
-                                    style={
-                                      Object {
-                                        "minWidth": undefined,
-                                      }
-                                    }
-                                  >
-                                    <EuiButtonContent
-                                      className="euiButton__content"
-                                      iconSide="left"
-                                      textProps={
-                                        Object {
-                                          "className": "euiButton__text",
-                                        }
-                                      }
-                                    >
-                                      <span
-                                        className="euiButtonContent euiButton__content"
-                                      >
-                                        <span
-                                          className="euiButton__text"
-                                        >
-                                          <FormattedMessage
-                                            defaultMessage="Update index pattern settings"
-                                            id="xpack.uptime.emptyState.updateIndexPattern"
-                                            values={Object {}}
-                                          >
-                                            Update index pattern settings
-                                          </FormattedMessage>
-                                        </span>
-                                      </span>
-                                    </EuiButtonContent>
-                                  </a>
-                                </EuiButtonDisplay>
-                              </EuiButton>
-                            </div>
-                          </EuiFlexItem>
-                        </div>
-                      </EuiFlexGroup>
-                    </div>
-                  </EuiEmptyPrompt>
-                </div>
-              </EuiPanel>
-            </div>
-          </EuiFlexItem>
-        </div>
-      </EuiFlexGroup>
-    </DataOrIndexMissing>
-  </EmptyStateComponent>
-</Router>
-`;
-
-exports[`EmptyState component renders child components when count is truthy 1`] = `
-<ContextProvider
-  value={
-    Object {
-      "history": Object {
-        "action": "POP",
-        "block": [Function],
-        "canGo": [Function],
-        "createHref": [Function],
-        "entries": Array [
-          Object {
-            "hash": "",
-            "key": "TestKeyForTesting",
-            "pathname": "/",
-            "search": "",
-            "state": undefined,
-          },
-        ],
-        "go": [Function],
-        "goBack": [Function],
-        "goForward": [Function],
-        "index": 0,
-        "length": 1,
-        "listen": [Function],
-        "location": Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-        "push": [Function],
-        "replace": [Function],
-      },
-      "location": Object {
-        "hash": "",
-        "key": "TestKeyForTesting",
-        "pathname": "/",
-        "search": "",
-        "state": undefined,
-      },
-      "match": Object {
-        "isExact": true,
-        "params": Object {},
-        "path": "/",
-        "url": "/",
-      },
-      "staticContext": undefined,
-    }
-  }
->
-  <ContextProvider
-    value={
-      Object {
-        "action": "POP",
-        "block": [Function],
-        "canGo": [Function],
-        "createHref": [Function],
-        "entries": Array [
-          Object {
-            "hash": "",
-            "key": "TestKeyForTesting",
-            "pathname": "/",
-            "search": "",
-            "state": undefined,
-          },
-        ],
-        "go": [Function],
-        "goBack": [Function],
-        "goForward": [Function],
-        "index": 0,
-        "length": 1,
-        "listen": [Function],
-        "location": Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-        "push": [Function],
-        "replace": [Function],
-      }
-    }
-  >
-    <EmptyStateComponent
-      loading={false}
-      statesIndexStatus={
-        Object {
-          "docCount": 1,
-          "indexExists": true,
-        }
-      }
-    >
-      <div>
-        Foo
-      </div>
-      <div>
-        Bar
-      </div>
-      <div>
-        Baz
-      </div>
-    </EmptyStateComponent>
-  </ContextProvider>
-</ContextProvider>
-`;
-
-exports[`EmptyState component renders error message when an error occurs 1`] = `
-<Router
-  history={
-    Object {
-      "action": "POP",
-      "block": [Function],
-      "canGo": [Function],
-      "createHref": [Function],
-      "entries": Array [
-        Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-      ],
-      "go": [Function],
-      "goBack": [Function],
-      "goForward": [Function],
-      "index": 0,
-      "length": 1,
-      "listen": [Function],
-      "location": Object {
-        "hash": "",
-        "key": "TestKeyForTesting",
-        "pathname": "/",
-        "search": "",
-        "state": undefined,
-      },
-      "push": [Function],
-      "replace": [Function],
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EmptyStateComponent
-    errors={
-      Array [
-        [error: There was an error fetching your data.],
-      ]
-    }
-    loading={false}
-    statesIndexStatus={null}
-  >
-    <EmptyStateError
-      errors={
-        Array [
-          [error: There was an error fetching your data.],
-        ]
-      }
-    >
-      <EuiFlexGroup
-        justifyContent="center"
-      >
-        <div
-          className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
-        >
-          <EuiFlexItem
-            grow={false}
-          >
-            <div
-              className="euiFlexItem euiFlexItem--flexGrowZero"
-            >
-              <EuiPanel>
-                <div
-                  className="euiPanel euiPanel--paddingMedium euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow"
-                >
-                  <EuiEmptyPrompt
-                    body={
-                      <React.Fragment>
-                        <p>
-                          There was an error fetching your data.
-                        </p>
-                      </React.Fragment>
-                    }
-                    iconColor="subdued"
-                    iconType="securityApp"
-                    title={
-                      <EuiTitle
-                        size="m"
-                      >
-                        <h3>
-                          Error
-                        </h3>
-                      </EuiTitle>
-                    }
-                  >
-                    <div
-                      className="euiEmptyPrompt"
-                    >
-                      <EuiIcon
-                        color="subdued"
-                        size="xxl"
-                        type="securityApp"
-                      >
-                        <span
-                          color="subdued"
-                          data-euiicon-type="securityApp"
-                          size="xxl"
-                        />
-                      </EuiIcon>
-                      <EuiSpacer
-                        size="s"
-                      >
-                        <div
-                          className="euiSpacer euiSpacer--s"
-                        />
-                      </EuiSpacer>
-                      <EuiTextColor
-                        color="subdued"
-                      >
-                        <span
-                          className="euiTextColor euiTextColor--subdued"
-                        >
-                          <EuiTitle
-                            size="m"
-                          >
-                            <EuiTitle
-                              className="euiTitle euiTitle--medium"
-                              size="m"
-                            >
-                              <h3
-                                className="euiTitle euiTitle--medium euiTitle euiTitle--medium"
-                              >
-                                Error
-                              </h3>
-                            </EuiTitle>
-                          </EuiTitle>
-                          <EuiSpacer
-                            size="m"
-                          >
-                            <div
-                              className="euiSpacer euiSpacer--m"
-                            />
-                          </EuiSpacer>
-                          <EuiText>
-                            <div
-                              className="euiText euiText--medium"
-                            >
-                              <p
-                                key="There was an error fetching your data."
-                              >
-                                There was an error fetching your data.
-                              </p>
-                            </div>
-                          </EuiText>
-                        </span>
-                      </EuiTextColor>
-                    </div>
-                  </EuiEmptyPrompt>
-                </div>
-              </EuiPanel>
-            </div>
-          </EuiFlexItem>
-        </div>
-      </EuiFlexGroup>
-    </EmptyStateError>
-  </EmptyStateComponent>
-</Router>
-`;
-
-exports[`EmptyState component renders loading state if no errors or doc count 1`] = `
-<Router
-  history={
-    Object {
-      "action": "POP",
-      "block": [Function],
-      "canGo": [Function],
-      "createHref": [Function],
-      "entries": Array [
-        Object {
-          "hash": "",
-          "key": "TestKeyForTesting",
-          "pathname": "/",
-          "search": "",
-          "state": undefined,
-        },
-      ],
-      "go": [Function],
-      "goBack": [Function],
-      "goForward": [Function],
-      "index": 0,
-      "length": 1,
-      "listen": [Function],
-      "location": Object {
-        "hash": "",
-        "key": "TestKeyForTesting",
-        "pathname": "/",
-        "search": "",
-        "state": undefined,
-      },
-      "push": [Function],
-      "replace": [Function],
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
->
-  <EmptyStateComponent
-    loading={true}
-    statesIndexStatus={null}
-  >
-    <EmptyStateLoading>
-      <EuiEmptyPrompt
-        body={
-          <React.Fragment>
-            <EuiLoadingSpinner
-              size="xl"
-            />
-            <EuiSpacer />
-            <EuiTitle
-              size="l"
-            >
-              <h2>
-                Loading…
-              </h2>
-            </EuiTitle>
-          </React.Fragment>
-        }
-      >
-        <div
-          className="euiEmptyPrompt"
-        >
-          <EuiTextColor
-            color="subdued"
-          >
-            <span
-              className="euiTextColor euiTextColor--subdued"
-            >
-              <EuiText>
-                <div
-                  className="euiText euiText--medium"
-                >
-                  <EuiLoadingSpinner
-                    size="xl"
-                  >
-                    <span
-                      className="euiLoadingSpinner euiLoadingSpinner--xLarge"
-                    />
-                  </EuiLoadingSpinner>
-                  <EuiSpacer>
-                    <div
-                      className="euiSpacer euiSpacer--l"
-                    />
-                  </EuiSpacer>
-                  <EuiTitle
-                    size="l"
-                  >
-                    <h2
-                      className="euiTitle euiTitle--large"
-                    >
-                      Loading…
-                    </h2>
-                  </EuiTitle>
-                </div>
-              </EuiText>
-            </span>
-          </EuiTextColor>
-        </div>
-      </EuiEmptyPrompt>
-    </EmptyStateLoading>
-  </EmptyStateComponent>
-</Router>
-`;
diff --git a/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.test.tsx b/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.test.tsx
index a617ba0db1eb33..d6a64e65110246 100644
--- a/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.test.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.test.tsx
@@ -6,10 +6,11 @@
  */
 
 import React from 'react';
+import { screen } from '@testing-library/react';
 import { EmptyStateComponent } from './empty_state';
 import { StatesIndexStatus } from '../../../../common/runtime_types';
 import { HttpFetchError, IHttpFetchError } from 'src/core/public';
-import { mountWithRouter, shallowWithRouter } from '../../../lib';
+import { render } from '../../../lib/helper/rtl_helpers';
 
 describe('EmptyState component', () => {
   let statesIndexStatus: StatesIndexStatus;
@@ -22,23 +23,26 @@ describe('EmptyState component', () => {
   });
 
   it('renders child components when count is truthy', () => {
-    const component = shallowWithRouter(
+    render(
       <EmptyStateComponent statesIndexStatus={statesIndexStatus} loading={false}>
         <div>Foo</div>
         <div>Bar</div>
         <div>Baz</div>
       </EmptyStateComponent>
     );
-    expect(component).toMatchSnapshot();
+
+    expect(screen.getByText('Foo')).toBeInTheDocument();
+    expect(screen.getByText('Bar')).toBeInTheDocument();
+    expect(screen.getByText('Baz')).toBeInTheDocument();
   });
 
   it(`doesn't render child components when count is falsy`, () => {
-    const component = mountWithRouter(
+    render(
       <EmptyStateComponent statesIndexStatus={null} loading={false}>
-        <div>Shouldn&apos;t be rendered</div>
+        <div>Should not be rendered</div>
       </EmptyStateComponent>
     );
-    expect(component).toMatchSnapshot();
+    expect(screen.queryByText('Should not be rendered')).toBeNull();
   });
 
   it(`renders error message when an error occurs`, () => {
@@ -47,21 +51,21 @@ describe('EmptyState component', () => {
         body: { message: 'There was an error fetching your data.' },
       }),
     ];
-    const component = mountWithRouter(
+    render(
       <EmptyStateComponent statesIndexStatus={null} errors={errors} loading={false}>
-        <div>Shouldn&apos;t appear...</div>
+        <div>Should not appear...</div>
       </EmptyStateComponent>
     );
-    expect(component).toMatchSnapshot();
+    expect(screen.queryByText('Should not appear...')).toBeNull();
   });
 
   it('renders loading state if no errors or doc count', () => {
-    const component = mountWithRouter(
+    render(
       <EmptyStateComponent loading={true} statesIndexStatus={null}>
         <div>Should appear even while loading...</div>
       </EmptyStateComponent>
     );
-    expect(component).toMatchSnapshot();
+    expect(screen.queryByText('Should appear even while loading...')).toBeInTheDocument();
   });
 
   it('does not render empty state with appropriate base path and no docs', () => {
@@ -69,21 +73,25 @@ describe('EmptyState component', () => {
       docCount: 0,
       indexExists: true,
     };
-    const component = mountWithRouter(
+    const text = 'If this is in the snapshot the test should fail';
+    render(
       <EmptyStateComponent statesIndexStatus={statesIndexStatus} loading={false}>
-        <div>If this is in the snapshot the test should fail</div>
+        <div>{text}</div>
       </EmptyStateComponent>
     );
-    expect(component).toMatchSnapshot();
+    expect(screen.queryByText(text)).toBeNull();
   });
 
   it('notifies when index does not exist', () => {
     statesIndexStatus.indexExists = false;
-    const component = mountWithRouter(
+
+    const text = 'This text should not render';
+
+    render(
       <EmptyStateComponent statesIndexStatus={statesIndexStatus} loading={false}>
-        <div>This text should not render</div>
+        <div>{text}</div>
       </EmptyStateComponent>
     );
-    expect(component).toMatchSnapshot();
+    expect(screen.queryByText(text)).toBeNull();
   });
 });
diff --git a/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.tsx b/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.tsx
index 415d9cb5adcc6e..5a28c7c2592d73 100644
--- a/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state.tsx
@@ -33,36 +33,28 @@ export const EmptyStateComponent = ({
   }
   const { indexExists, docCount } = statesIndexStatus ?? {};
 
-  if (loading && (!indexExists || docCount === 0 || !statesIndexStatus)) {
-    return <EmptyStateLoading />;
-  }
+  const isLoading = loading && (!indexExists || docCount === 0 || !statesIndexStatus);
+
+  const noIndicesMessage = (
+    <FormattedMessage
+      id="xpack.uptime.emptyState.noIndexTitle"
+      defaultMessage="No indices found matching pattern {indexName}"
+      values={{ indexName: <em>{settings?.heartbeatIndices}</em> }}
+    />
+  );
+
+  const noUptimeDataMessage = (
+    <FormattedMessage
+      id="xpack.uptime.emptyState.noDataMessage"
+      defaultMessage="No uptime data found in index {indexName}"
+      values={{ indexName: <em>{settings?.heartbeatIndices}</em> }}
+    />
+  );
 
-  if (!indexExists) {
-    return (
-      <DataOrIndexMissing
-        settings={settings}
-        headingMessage={
-          <FormattedMessage
-            id="xpack.uptime.emptyState.noIndexTitle"
-            defaultMessage="No indices found matching pattern {indexName}"
-            values={{ indexName: <em>{settings?.heartbeatIndices}</em> }}
-          />
-        }
-      />
-    );
-  } else if (indexExists && docCount === 0) {
-    return (
-      <DataOrIndexMissing
-        settings={settings}
-        headingMessage={
-          <FormattedMessage
-            id="xpack.uptime.emptyState.noDataMessage"
-            defaultMessage="No uptime data found in index {indexName}"
-            values={{ indexName: <em>{settings?.heartbeatIndices}</em> }}
-          />
-        }
-      />
-    );
+  if (!indexExists && !isLoading) {
+    return <DataOrIndexMissing settings={settings} headingMessage={noIndicesMessage} />;
+  } else if (indexExists && docCount === 0 && !isLoading) {
+    return <DataOrIndexMissing settings={settings} headingMessage={noUptimeDataMessage} />;
   }
   /**
    * We choose to render the children any time the count > 0, even if
@@ -71,6 +63,11 @@ export const EmptyStateComponent = ({
    * jittery UX any time the components refresh. This way we'll keep the stale
    * state displayed during the fetching process.
    */
-  return <Fragment>{children}</Fragment>;
+  return (
+    <Fragment>
+      {isLoading && <EmptyStateLoading />}
+      <div style={{ visibility: isLoading ? 'hidden' : 'initial' }}>{children}</div>
+    </Fragment>
+  );
   // }
 };
diff --git a/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state_container.tsx b/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state_container.tsx
index 83fd2f78278d26..562e45727dda7d 100644
--- a/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state_container.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/empty_state/empty_state_container.tsx
@@ -23,15 +23,18 @@ export const EmptyState: React.FC = ({ children }) => {
 
   const dispatch = useDispatch();
 
+  const noDataInfo = !data || data?.docCount === 0 || data?.indexExists === false;
+
   useEffect(() => {
-    if (!data || data?.docCount === 0 || data?.indexExists === false) {
+    if (noDataInfo) {
+      // only call when we haven't fetched it already
       dispatch(indexStatusAction.get());
     }
-    // Don't add data , it will create endless loop
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [dispatch, lastRefresh]);
+  }, [dispatch, lastRefresh, noDataInfo]);
 
   useEffect(() => {
+    // using separate side effect, we want to call index status,
+    // every statue indices setting changes
     dispatch(indexStatusAction.get());
   }, [dispatch, heartbeatIndices]);
 
diff --git a/x-pack/plugins/uptime/public/components/overview/monitor_list/monitor_list_container.tsx b/x-pack/plugins/uptime/public/components/overview/monitor_list/monitor_list_container.tsx
index 4fd0a9c0f4b08b..835a89e8f72723 100644
--- a/x-pack/plugins/uptime/public/components/overview/monitor_list/monitor_list_container.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/monitor_list/monitor_list_container.tsx
@@ -12,6 +12,7 @@ import { esKuerySelector, monitorListSelector } from '../../../state/selectors';
 import { MonitorListComponent } from './monitor_list';
 import { useUrlParams } from '../../../hooks';
 import { UptimeRefreshContext } from '../../../contexts';
+import { getConnectorsAction, getMonitorAlertsAction } from '../../../state/alerts/alerts';
 
 export interface MonitorListProps {
   filters?: string;
@@ -65,6 +66,14 @@ export const MonitorList: React.FC<MonitorListProps> = (props) => {
     query,
   ]);
 
+  useEffect(() => {
+    dispatch(getMonitorAlertsAction.get());
+  }, [dispatch]);
+
+  useEffect(() => {
+    dispatch(getConnectorsAction.get());
+  }, [dispatch]);
+
   return (
     <MonitorListComponent
       {...props}
diff --git a/x-pack/plugins/uptime/public/components/overview/query_bar/query_bar.tsx b/x-pack/plugins/uptime/public/components/overview/query_bar/query_bar.tsx
index 39bad0663ff388..54e2789dc666f7 100644
--- a/x-pack/plugins/uptime/public/components/overview/query_bar/query_bar.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/query_bar/query_bar.tsx
@@ -32,12 +32,12 @@ export const isValidKuery = (query: string) => {
 };
 
 export const QueryBar = () => {
-  const { index_pattern: indexPattern } = useIndexPattern();
-
   const { search: urlValue } = useGetUrlParams();
 
   const { query, setQuery } = useQueryBar();
 
+  const { index_pattern: indexPattern } = useIndexPattern(query.language ?? SyntaxType.text);
+
   const [inputVal, setInputVal] = useState<string>(query.query);
 
   const isInValid = () => {
diff --git a/x-pack/plugins/uptime/public/components/overview/query_bar/use_index_pattern.ts b/x-pack/plugins/uptime/public/components/overview/query_bar/use_index_pattern.ts
index 49466cf8d00bf3..ab10afb5b231e5 100644
--- a/x-pack/plugins/uptime/public/components/overview/query_bar/use_index_pattern.ts
+++ b/x-pack/plugins/uptime/public/components/overview/query_bar/use_index_pattern.ts
@@ -9,16 +9,18 @@ import { useEffect } from 'react';
 import { useDispatch, useSelector } from 'react-redux';
 import { getIndexPattern } from '../../../state/actions';
 import { selectIndexPattern } from '../../../state/selectors';
+import { SyntaxType } from './use_query_bar';
 
-export const useIndexPattern = () => {
+export const useIndexPattern = (queryLanguage?: string) => {
   const dispatch = useDispatch();
   const indexPattern = useSelector(selectIndexPattern);
 
   useEffect(() => {
-    if (!indexPattern.index_pattern) {
+    // we only use index pattern for kql queries
+    if (!indexPattern.index_pattern && (!queryLanguage || queryLanguage === SyntaxType.kuery)) {
       dispatch(getIndexPattern());
     }
-  }, [indexPattern.index_pattern, dispatch]);
+  }, [indexPattern.index_pattern, dispatch, queryLanguage]);
 
   return indexPattern;
 };
diff --git a/x-pack/plugins/uptime/public/components/overview/query_bar/use_query_bar.ts b/x-pack/plugins/uptime/public/components/overview/query_bar/use_query_bar.ts
index caf6b08e8fdeae..9e3691497eab6c 100644
--- a/x-pack/plugins/uptime/public/components/overview/query_bar/use_query_bar.ts
+++ b/x-pack/plugins/uptime/public/components/overview/query_bar/use_query_bar.ts
@@ -21,8 +21,6 @@ export enum SyntaxType {
 const SYNTAX_STORAGE = 'uptime:queryBarSyntax';
 
 export const useQueryBar = () => {
-  const { index_pattern: indexPattern } = useIndexPattern();
-
   const dispatch = useDispatch();
 
   const { absoluteDateRangeStart, absoluteDateRangeEnd, ...params } = useGetUrlParams();
@@ -46,6 +44,8 @@ export const useQueryBar = () => {
         }
   );
 
+  const { index_pattern: indexPattern } = useIndexPattern(query.language);
+
   const updateUrlParams = useUrlParams()[1];
 
   const [esFilters, error] = useUpdateKueryString(
diff --git a/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx b/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx
index 37ee7021eb19f3..dacaeb89a5cc58 100644
--- a/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx
+++ b/x-pack/plugins/uptime/public/contexts/uptime_settings_context.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { createContext, useMemo } from 'react';
+import React, { createContext, useContext, useMemo } from 'react';
 import { UptimeAppProps } from '../apps/uptime_app';
 import { CLIENT_DEFAULTS, CONTEXT_DEFAULTS } from '../../common/constants';
 import { CommonlyUsedRange } from '../components/common/uptime_date_picker';
@@ -66,3 +66,5 @@ export const UptimeSettingsContextProvider: React.FC<UptimeAppProps> = ({ childr
 
   return <UptimeSettingsContext.Provider value={value} children={children} />;
 };
+
+export const useUptimeSettingsContext = () => useContext(UptimeSettingsContext);
diff --git a/x-pack/plugins/uptime/public/hooks/use_telemetry.ts b/x-pack/plugins/uptime/public/hooks/use_telemetry.ts
index b9ec9cc5e55162..4ba0179bb54baf 100644
--- a/x-pack/plugins/uptime/public/hooks/use_telemetry.ts
+++ b/x-pack/plugins/uptime/public/hooks/use_telemetry.ts
@@ -38,6 +38,8 @@ export const useUptimeTelemetry = (page?: UptimePage) => {
       dateEnd: dateRangeEnd,
       autoRefreshEnabled: !autorefreshIsPaused,
     };
-    apiService.post(API_URLS.LOG_PAGE_VIEW, params);
+    setTimeout(() => {
+      apiService.post(API_URLS.LOG_PAGE_VIEW, params);
+    }, 100);
   }, [autorefreshInterval, autorefreshIsPaused, dateRangeEnd, dateRangeStart, page]);
 };
diff --git a/x-pack/plugins/uptime/public/pages/overview.tsx b/x-pack/plugins/uptime/public/pages/overview.tsx
index d478fe1bc1f372..846698bc390dba 100644
--- a/x-pack/plugins/uptime/public/pages/overview.tsx
+++ b/x-pack/plugins/uptime/public/pages/overview.tsx
@@ -6,17 +6,14 @@
  */
 
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
-import React, { useEffect } from 'react';
+import React from 'react';
 import styled from 'styled-components';
-import { useDispatch } from 'react-redux';
 
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
 import { useTrackPageview } from '../../../observability/public';
 import { MonitorList } from '../components/overview/monitor_list/monitor_list_container';
 import { EmptyState, FilterGroup } from '../components/overview';
 import { StatusPanel } from '../components/overview/status_panel';
-import { getConnectorsAction, getMonitorAlertsAction } from '../state/alerts/alerts';
-import { useInitApp } from '../hooks/use_init_app';
 import { QueryBar } from '../components/overview/query_bar/query_bar';
 
 const EuiFlexItemStyled = styled(EuiFlexItem)`
@@ -35,15 +32,6 @@ export const OverviewPageComponent = () => {
   useTrackPageview({ app: 'uptime', path: 'overview' });
   useTrackPageview({ app: 'uptime', path: 'overview', delay: 15000 });
 
-  useInitApp();
-
-  const dispatch = useDispatch();
-
-  useEffect(() => {
-    dispatch(getConnectorsAction.get());
-    dispatch(getMonitorAlertsAction.get());
-  }, [dispatch]);
-
   useBreadcrumbs([]); // No extra breadcrumbs on overview
 
   return (
diff --git a/x-pack/plugins/uptime/public/state/effects/index_pattern.ts b/x-pack/plugins/uptime/public/state/effects/index_pattern.ts
index 5142dcc6df0668..687d1fa413ba37 100644
--- a/x-pack/plugins/uptime/public/state/effects/index_pattern.ts
+++ b/x-pack/plugins/uptime/public/state/effects/index_pattern.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import { takeLatest } from 'redux-saga/effects';
+import { takeLeading } from 'redux-saga/effects';
 import { getIndexPattern, getIndexPatternSuccess, getIndexPatternFail } from '../actions';
 import { fetchIndexPattern } from '../api';
 import { fetchEffectFactory } from './fetch_effect';
 
 export function* fetchIndexPatternEffect() {
-  yield takeLatest(
+  yield takeLeading(
     getIndexPattern,
     fetchEffectFactory(fetchIndexPattern, getIndexPatternSuccess, getIndexPatternFail)
   );
diff --git a/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts b/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
index 08b5a0f60521c6..2034a4e5b74bab 100644
--- a/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
+++ b/x-pack/plugins/xpack_legacy/server/routes/settings.test.ts
@@ -9,11 +9,7 @@ import { BehaviorSubject } from 'rxjs';
 import { UnwrapPromise } from '@kbn/utility-types';
 import supertest from 'supertest';
 
-import {
-  LegacyAPICaller,
-  ServiceStatus,
-  ServiceStatusLevels,
-} from '../../../../../src/core/server';
+import { ServiceStatus, ServiceStatusLevels } from '../../../../../src/core/server';
 import {
   contextServiceMock,
   elasticsearchServiceMock,
@@ -31,24 +27,18 @@ export function mockGetClusterInfo(clusterInfo: any) {
   esClient.info.mockResolvedValue({ body: { ...clusterInfo } });
   return esClient;
 }
+
 describe('/api/settings', () => {
   let server: HttpService;
   let httpSetup: HttpSetup;
   let overallStatus$: BehaviorSubject<ServiceStatus>;
-  let mockApiCaller: jest.Mocked<LegacyAPICaller>;
 
   beforeEach(async () => {
-    mockApiCaller = jest.fn();
     server = createHttpServer();
     httpSetup = await server.setup({
       context: contextServiceMock.createSetupContract({
         core: {
           elasticsearch: {
-            legacy: {
-              client: {
-                callAsCurrentUser: mockApiCaller,
-              },
-            },
             client: {
               asCurrentUser: mockGetClusterInfo({ cluster_uuid: 'yyy-yyyyy' }),
             },
diff --git a/x-pack/plugins/xpack_legacy/server/routes/settings.ts b/x-pack/plugins/xpack_legacy/server/routes/settings.ts
index 9117637b70bee6..b9052ca0c84e3d 100644
--- a/x-pack/plugins/xpack_legacy/server/routes/settings.ts
+++ b/x-pack/plugins/xpack_legacy/server/routes/settings.ts
@@ -42,9 +42,7 @@ export function registerSettingsRoute({
       validate: false,
     },
     async (context, req, res) => {
-      const { callAsCurrentUser } = context.core.elasticsearch.legacy.client;
       const collectorFetchContext = {
-        callCluster: callAsCurrentUser,
         esClient: context.core.elasticsearch.client.asCurrentUser,
         soClient: context.core.savedObjects.client,
       };
diff --git a/x-pack/test/accessibility/apps/login_page.ts b/x-pack/test/accessibility/apps/login_page.ts
index f46a6841948107..02d817612671c2 100644
--- a/x-pack/test/accessibility/apps/login_page.ts
+++ b/x-pack/test/accessibility/apps/login_page.ts
@@ -14,8 +14,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const PageObjects = getPageObjects(['common', 'security']);
 
-  // FLAKY: https://github.com/elastic/kibana/issues/96372
-  describe.skip('Security', () => {
+  describe('Security', () => {
     describe('Login Page', () => {
       before(async () => {
         await esArchiver.load('empty_kibana');
diff --git a/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts b/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts
index deb91f6b9b1efc..de44984a50c5b9 100644
--- a/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts
+++ b/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts
@@ -58,7 +58,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const ml = getService('ml');
   const PageObjects = getPageObjects(['common', 'timePicker', 'dashboard']);
-  const dashboardAddPanel = getService('dashboardAddPanel');
   const a11y = getService('a11y'); /* this is the wrapping service around axe */
 
   describe('machine learning embeddables anomaly charts', function () {
@@ -96,10 +95,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('can open job selection flyout', async () => {
           await PageObjects.dashboard.clickCreateDashboardPrompt();
           await ml.dashboardEmbeddables.assertDashboardIsEmpty();
-          await dashboardAddPanel.clickOpenAddPanel();
-          await dashboardAddPanel.ensureAddPanelIsShowing();
-          await dashboardAddPanel.clickAddNewEmbeddableLink('ml_anomaly_charts');
-          await ml.dashboardJobSelectionTable.assertJobSelectionTableExists();
+          await ml.dashboardEmbeddables.openJobSelectionFlyout();
           await a11y.testAppSnapshot();
         });
 
diff --git a/x-pack/test/accessibility/apps/remote_clusters.ts b/x-pack/test/accessibility/apps/remote_clusters.ts
new file mode 100644
index 00000000000000..099e3f9f170d9d
--- /dev/null
+++ b/x-pack/test/accessibility/apps/remote_clusters.ts
@@ -0,0 +1,204 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+import { ClusterPayloadEs } from '../../../plugins/remote_clusters/common/lib';
+
+const emptyPrompt = 'remoteClusterListEmptyPrompt';
+const createButton = 'remoteClusterEmptyPromptCreateButton';
+const pageTitle = 'remoteClusterPageTitle';
+const nameLink = 'remoteClustersTableListClusterLink';
+const editButton = 'remoteClusterTableRowEditButton';
+const deleteButton = 'remoteClusterTableRowRemoveButton';
+const deleteModalTitle = 'confirmModalTitleText';
+const detailsTitle = 'remoteClusterDetailsFlyoutTitle';
+const requestButton = 'remoteClustersRequestButton';
+const requestTitle = 'remoteClusterRequestFlyoutTitle';
+
+interface Payload {
+  persistent: {
+    cluster: {
+      remote: {
+        [k: string]: ClusterPayloadEs;
+      };
+    };
+  };
+}
+
+const getEmptyPayload = () =>
+  ({
+    persistent: {
+      cluster: {
+        remote: {},
+      },
+    },
+  } as Payload);
+
+const getPayloadClusterProxyMode = (name: string): Payload => {
+  const payload = getEmptyPayload();
+  payload.persistent.cluster.remote[name] = {
+    mode: 'proxy',
+    proxy_address: '127.0.0.1:9302',
+    server_name: 'test_server',
+  };
+  return payload;
+};
+
+const getPayloadClusterSniffMode = (name: string): Payload => {
+  const payload = getEmptyPayload();
+  payload.persistent.cluster.remote[name] = {
+    mode: 'sniff',
+    seeds: ['127.0.0.1:9301'],
+  };
+  return payload;
+};
+
+const getDeleteClusterPayload = (name: string): Payload => {
+  const payload = getEmptyPayload();
+  payload.persistent.cluster.remote[name] = {
+    skip_unavailable: null,
+    mode: null,
+    proxy_address: null,
+    proxy_socket_connections: null,
+    server_name: null,
+    seeds: null,
+    node_connections: null,
+    proxy: null,
+  };
+  return payload;
+};
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const PageObjects = getPageObjects(['common', 'security']);
+  const testSubjects = getService('testSubjects');
+  const esClient = getService('es');
+  const a11y = getService('a11y');
+  const retry = getService('retry');
+
+  describe('Remote Clusters', () => {
+    beforeEach(async () => {
+      await PageObjects.common.navigateToApp('remoteClusters');
+    });
+
+    describe('Add remote cluster', () => {
+      it('renders the list view with empty prompt', async () => {
+        await retry.waitFor('empty prompt to be rendered', async () => {
+          return testSubjects.isDisplayed(emptyPrompt);
+        });
+        await a11y.testAppSnapshot();
+      });
+
+      it('renders add remote cluster form', async () => {
+        await retry.waitFor('add remote cluster button to be rendered', async () => {
+          return testSubjects.isDisplayed(createButton);
+        });
+
+        await testSubjects.click(createButton);
+        await retry.waitFor('add remote cluster form to be rendered', async () => {
+          return (await testSubjects.getVisibleText(pageTitle)) === 'Add remote cluster';
+        });
+
+        await a11y.testAppSnapshot();
+      });
+
+      it('renders request flyout', async () => {
+        await retry.waitFor('add remote cluster button to be rendered', async () => {
+          return testSubjects.isDisplayed(createButton);
+        });
+
+        await testSubjects.click(createButton);
+        await retry.waitFor('add remote cluster form to be rendered', async () => {
+          return (await testSubjects.getVisibleText(pageTitle)) === 'Add remote cluster';
+        });
+
+        await testSubjects.click(requestButton);
+        await retry.waitFor('request flyout to be rendered', async () => {
+          return (await testSubjects.getVisibleText(requestTitle)) === 'Request';
+        });
+
+        await a11y.testAppSnapshot();
+      });
+    });
+
+    const modes = ['sniff', 'proxy'];
+
+    modes.forEach((mode: string) => {
+      describe(`Edit remote cluster (${mode} mode)`, () => {
+        const clusterName = mode === 'sniff' ? 'clusterSniffMode' : 'clusterProxyMode';
+        const body =
+          mode === 'sniff'
+            ? getPayloadClusterSniffMode(clusterName)
+            : getPayloadClusterProxyMode(clusterName);
+        before(async () => {
+          await esClient.cluster.putSettings({ body });
+        });
+
+        after(async () => {
+          await esClient.cluster.putSettings({ body: getDeleteClusterPayload(clusterName) });
+        });
+
+        it('renders the list view with remote clusters', async () => {
+          await retry.waitFor('remote clusters list to be rendered', async () => {
+            return testSubjects.isDisplayed(nameLink);
+          });
+          await a11y.testAppSnapshot();
+        });
+
+        it(`renders remote cluster details flyout (${mode} mode)`, async () => {
+          await retry.waitFor('remote clusters list to be rendered', async () => {
+            return testSubjects.isDisplayed(nameLink);
+          });
+
+          await testSubjects.click(nameLink);
+
+          await retry.waitFor('remote cluster details to be rendered', async () => {
+            return (await testSubjects.getVisibleText(detailsTitle)) === clusterName;
+          });
+
+          await a11y.testAppSnapshot();
+        });
+
+        it(`renders delete cluster modal (${mode} mode)`, async () => {
+          await retry.waitFor('remote clusters list to be rendered', async () => {
+            return testSubjects.isDisplayed(nameLink);
+          });
+
+          await testSubjects.click(deleteButton);
+
+          await retry.waitFor('delete cluster modal to be rendered', async () => {
+            return (
+              (await testSubjects.getVisibleText(deleteModalTitle)) ===
+              `Remove remote cluster '${clusterName}'?`
+            );
+          });
+
+          await a11y.testAppSnapshot();
+        });
+
+        it(`renders edit remote cluster form and request flyout (${mode} mode)`, async () => {
+          await retry.waitFor('edit remote cluster button to be rendered', async () => {
+            return testSubjects.isDisplayed(editButton);
+          });
+
+          await testSubjects.click(editButton);
+          await retry.waitFor('edit remote cluster form to be rendered', async () => {
+            return (await testSubjects.getVisibleText(pageTitle)) === 'Edit remote cluster';
+          });
+
+          await testSubjects.click(requestButton);
+          await retry.waitFor('request flyout to be rendered', async () => {
+            return (
+              (await testSubjects.getVisibleText(requestTitle)) === `Request for '${clusterName}'`
+            );
+          });
+
+          await a11y.testAppSnapshot();
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/test/accessibility/apps/spaces.ts b/x-pack/test/accessibility/apps/spaces.ts
index a2f0e835c0b3e4..a08ae474497e57 100644
--- a/x-pack/test/accessibility/apps/spaces.ts
+++ b/x-pack/test/accessibility/apps/spaces.ts
@@ -18,17 +18,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const toasts = getService('toasts');
 
-  // flaky
-  // https://github.com/elastic/kibana/issues/77933
-  // https://github.com/elastic/kibana/issues/96625
-  describe.skip('Kibana spaces page meets a11y validations', () => {
+  describe('Kibana spaces page meets a11y validations', () => {
     before(async () => {
       await esArchiver.load('empty_kibana');
       await PageObjects.common.navigateToApp('home');
     });
 
-    it.skip('a11y test for manage spaces menu from top nav on Kibana home', async () => {
-      await PageObjects.spaceSelector.openSpacesNav();
+    it('a11y test for manage spaces menu from top nav on Kibana home', async () => {
+      await testSubjects.click('space-avatar-default');
       await retry.waitFor(
         'Manage spaces option visible',
         async () => await testSubjects.exists('manageSpaces')
@@ -36,7 +33,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await a11y.testAppSnapshot();
     });
 
-    it.skip('a11y test for manage spaces page', async () => {
+    it('a11y test for manage spaces page', async () => {
       await PageObjects.spaceSelector.clickManageSpaces();
       await PageObjects.header.waitUntilLoadingHasFinished();
       await toasts.dismissAllToasts();
diff --git a/x-pack/test/accessibility/config.ts b/x-pack/test/accessibility/config.ts
index 289247beb47713..5b46e7de1efa42 100644
--- a/x-pack/test/accessibility/config.ts
+++ b/x-pack/test/accessibility/config.ts
@@ -36,6 +36,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
       require.resolve('./apps/canvas'),
       require.resolve('./apps/security_solution'),
       require.resolve('./apps/ml_embeddables_in_dashboard'),
+      require.resolve('./apps/remote_clusters'),
     ],
 
     pageObjects,
diff --git a/x-pack/test/api_integration/apis/lens/existing_fields.ts b/x-pack/test/api_integration/apis/lens/existing_fields.ts
index 88949401f102ad..03587869939196 100644
--- a/x-pack/test/api_integration/apis/lens/existing_fields.ts
+++ b/x-pack/test/api_integration/apis/lens/existing_fields.ts
@@ -160,7 +160,8 @@ export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
 
-  describe('existing_fields apis', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/97387
+  describe.skip('existing_fields apis', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('logstash_functional');
       await esArchiver.loadIfNeeded('visualize/default');
diff --git a/x-pack/test/api_integration/apis/security_solution/feature_controls.ts b/x-pack/test/api_integration/apis/security_solution/feature_controls.ts
deleted file mode 100644
index da28e28dae769c..00000000000000
--- a/x-pack/test/api_integration/apis/security_solution/feature_controls.ts
+++ /dev/null
@@ -1,203 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import expect from '@kbn/expect';
-import gql from 'graphql-tag';
-import { FtrProviderContext } from '../../ftr_provider_context';
-
-const introspectionQuery = gql`
-  query Schema {
-    __schema {
-      queryType {
-        name
-      }
-    }
-  }
-`;
-
-export default function ({ getService }: FtrProviderContext) {
-  const security = getService('security');
-  const spaces = getService('spaces');
-  const clientFactory = getService('securitySolutionGraphQLClientFactory');
-
-  const expectGraphQL403 = (result: any) => {
-    expect(result.response).to.be(undefined);
-    expect(result.error).not.to.be(undefined);
-    expect(result.error).to.have.property('networkError');
-    expect(result.error.networkError).to.have.property('statusCode', 403);
-  };
-
-  const expectGraphQLResponse = (result: any) => {
-    expect(result.error).to.be(undefined);
-    expect(result.response).to.have.property('data');
-    expect(result.response.data).to.be.an('object');
-  };
-
-  const executeGraphQLQuery = async (username: string, password: string, spaceId?: string) => {
-    const queryOptions = {
-      query: introspectionQuery,
-    };
-
-    const basePath = spaceId ? `/s/${spaceId}` : '';
-
-    const client = clientFactory({ username, password, basePath });
-    let error;
-    let response;
-    try {
-      response = await client.query(queryOptions);
-    } catch (err) {
-      error = err;
-    }
-    return {
-      error,
-      response,
-    };
-  };
-
-  // FLAKY: https://github.com/elastic/kibana/issues/97355
-  describe.skip('feature controls', () => {
-    it(`APIs can't be accessed by user with no privileges`, async () => {
-      const username = 'logstash_read';
-      const roleName = 'logstash_read';
-      const password = `${username}-password`;
-      try {
-        await security.role.create(roleName, {});
-
-        await security.user.create(username, {
-          password,
-          roles: [roleName],
-          full_name: 'a kibana user',
-        });
-
-        const graphQLResult = await executeGraphQLQuery(username, password);
-        expectGraphQL403(graphQLResult);
-      } finally {
-        await security.role.delete(roleName);
-        await security.user.delete(username);
-      }
-    });
-
-    it('APIs can be accessed user with global "all" privileges', async () => {
-      const username = 'global_all';
-      const roleName = 'global_all';
-      const password = `${username}-password`;
-      try {
-        await security.role.create(roleName, {
-          kibana: [
-            {
-              base: ['all'],
-              spaces: ['*'],
-            },
-          ],
-        });
-
-        await security.user.create(username, {
-          password,
-          roles: [roleName],
-          full_name: 'a kibana user',
-        });
-
-        const graphQLResult = await executeGraphQLQuery(username, password);
-        expectGraphQLResponse(graphQLResult);
-      } finally {
-        await security.role.delete(roleName);
-        await security.user.delete(username);
-      }
-    });
-
-    // this could be any role which doesn't have access to the siem feature
-    it(`APIs can't be accessed by user with dashboard "all" privileges`, async () => {
-      const username = 'dashboard_all';
-      const roleName = 'dashboard_all';
-      const password = `${username}-password`;
-      try {
-        await security.role.create(roleName, {
-          kibana: [
-            {
-              feature: {
-                dashboard: ['all'],
-              },
-              spaces: ['*'],
-            },
-          ],
-        });
-
-        await security.user.create(username, {
-          password,
-          roles: [roleName],
-          full_name: 'a kibana user',
-        });
-
-        const graphQLResult = await executeGraphQLQuery(username, password);
-        expectGraphQL403(graphQLResult);
-      } finally {
-        await security.role.delete(roleName);
-        await security.user.delete(username);
-      }
-    });
-
-    describe('spaces', () => {
-      // the following tests create a user_1 which has siem read access to space_1 and dashboard all access to space_2
-      const space1Id = 'space_1';
-      const space2Id = 'space_2';
-
-      const roleName = 'user_1';
-      const username = 'user_1';
-      const password = 'user_1-password';
-
-      before(async () => {
-        await spaces.create({
-          id: space1Id,
-          name: space1Id,
-          disabledFeatures: [],
-        });
-        await spaces.create({
-          id: space2Id,
-          name: space2Id,
-          disabledFeatures: [],
-        });
-        await security.role.create(roleName, {
-          kibana: [
-            {
-              feature: {
-                siem: ['read'],
-              },
-              spaces: [space1Id],
-            },
-            {
-              feature: {
-                dashboard: ['all'],
-              },
-              spaces: [space2Id],
-            },
-          ],
-        });
-        await security.user.create(username, {
-          password,
-          roles: [roleName],
-        });
-      });
-
-      after(async () => {
-        await spaces.delete(space1Id);
-        await spaces.delete(space2Id);
-        await security.role.delete(roleName);
-        await security.user.delete(username);
-      });
-
-      it('user_1 can access APIs in space_1', async () => {
-        const graphQLResult = await executeGraphQLQuery(username, password, space1Id);
-        expectGraphQLResponse(graphQLResult);
-      });
-
-      it(`user_1 can't access APIs in space_2`, async () => {
-        const graphQLResult = await executeGraphQLQuery(username, password, space2Id);
-        expectGraphQL403(graphQLResult);
-      });
-    });
-  });
-}
diff --git a/x-pack/test/api_integration/apis/security_solution/index.js b/x-pack/test/api_integration/apis/security_solution/index.js
index 57fc7125498590..18c315a3b8c3de 100644
--- a/x-pack/test/api_integration/apis/security_solution/index.js
+++ b/x-pack/test/api_integration/apis/security_solution/index.js
@@ -22,11 +22,10 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./saved_objects/pinned_events'));
     loadTestFile(require.resolve('./saved_objects/timeline'));
     loadTestFile(require.resolve('./sources'));
-    // loadTestFile(require.resolve('./timeline'));
+    loadTestFile(require.resolve('./timeline'));
     loadTestFile(require.resolve('./timeline_details'));
     loadTestFile(require.resolve('./uncommon_processes'));
     loadTestFile(require.resolve('./users'));
     loadTestFile(require.resolve('./tls'));
-    loadTestFile(require.resolve('./feature_controls'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/security_solution/kpi_hosts.ts b/x-pack/test/api_integration/apis/security_solution/kpi_hosts.ts
index f2e597912c4e1b..ff395f056354ea 100644
--- a/x-pack/test/api_integration/apis/security_solution/kpi_hosts.ts
+++ b/x-pack/test/api_integration/apis/security_solution/kpi_hosts.ts
@@ -10,13 +10,14 @@ import { HostsKpiQueries } from '../../../../plugins/security_solution/common/se
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function ({ getService }: FtrProviderContext) {
+  const retry = getService('retry');
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
 
   describe('Kpi Hosts', () => {
     describe('With filebeat', () => {
-      before(() => esArchiver.load('filebeat/default'));
-      after(() => esArchiver.unload('filebeat/default'));
+      before(() => esArchiver.load('filebeat/kpi_hosts'));
+      after(() => esArchiver.unload('filebeat/kpi_hosts'));
 
       const FROM = '2000-01-01T00:00:00.000Z';
       const TO = '3000-01-01T00:00:00.000Z';
@@ -24,19 +25,7 @@ export default function ({ getService }: FtrProviderContext) {
         hosts: 1,
         hostsHistogram: [
           {
-            x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
-            y: 1,
-          },
-          {
-            x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
-            y: 0,
-          },
-          {
-            x: new Date('2019-02-09T22:00:00.000Z').valueOf(),
-            y: 1,
-          },
-          {
-            x: new Date('2019-02-10T01:00:00.000Z').valueOf(),
+            x: new Date('2019-02-09T16:45:06.000Z').valueOf(),
             y: 1,
           },
         ],
@@ -44,246 +33,234 @@ export default function ({ getService }: FtrProviderContext) {
         authSuccessHistogram: null,
         authFailure: 0,
         authFailureHistogram: null,
-        uniqueSourceIps: 121,
+        uniqueSourceIps: 1,
         uniqueSourceIpsHistogram: [
           {
-            x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
-            y: 52,
-          },
-          {
-            x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
-            y: 0,
-          },
-          {
-            x: new Date('2019-02-09T22:00:00.000Z').valueOf(),
-            y: 31,
-          },
-          {
-            x: new Date('2019-02-10T01:00:00.000Z').valueOf(),
-            y: 88,
+            x: new Date('2019-02-09T16:45:06.000Z').valueOf(),
+            y: 1,
           },
         ],
-        uniqueDestinationIps: 154,
+        uniqueDestinationIps: 1,
         uniqueDestinationIpsHistogram: [
           {
-            x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
-            y: 61,
-          },
-          {
-            x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
-            y: 0,
-          },
-          {
-            x: new Date('2019-02-09T22:00:00.000Z').valueOf(),
-            y: 45,
-          },
-          {
-            x: new Date('2019-02-10T01:00:00.000Z').valueOf(),
-            y: 114,
+            x: new Date('2019-02-09T16:45:06.000Z').valueOf(),
+            y: 1,
           },
         ],
       };
 
       it('Make sure that we get KpiHosts data', async () => {
-        const { body: kpiHosts } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: HostsKpiQueries.kpiHosts,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['filebeat-*'],
-            docValueFields: [],
-            inspect: false,
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
+        await retry.try(async () => {
+          const { body: kpiHosts } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: HostsKpiQueries.kpiHosts,
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['filebeat-*'],
+              docValueFields: [],
+              inspect: false,
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
 
-        expect(kpiHosts.hostsHistogram!).to.eql(expectedResult.hostsHistogram);
-        expect(kpiHosts.hosts!).to.eql(expectedResult.hosts);
+          expect(kpiHosts.hostsHistogram!).to.eql(expectedResult.hostsHistogram);
+          expect(kpiHosts.hosts!).to.eql(expectedResult.hosts);
+        });
       });
 
       it('Make sure that we get KpiAuthentications data', async () => {
-        const { body } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: HostsKpiQueries.kpiAuthentications,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['filebeat-*'],
-            docValueFields: [],
-            inspect: false,
-            /* We need a very long timeout to avoid returning just partial data.
-             ** https://github.com/elastic/kibana/blob/master/x-pack/test/api_integration/apis/search/search.ts#L18
-             */
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
-        expect(body.authenticationsSuccess!).to.eql(expectedResult.authSuccess);
-        expect(body.authenticationsSuccessHistogram!).to.eql(expectedResult.authSuccessHistogram);
-        expect(body.authenticationsFailure!).to.eql(expectedResult.authFailure);
-        expect(body.authenticationsFailureHistogram!).to.eql(expectedResult.authFailureHistogram);
+        await retry.try(async () => {
+          const { body } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: HostsKpiQueries.kpiAuthentications,
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['filebeat-*'],
+              docValueFields: [],
+              inspect: false,
+              /* We need a very long timeout to avoid returning just partial data.
+               ** https://github.com/elastic/kibana/blob/master/x-pack/test/api_integration/apis/search/search.ts#L18
+               */
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
+          expect(body.authenticationsSuccess!).to.eql(expectedResult.authSuccess);
+          expect(body.authenticationsSuccessHistogram!).to.eql(expectedResult.authSuccessHistogram);
+          expect(body.authenticationsFailure!).to.eql(expectedResult.authFailure);
+          expect(body.authenticationsFailureHistogram!).to.eql(expectedResult.authFailureHistogram);
+        });
       });
 
       it('Make sure that we get KpiUniqueIps data', async () => {
-        const { body } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: HostsKpiQueries.kpiUniqueIps,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['filebeat-*'],
-            docValueFields: [],
-            inspect: false,
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
-        expect(body.uniqueDestinationIps!).to.eql(expectedResult.uniqueDestinationIps);
-        expect(body.uniqueDestinationIpsHistogram!).to.eql(
-          expectedResult.uniqueDestinationIpsHistogram
-        );
-        expect(body.uniqueSourceIps!).to.eql(expectedResult.uniqueSourceIps);
-        expect(body.uniqueSourceIpsHistogram!).to.eql(expectedResult.uniqueSourceIpsHistogram);
+        await retry.try(async () => {
+          const { body } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: HostsKpiQueries.kpiUniqueIps,
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['filebeat-*'],
+              docValueFields: [],
+              inspect: false,
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
+          expect(body.uniqueDestinationIps!).to.eql(expectedResult.uniqueDestinationIps);
+          expect(body.uniqueDestinationIpsHistogram!).to.eql(
+            expectedResult.uniqueDestinationIpsHistogram
+          );
+          expect(body.uniqueSourceIps!).to.eql(expectedResult.uniqueSourceIps);
+          expect(body.uniqueSourceIpsHistogram!).to.eql(expectedResult.uniqueSourceIpsHistogram);
+        });
       });
     });
 
     describe('With auditbeat', () => {
-      before(() => esArchiver.load('auditbeat/default'));
-      after(() => esArchiver.unload('auditbeat/default'));
+      before(() => esArchiver.load('auditbeat/kpi_hosts'));
+      after(() => esArchiver.unload('auditbeat/kpi_hosts'));
 
       const FROM = '2000-01-01T00:00:00.000Z';
       const TO = '3000-01-01T00:00:00.000Z';
       const expectedResult = {
-        hosts: 6,
+        hosts: 3,
         hostsHistogram: [
           {
             x: new Date('2018-11-27T00:00:00.000Z').valueOf(),
-            y: 6,
+            y: 1,
           },
           {
             x: new Date('2018-11-27T00:30:00.000Z').valueOf(),
-            y: 6,
+            y: 0,
           },
           {
             x: new Date('2018-11-27T01:00:00.000Z').valueOf(),
-            y: 6,
+            y: 0,
           },
           {
             x: new Date('2018-11-27T01:30:00.000Z').valueOf(),
-            y: 6,
+            y: 0,
           },
           {
             x: new Date('2018-11-27T02:00:00.000Z').valueOf(),
-            y: 6,
+            y: 1,
           },
           {
             x: new Date('2018-11-27T02:30:00.000Z').valueOf(),
-            y: 6,
+            y: 1,
           },
         ],
         authSuccess: 0,
         authSuccessHistogram: null,
         authFailure: 0,
         authFailureHistogram: null,
-        uniqueSourceIps: 370,
+        uniqueSourceIps: 3,
         uniqueSourceIpsHistogram: [
-          { x: 1543276800000, y: 74 },
-          { x: 1543278600000, y: 52 },
-          { x: 1543280400000, y: 71 },
-          { x: 1543282200000, y: 76 },
-          { x: 1543284000000, y: 71 },
-          { x: 1543285800000, y: 89 },
+          { x: 1543276800000, y: 1 },
+          { x: 1543278600000, y: 0 },
+          { x: 1543280400000, y: 0 },
+          { x: 1543282200000, y: 0 },
+          { x: 1543284000000, y: 1 },
+          { x: 1543285800000, y: 1 },
         ],
-        uniqueDestinationIps: 1,
+        uniqueDestinationIps: 0,
         uniqueDestinationIpsHistogram: [
           { x: 1543276800000, y: 0 },
           { x: 1543278600000, y: 0 },
           { x: 1543280400000, y: 0 },
           { x: 1543282200000, y: 0 },
           { x: 1543284000000, y: 0 },
-          { x: 1543285800000, y: 1 },
+          { x: 1543285800000, y: 0 },
         ],
       };
 
       it('Make sure that we get KpiHosts data', async () => {
-        const { body: kpiHosts } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: HostsKpiQueries.kpiHosts,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['auditbeat-*'],
-            docValueFields: [],
-            inspect: false,
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
+        await retry.try(async () => {
+          const { body: kpiHosts } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: HostsKpiQueries.kpiHosts,
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['auditbeat-*'],
+              docValueFields: [],
+              inspect: false,
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
 
-        expect(kpiHosts.hostsHistogram!).to.eql(expectedResult.hostsHistogram);
-        expect(kpiHosts.hosts!).to.eql(expectedResult.hosts);
+          expect(kpiHosts.hostsHistogram!).to.eql(expectedResult.hostsHistogram);
+          expect(kpiHosts.hosts!).to.eql(expectedResult.hosts);
+        });
       });
 
       it('Make sure that we get KpiAuthentications data', async () => {
-        const { body } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: HostsKpiQueries.kpiAuthentications,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['auditbeat-*'],
-            docValueFields: [],
-            inspect: false,
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
-        expect(body.authenticationsSuccess!).to.eql(expectedResult.authSuccess);
-        expect(body.authenticationsSuccessHistogram!).to.eql(expectedResult.authSuccessHistogram);
-        expect(body.authenticationsFailure!).to.eql(expectedResult.authFailure);
-        expect(body.authenticationsFailureHistogram!).to.eql(expectedResult.authFailureHistogram);
+        await retry.try(async () => {
+          const { body } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: HostsKpiQueries.kpiAuthentications,
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['auditbeat-*'],
+              docValueFields: [],
+              inspect: false,
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
+          expect(body.authenticationsSuccess!).to.eql(expectedResult.authSuccess);
+          expect(body.authenticationsSuccessHistogram!).to.eql(expectedResult.authSuccessHistogram);
+          expect(body.authenticationsFailure!).to.eql(expectedResult.authFailure);
+          expect(body.authenticationsFailureHistogram!).to.eql(expectedResult.authFailureHistogram);
+        });
       });
 
       it('Make sure that we get KpiUniqueIps data', async () => {
-        const { body } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: HostsKpiQueries.kpiUniqueIps,
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['auditbeat-*'],
-            docValueFields: [],
-            inspect: false,
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
-        expect(body.uniqueDestinationIps!).to.eql(expectedResult.uniqueDestinationIps);
-        expect(body.uniqueDestinationIpsHistogram!).to.eql(
-          expectedResult.uniqueDestinationIpsHistogram
-        );
-        expect(body.uniqueSourceIps!).to.eql(expectedResult.uniqueSourceIps);
-        expect(body.uniqueSourceIpsHistogram!).to.eql(expectedResult.uniqueSourceIpsHistogram);
+        await retry.try(async () => {
+          const { body } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: HostsKpiQueries.kpiUniqueIps,
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['auditbeat-*'],
+              docValueFields: [],
+              inspect: false,
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
+          expect(body.uniqueDestinationIps!).to.eql(expectedResult.uniqueDestinationIps);
+          expect(body.uniqueDestinationIpsHistogram!).to.eql(
+            expectedResult.uniqueDestinationIpsHistogram
+          );
+          expect(body.uniqueSourceIps!).to.eql(expectedResult.uniqueSourceIps);
+          expect(body.uniqueSourceIpsHistogram!).to.eql(expectedResult.uniqueSourceIpsHistogram);
+        });
       });
     });
   });
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/helpers.ts b/x-pack/test/api_integration/apis/security_solution/saved_objects/helpers.ts
new file mode 100644
index 00000000000000..7265a2caf7dd8e
--- /dev/null
+++ b/x-pack/test/api_integration/apis/security_solution/saved_objects/helpers.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import Supertest from 'supertest';
+import supertestAsPromised from 'supertest-as-promised';
+import uuid from 'uuid';
+import { TimelineType } from '../../../../../plugins/security_solution/common/types/timeline';
+
+export const createBasicTimeline = async (
+  supertest: Supertest.SuperTest<supertestAsPromised.Test>,
+  titleToSaved: string
+) =>
+  await supertest
+    .post('/api/timeline')
+    .set('kbn-xsrf', 'true')
+    .send({
+      timelineId: null,
+      version: null,
+      timeline: {
+        title: titleToSaved,
+      },
+    });
+
+export const createBasicTimelineTemplate = async (
+  supertest: Supertest.SuperTest<supertestAsPromised.Test>,
+  titleToSaved: string
+) =>
+  await supertest
+    .post('/api/timeline')
+    .set('kbn-xsrf', 'true')
+    .send({
+      timelineId: null,
+      version: null,
+      timeline: {
+        title: titleToSaved,
+        templateTimelineId: uuid.v4(),
+        templateTimelineVersion: 1,
+        timelineType: TimelineType.template,
+      },
+    });
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts b/x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts
index c2ec448c5b5c91..0d4f3a4fb9ea9f 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts
+++ b/x-pack/test/api_integration/apis/security_solution/saved_objects/notes.ts
@@ -6,14 +6,12 @@
  */
 
 import expect from '@kbn/expect';
-import gql from 'graphql-tag';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
-import { persistTimelineNoteMutation } from '../../../../../plugins/security_solution/public/timelines/containers/notes/persist.gql_query';
 
 export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
-  const client = getService('securitySolutionGraphQLClient');
+  const supertest = getService('supertest');
 
   describe('Note - Saved Objects', () => {
     beforeEach(() => esArchiver.load('empty_kibana'));
@@ -22,16 +20,17 @@ export default function ({ getService }: FtrProviderContext) {
     describe('create a note', () => {
       it('should return a timelineId, timelineVersion, noteId and version', async () => {
         const myNote = 'world test';
-        const response = await client.mutate<any>({
-          mutation: persistTimelineNoteMutation,
-          variables: {
+        const response = await supertest
+          .patch('/api/note')
+          .set('kbn-xsrf', 'true')
+          .send({
             noteId: null,
             version: null,
             note: { note: myNote, timelineId: null },
-          },
-        });
+          });
+
         const { note, noteId, timelineId, timelineVersion, version } =
-          response.data && response.data.persistNote.note;
+          response.body.data && response.body.data.persistNote.note;
 
         expect(note).to.be(myNote);
         expect(noteId).to.not.be.empty();
@@ -42,62 +41,32 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('if noteId exist update note and return existing noteId and new version', async () => {
         const myNote = 'world test';
-        const response = await client.mutate<any>({
-          mutation: persistTimelineNoteMutation,
-          variables: {
+        const response = await supertest
+          .patch('/api/note')
+          .set('kbn-xsrf', 'true')
+          .send({
             noteId: null,
             version: null,
             note: { note: myNote, timelineId: null },
-          },
-        });
+          });
 
-        const { noteId, timelineId, version } = response.data && response.data.persistNote.note;
+        const { noteId, timelineId, version } =
+          response.body.data && response.body.data.persistNote.note;
 
         const myNewNote = 'new world test';
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelineNoteMutation,
-          variables: {
+        const responseToTest = await supertest
+          .patch('/api/note')
+          .set('kbn-xsrf', 'true')
+          .send({
             noteId,
             version,
             note: { note: myNewNote, timelineId },
-          },
-        });
-
-        expect(responseToTest.data!.persistNote.note.note).to.be(myNewNote);
-        expect(responseToTest.data!.persistNote.note.noteId).to.be(noteId);
-        expect(responseToTest.data!.persistNote.note.version).to.not.be.eql(version);
-      });
-    });
-
-    describe('Delete a note', () => {
-      it('one note', async () => {
-        const myNote = 'world test';
-        const response = await client.mutate<any>({
-          mutation: persistTimelineNoteMutation,
-          variables: {
-            noteId: null,
-            version: null,
-            note: { note: myNote, timelineId: null },
-          },
-        });
+          });
 
-        const { noteId } = response.data && response.data.persistNote.note;
-
-        const responseToTest = await client.mutate<any>({
-          mutation: deleteNoteMutation,
-          variables: {
-            id: [noteId],
-          },
-        });
-
-        expect(responseToTest.data!.deleteNote).to.be(true);
+        expect(responseToTest.body.data!.persistNote.note.note).to.be(myNewNote);
+        expect(responseToTest.body.data!.persistNote.note.noteId).to.be(noteId);
+        expect(responseToTest.body.data!.persistNote.note.version).to.not.be.eql(version);
       });
     });
   });
 }
-
-const deleteNoteMutation = gql`
-  mutation DeleteNoteMutation($id: [ID!]!) {
-    deleteNote(id: $id)
-  }
-`;
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts b/x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts
index 3f5bf9df7f06fa..b77c654b038c25 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts
+++ b/x-pack/test/api_integration/apis/security_solution/saved_objects/pinned_events.ts
@@ -8,11 +8,10 @@
 import expect from '@kbn/expect';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
-import { persistTimelinePinnedEventMutation } from '../../../../../plugins/security_solution/public/timelines/containers/pinned_event/persist.gql_query';
 
 export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
-  const client = getService('securitySolutionGraphQLClient');
+  const supertest = getService('supertest');
 
   describe('Pinned Events - Saved Objects', () => {
     beforeEach(() => esArchiver.load('empty_kibana'));
@@ -20,15 +19,12 @@ export default function ({ getService }: FtrProviderContext) {
 
     describe('Pinned an event', () => {
       it('return a timelineId, timelineVersion, pinnedEventId and version', async () => {
-        const response = await client.mutate<any>({
-          mutation: persistTimelinePinnedEventMutation,
-          variables: {
-            pinnedEventId: null,
-            eventId: 'bv4QSGsB9v5HJNSH-7fi',
-          },
+        const response = await supertest.patch('/api/pinned_event').set('kbn-xsrf', 'true').send({
+          pinnedEventId: null,
+          eventId: 'bv4QSGsB9v5HJNSH-7fi',
         });
         const { eventId, pinnedEventId, timelineId, timelineVersion, version } =
-          response.data && response.data.persistPinnedEventOnTimeline;
+          response.body.data && response.body.data.persistPinnedEventOnTimeline;
 
         expect(eventId).to.be('bv4QSGsB9v5HJNSH-7fi');
         expect(pinnedEventId).to.not.be.empty();
@@ -40,25 +36,21 @@ export default function ({ getService }: FtrProviderContext) {
 
     describe('Unpinned an event', () => {
       it('return null', async () => {
-        const response = await client.mutate<any>({
-          mutation: persistTimelinePinnedEventMutation,
-          variables: {
-            pinnedEventId: null,
-            eventId: 'bv4QSGsB9v5HJNSH-7fi',
-          },
+        const response = await supertest.patch('/api/pinned_event').set('kbn-xsrf', 'true').send({
+          pinnedEventId: null,
+          eventId: 'bv4QSGsB9v5HJNSH-7fi',
         });
         const { eventId, pinnedEventId } =
-          response.data && response.data.persistPinnedEventOnTimeline;
+          response.body.data && response.body.data.persistPinnedEventOnTimeline;
 
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelinePinnedEventMutation,
-          variables: {
+        const responseToTest = await supertest
+          .patch('/api/pinned_event')
+          .set('kbn-xsrf', 'true')
+          .send({
             pinnedEventId,
             eventId,
-          },
-        });
-
-        expect(responseToTest.data!.persistPinnedEventOnTimeline).to.be(null);
+          });
+        expect(responseToTest.body.data!.persistPinnedEventOnTimeline).to.be(null);
       });
     });
   });
diff --git a/x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts b/x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts
index c5e9cfbf936ed8..ed1d4719b90730 100644
--- a/x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts
+++ b/x-pack/test/api_integration/apis/security_solution/saved_objects/timeline.ts
@@ -6,19 +6,18 @@
  */
 
 import expect from '@kbn/expect';
-import ApolloClient from 'apollo-client';
-
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
-import { deleteTimelineMutation } from '../../../../../plugins/security_solution/public/timelines/containers/delete/persist.gql_query';
-import { persistTimelineFavoriteMutation } from '../../../../../plugins/security_solution/public/timelines/containers/favorite/persist.gql_query';
-import { persistTimelineMutation } from '../../../../../plugins/security_solution/public/timelines/containers/persist.gql_query';
-import { TimelineResult } from '../../../../../plugins/security_solution/public/graphql/types';
-import { TimelineType } from '../../../../../plugins/security_solution/common/types/timeline';
+import {
+  TimelineResult,
+  TimelineType,
+} from '../../../../../plugins/security_solution/common/types/timeline';
+
+import { createBasicTimeline } from './helpers';
 
 export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
-  const client = getService('securitySolutionGraphQLClient');
+  const supertest = getService('supertest');
 
   describe('Timeline - Saved Objects', () => {
     beforeEach(() => esArchiver.load('empty_kibana'));
@@ -27,9 +26,9 @@ export default function ({ getService }: FtrProviderContext) {
     describe('Persist a timeline', () => {
       it('Create a timeline just with a title', async () => {
         const titleToSaved = 'hello title';
-        const response = await createBasicTimeline(client, titleToSaved);
+        const response = await createBasicTimeline(supertest, titleToSaved);
         const { savedObjectId, title, version } =
-          response.data && response.data.persistTimeline.timeline;
+          response.body.data && response.body.data.persistTimeline.timeline;
 
         expect(title).to.be(titleToSaved);
         expect(savedObjectId).to.not.be.empty();
@@ -137,13 +136,11 @@ export default function ({ getService }: FtrProviderContext) {
           dateRange: { start: '2019-06-10T19:43:20.755Z', end: '2019-06-11T19:43:20.756Z' },
           sort: { columnId: '@timestamp', sortDirection: 'desc' },
         };
-        const response = await client.mutate<any>({
-          mutation: persistTimelineMutation,
-          variables: {
-            timelineId: null,
-            version: null,
-            timeline: timelineObject,
-          },
+
+        const response = await supertest.post('/api/timeline').set('kbn-xsrf', 'true').send({
+          timelineId: null,
+          version: null,
+          timeline: timelineObject,
         });
         const {
           columns,
@@ -156,7 +153,8 @@ export default function ({ getService }: FtrProviderContext) {
           sort,
           title,
           version,
-        } = response.data && omitTypenameInTimeline(response.data.persistTimeline.timeline);
+        } =
+          response.body.data && omitTypenameInTimeline(response.body.data.persistTimeline.timeline);
 
         expect(columns.map((col: { id: string }) => col.id)).to.eql(
           timelineObject.columns.map((col) => col.id)
@@ -174,235 +172,245 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('Update a timeline with a new title', async () => {
         const titleToSaved = 'hello title';
-        const response = await createBasicTimeline(client, titleToSaved);
-        const { savedObjectId, version } = response.data && response.data.persistTimeline.timeline;
+        const response = await createBasicTimeline(supertest, titleToSaved);
+        const { savedObjectId, version } =
+          response.body.data && response.body.data.persistTimeline.timeline;
 
         const newTitle = 'new title';
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelineMutation,
-          variables: {
+
+        const responseToTest = await supertest
+          .patch('/api/timeline')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: savedObjectId,
             version,
             timeline: {
               title: newTitle,
             },
-          },
-        });
-
-        expect(responseToTest.data!.persistTimeline.timeline.savedObjectId).to.eql(savedObjectId);
-        expect(responseToTest.data!.persistTimeline.timeline.title).to.be(newTitle);
-        expect(responseToTest.data!.persistTimeline.timeline.version).to.not.be.eql(version);
+          });
+        expect(responseToTest.body.data!.persistTimeline.timeline.savedObjectId).to.eql(
+          savedObjectId
+        );
+        expect(responseToTest.body.data!.persistTimeline.timeline.title).to.be(newTitle);
+        expect(responseToTest.body.data!.persistTimeline.timeline.version).to.not.be.eql(version);
       });
     });
 
     describe('Persist favorite', () => {
       it('to an existing timeline', async () => {
         const titleToSaved = 'hello title';
-        const response = await createBasicTimeline(client, titleToSaved);
-        const { savedObjectId, version } = response.data && response.data.persistTimeline.timeline;
+        const response = await createBasicTimeline(supertest, titleToSaved);
 
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
+        const { savedObjectId, version } =
+          response.body.data && response.body.data.persistTimeline.timeline;
+
+        const responseToTest = await supertest
+          .patch('/api/timeline/_favorite')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: savedObjectId,
             templateTimelineId: null,
             templateTimelineVersion: null,
             timelineType: TimelineType.default,
-          },
-        });
-
-        expect(responseToTest.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
-        expect(responseToTest.data!.persistFavorite.favorite.length).to.be(1);
-        expect(responseToTest.data!.persistFavorite.version).to.not.be.eql(version);
-        expect(responseToTest.data!.persistFavorite.templateTimelineId).to.be.eql(null);
-        expect(responseToTest.data!.persistFavorite.templateTimelineVersion).to.be.eql(null);
-        expect(responseToTest.data!.persistFavorite.timelineType).to.be.eql(TimelineType.default);
+          });
+
+        expect(responseToTest.body.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
+        expect(responseToTest.body.data!.persistFavorite.favorite.length).to.be(1);
+        expect(responseToTest.body.data!.persistFavorite.version).to.not.be.eql(version);
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineId).to.be.eql(null);
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineVersion).to.be.eql(null);
+        expect(responseToTest.body.data!.persistFavorite.timelineType).to.be.eql(
+          TimelineType.default
+        );
       });
 
       it('to an existing timeline template', async () => {
         const titleToSaved = 'hello title';
         const templateTimelineIdFromStore = 'f4a90a2d-365c-407b-9fef-c1dcb33a6ab3';
         const templateTimelineVersionFromStore = 1;
-        const response = await createBasicTimeline(client, titleToSaved);
-        const { savedObjectId, version } = response.data && response.data.persistTimeline.timeline;
-
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
+        const response = await createBasicTimeline(supertest, titleToSaved);
+        const { savedObjectId, version } =
+          response.body.data && response.body.data.persistTimeline.timeline;
+
+        const responseToTest = await supertest
+          .patch('/api/timeline/_favorite')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: savedObjectId,
             templateTimelineId: templateTimelineIdFromStore,
             templateTimelineVersion: templateTimelineVersionFromStore,
             timelineType: TimelineType.template,
-          },
-        });
-
-        expect(responseToTest.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
-        expect(responseToTest.data!.persistFavorite.favorite.length).to.be(1);
-        expect(responseToTest.data!.persistFavorite.version).to.not.be.eql(version);
-        expect(responseToTest.data!.persistFavorite.templateTimelineId).to.be.eql(
+          });
+        expect(responseToTest.body.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
+        expect(responseToTest.body.data!.persistFavorite.favorite.length).to.be(1);
+        expect(responseToTest.body.data!.persistFavorite.version).to.not.be.eql(version);
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineId).to.be.eql(
           templateTimelineIdFromStore
         );
-        expect(responseToTest.data!.persistFavorite.templateTimelineVersion).to.be.eql(
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineVersion).to.be.eql(
           templateTimelineVersionFromStore
         );
-        expect(responseToTest.data!.persistFavorite.timelineType).to.be.eql(TimelineType.template);
+        expect(responseToTest.body.data!.persistFavorite.timelineType).to.be.eql(
+          TimelineType.template
+        );
       });
 
       it('to Unfavorite an existing timeline', async () => {
         const titleToSaved = 'hello title';
-        const response = await createBasicTimeline(client, titleToSaved);
-        const { savedObjectId, version } = response.data && response.data.persistTimeline.timeline;
-
-        await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
-            timelineId: savedObjectId,
-            templateTimelineId: null,
-            templateTimelineVersion: null,
-            timelineType: TimelineType.default,
-          },
+        const response = await createBasicTimeline(supertest, titleToSaved);
+        const { savedObjectId, version } =
+          response.body.data && response.body.data.persistTimeline.timeline;
+
+        await supertest.patch('/api/timeline/_favorite').set('kbn-xsrf', 'true').send({
+          timelineId: savedObjectId,
+          templateTimelineId: null,
+          templateTimelineVersion: null,
+          timelineType: TimelineType.default,
         });
 
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
+        const responseToTest = await supertest
+          .patch('/api/timeline/_favorite')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: savedObjectId,
             templateTimelineId: null,
             templateTimelineVersion: null,
             timelineType: TimelineType.default,
-          },
-        });
-
-        expect(responseToTest.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
-        expect(responseToTest.data!.persistFavorite.favorite).to.be.empty();
-        expect(responseToTest.data!.persistFavorite.version).to.not.be.eql(version);
-        expect(responseToTest.data!.persistFavorite.templateTimelineId).to.be.eql(null);
-        expect(responseToTest.data!.persistFavorite.templateTimelineVersion).to.be.eql(null);
-        expect(responseToTest.data!.persistFavorite.timelineType).to.be.eql(TimelineType.default);
+          });
+
+        expect(responseToTest.body.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
+        expect(responseToTest.body.data!.persistFavorite.favorite).to.be.empty();
+        expect(responseToTest.body.data!.persistFavorite.version).to.not.be.eql(version);
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineId).to.be.eql(null);
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineVersion).to.be.eql(null);
+        expect(responseToTest.body.data!.persistFavorite.timelineType).to.be.eql(
+          TimelineType.default
+        );
       });
 
       it('to Unfavorite an existing timeline template', async () => {
         const titleToSaved = 'hello title';
         const templateTimelineIdFromStore = 'f4a90a2d-365c-407b-9fef-c1dcb33a6ab3';
         const templateTimelineVersionFromStore = 1;
-        const response = await createBasicTimeline(client, titleToSaved);
-        const { savedObjectId, version } = response.data && response.data.persistTimeline.timeline;
-
-        await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
-            timelineId: savedObjectId,
-            templateTimelineId: templateTimelineIdFromStore,
-            templateTimelineVersion: templateTimelineVersionFromStore,
-            timelineType: TimelineType.template,
-          },
+        const response = await createBasicTimeline(supertest, titleToSaved);
+        const { savedObjectId, version } =
+          response.body.data && response.body.data.persistTimeline.timeline;
+
+        await supertest.patch('/api/timeline/_favorite').set('kbn-xsrf', 'true').send({
+          timelineId: savedObjectId,
+          templateTimelineId: templateTimelineIdFromStore,
+          templateTimelineVersion: templateTimelineVersionFromStore,
+          timelineType: TimelineType.template,
         });
 
-        const responseToTest = await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
+        const responseToTest = await supertest
+          .patch('/api/timeline/_favorite')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: savedObjectId,
             templateTimelineId: templateTimelineIdFromStore,
             templateTimelineVersion: templateTimelineVersionFromStore,
             timelineType: TimelineType.template,
-          },
-        });
+          });
 
-        expect(responseToTest.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
-        expect(responseToTest.data!.persistFavorite.favorite).to.be.empty();
-        expect(responseToTest.data!.persistFavorite.version).to.not.be.eql(version);
-        expect(responseToTest.data!.persistFavorite.templateTimelineId).to.be.eql(
+        expect(responseToTest.body.data!.persistFavorite.savedObjectId).to.be(savedObjectId);
+        expect(responseToTest.body.data!.persistFavorite.favorite).to.be.empty();
+        expect(responseToTest.body.data!.persistFavorite.version).to.not.be.eql(version);
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineId).to.be.eql(
           templateTimelineIdFromStore
         );
-        expect(responseToTest.data!.persistFavorite.templateTimelineVersion).to.be.eql(
+        expect(responseToTest.body.data!.persistFavorite.templateTimelineVersion).to.be.eql(
           templateTimelineVersionFromStore
         );
-        expect(responseToTest.data!.persistFavorite.timelineType).to.be.eql(TimelineType.template);
+        expect(responseToTest.body.data!.persistFavorite.timelineType).to.be.eql(
+          TimelineType.template
+        );
       });
 
       it('to a timeline without a timelineId', async () => {
-        const response = await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
+        const response = await supertest
+          .patch('/api/timeline/_favorite')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: null,
             templateTimelineId: null,
             templateTimelineVersion: null,
             timelineType: TimelineType.default,
-          },
-        });
-
-        expect(response.data!.persistFavorite.savedObjectId).to.not.be.empty();
-        expect(response.data!.persistFavorite.favorite.length).to.be(1);
-        expect(response.data!.persistFavorite.version).to.not.be.empty();
-        expect(response.data!.persistFavorite.templateTimelineId).to.be.eql(null);
-        expect(response.data!.persistFavorite.templateTimelineVersion).to.be.eql(null);
-        expect(response.data!.persistFavorite.timelineType).to.be.eql(TimelineType.default);
+          });
+
+        expect(response.body.data!.persistFavorite.savedObjectId).to.not.be.empty();
+        expect(response.body.data!.persistFavorite.favorite.length).to.be(1);
+        expect(response.body.data!.persistFavorite.version).to.not.be.empty();
+        expect(response.body.data!.persistFavorite.templateTimelineId).to.be.eql(null);
+        expect(response.body.data!.persistFavorite.templateTimelineVersion).to.be.eql(null);
+        expect(response.body.data!.persistFavorite.timelineType).to.be.eql(TimelineType.default);
       });
 
       it('to a timeline template without a timelineId', async () => {
         const templateTimelineIdFromStore = 'f4a90a2d-365c-407b-9fef-c1dcb33a6ab3';
         const templateTimelineVersionFromStore = 1;
-        const response = await client.mutate<any>({
-          mutation: persistTimelineFavoriteMutation,
-          variables: {
+
+        const response = await supertest
+          .patch('/api/timeline/_favorite')
+          .set('kbn-xsrf', 'true')
+          .send({
             timelineId: null,
             templateTimelineId: templateTimelineIdFromStore,
             templateTimelineVersion: templateTimelineVersionFromStore,
             timelineType: TimelineType.template,
-          },
-        });
+          });
 
-        expect(response.data!.persistFavorite.savedObjectId).to.not.be.empty();
-        expect(response.data!.persistFavorite.favorite.length).to.be(1);
-        expect(response.data!.persistFavorite.version).to.not.be.empty();
-        expect(response.data!.persistFavorite.templateTimelineId).to.be.eql(
+        expect(response.body.data!.persistFavorite.savedObjectId).to.not.be.empty();
+        expect(response.body.data!.persistFavorite.favorite.length).to.be(1);
+        expect(response.body.data!.persistFavorite.version).to.not.be.empty();
+        expect(response.body.data!.persistFavorite.templateTimelineId).to.be.eql(
           templateTimelineIdFromStore
         );
-        expect(response.data!.persistFavorite.templateTimelineVersion).to.be.eql(
+        expect(response.body.data!.persistFavorite.templateTimelineVersion).to.be.eql(
           templateTimelineVersionFromStore
         );
-        expect(response.data!.persistFavorite.timelineType).to.be.eql(TimelineType.template);
+        expect(response.body.data!.persistFavorite.timelineType).to.be.eql(TimelineType.template);
       });
     });
 
     describe('Delete', () => {
       it('one timeline', async () => {
         const titleToSaved = 'hello title';
-        const response = await createBasicTimeline(client, titleToSaved);
-        const { savedObjectId } = response.data && response.data.persistTimeline.timeline;
+        const response = await createBasicTimeline(supertest, titleToSaved);
+        const { savedObjectId } = response.body.data && response.body.data.persistTimeline.timeline;
 
-        const responseToTest = await client.mutate<any>({
-          mutation: deleteTimelineMutation,
-          variables: {
-            id: [savedObjectId],
-          },
-        });
+        const responseToTest = await supertest
+          .delete('/api/timeline')
+          .set('kbn-xsrf', 'true')
+          .send({
+            savedObjectIds: [savedObjectId],
+          });
 
-        expect(responseToTest.data!.deleteTimeline).to.be(true);
+        expect(responseToTest.body.data!.deleteTimeline).to.be(true);
       });
 
-      it('multiple timeline', async () => {
+      it('multiple timelines', async () => {
         const titleToSaved = 'hello title';
-        const response1 = await createBasicTimeline(client, titleToSaved);
+        const response1 = await createBasicTimeline(supertest, titleToSaved);
         const savedObjectId1 =
-          response1.data && response1.data.persistTimeline.timeline
-            ? response1.data.persistTimeline.timeline.savedObjectId
+          response1.body.data && response1.body.data.persistTimeline.timeline
+            ? response1.body.data.persistTimeline.timeline.savedObjectId
             : '';
 
-        const response2 = await createBasicTimeline(client, titleToSaved);
+        const response2 = await createBasicTimeline(supertest, titleToSaved);
         const savedObjectId2 =
-          response2.data && response2.data.persistTimeline.timeline
-            ? response2.data.persistTimeline.timeline.savedObjectId
+          response2.body.data && response2.body.data.persistTimeline.timeline
+            ? response2.body.data.persistTimeline.timeline.savedObjectId
             : '';
 
-        const responseToTest = await client.mutate<any>({
-          mutation: deleteTimelineMutation,
-          variables: {
-            id: [savedObjectId1, savedObjectId2],
-          },
-        });
+        const responseToTest = await supertest
+          .delete('/api/timeline')
+          .set('kbn-xsrf', 'true')
+          .send({
+            savedObjectIds: [savedObjectId1, savedObjectId2],
+          });
 
-        expect(responseToTest.data!.deleteTimeline).to.be(true);
+        expect(responseToTest.body.data!.deleteTimeline).to.be(true);
       });
     });
   });
@@ -413,15 +421,3 @@ const omitTypename = (key: string, value: keyof TimelineResult) =>
 
 const omitTypenameInTimeline = (timeline: TimelineResult) =>
   JSON.parse(JSON.stringify(timeline), omitTypename);
-
-const createBasicTimeline = async (client: ApolloClient<any>, titleToSaved: string) =>
-  await client.mutate<any>({
-    mutation: persistTimelineMutation,
-    variables: {
-      timelineId: null,
-      version: null,
-      timeline: {
-        title: titleToSaved,
-      },
-    },
-  });
diff --git a/x-pack/test/api_integration/apis/security_solution/timeline.ts b/x-pack/test/api_integration/apis/security_solution/timeline.ts
index 11de9dbff324cb..10e082cf44004b 100644
--- a/x-pack/test/api_integration/apis/security_solution/timeline.ts
+++ b/x-pack/test/api_integration/apis/security_solution/timeline.ts
@@ -6,135 +6,54 @@
  */
 
 import expect from '@kbn/expect';
+import {
+  SavedTimeline,
+  TimelineType,
+} from '../../../../plugins/security_solution/common/types/timeline';
 
-import { Direction } from '../../../../plugins/security_solution/common/search_strategy';
-// @ts-expect-error
-import { timelineQuery } from '../../../../plugins/security_solution/public/timelines/containers/index.gql_query';
-// @ts-expect-error
-import { GetTimelineQuery } from '../../../../plugins/security_solution/public/graphql/types';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import { createBasicTimeline, createBasicTimelineTemplate } from './saved_objects/helpers';
 
-const TO = '3000-01-01T00:00:00.000Z';
-const FROM = '2000-01-01T00:00:00.000Z';
+export default function ({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
 
-// typical values that have to change after an update from "scripts/es_archiver"
-const DATA_COUNT = 2;
-const HOST_NAME = 'suricata-sensor-amsterdam';
-const TOTAL_COUNT = 96;
-const EDGE_LENGTH = 2;
-const CURSOR_ID = '1550608949681';
+  describe('Timeline', () => {
+    it('Make sure that we get Timeline data', async () => {
+      const titleToSaved = 'hello timeline';
+      await createBasicTimeline(supertest, titleToSaved);
 
-const FILTER_VALUE = {
-  bool: {
-    filter: [
-      {
-        bool: {
-          should: [{ match_phrase: { 'host.name': HOST_NAME } }],
-          minimum_should_match: 1,
-        },
-      },
-      {
-        bool: {
-          filter: [
-            {
-              bool: {
-                should: [{ range: { '@timestamp': { gte: FROM } } }],
-                minimum_should_match: 1,
-              },
-            },
-            {
-              bool: {
-                should: [{ range: { '@timestamp': { lte: TO } } }],
-                minimum_should_match: 1,
-              },
-            },
-          ],
-        },
-      },
-    ],
-  },
-};
+      const resp = await supertest.get('/api/timelines').set('kbn-xsrf', 'true');
 
-export default function ({ getService }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
-  const client = getService('securitySolutionGraphQLClient');
+      const timelines = resp.body.timeline;
 
-  describe('Timeline', () => {
-    before(() => esArchiver.load('auditbeat/hosts'));
-    after(() => esArchiver.unload('auditbeat/hosts'));
+      expect(timelines.length).to.greaterThan(0);
+    });
+
+    it('Make sure that pagination is working in Timeline query', async () => {
+      const titleToSaved = 'hello timeline';
+      await createBasicTimeline(supertest, titleToSaved);
 
-    it('Make sure that we get Timeline data', () => {
-      return client
-        .query<GetTimelineQuery.Query>({
-          query: timelineQuery,
-          variables: {
-            sourceId: 'default',
-            filterQuery: JSON.stringify(FILTER_VALUE),
-            pagination: {
-              limit: 2,
-              cursor: null,
-              tiebreaker: null,
-            },
-            sortField: {
-              sortFieldId: 'timestamp',
-              direction: Direction.desc,
-            },
-            fieldRequested: ['@timestamp', 'host.name'],
-            defaultIndex: ['auditbeat-*'],
-            docValueFields: [],
-            inspect: false,
-            timerange: {
-              from: FROM,
-              to: TO,
-              interval: '12h',
-            },
-            wait_for_completion_timeout: '10s',
-          },
-        })
-        .then((resp) => {
-          const timeline = resp.data.source.Timeline;
-          expect(timeline.edges.length).to.be(EDGE_LENGTH);
-          expect(timeline.edges[0].node.data.length).to.be(DATA_COUNT);
-          expect(timeline.totalCount).to.be(TOTAL_COUNT);
-          expect(timeline.pageInfo.endCursor!.value).to.equal(CURSOR_ID);
-        });
+      const resp = await supertest
+        .get('/api/timelines?page_size=1&page_index=1')
+        .set('kbn-xsrf', 'true');
+
+      const timelines = resp.body.timeline;
+
+      expect(timelines.length).to.equal(1);
     });
 
-    it('Make sure that pagination is working in Timeline query', () => {
-      return client
-        .query<GetTimelineQuery.Query>({
-          query: timelineQuery,
-          variables: {
-            sourceId: 'default',
-            filterQuery: JSON.stringify(FILTER_VALUE),
-            pagination: {
-              limit: 2,
-              cursor: CURSOR_ID,
-              tiebreaker: '191',
-            },
-            sortField: {
-              sortFieldId: 'timestamp',
-              direction: Direction.desc,
-            },
-            fieldRequested: ['@timestamp', 'host.name'],
-            defaultIndex: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-            docValueFields: [],
-            inspect: false,
-            timerange: {
-              from: FROM,
-              to: TO,
-              interval: '12h',
-            },
-            wait_for_completion_timeout: '10s',
-          },
-        })
-        .then((resp) => {
-          const timeline = resp.data.source.Timeline;
-          expect(timeline.edges.length).to.be(EDGE_LENGTH);
-          expect(timeline.totalCount).to.be(TOTAL_COUNT);
-          expect(timeline.edges[0].node.data.length).to.be(DATA_COUNT);
-          expect(timeline.edges[0]!.node.ecs.host!.name).to.eql([HOST_NAME]);
-        });
+    it('Make sure that we get Timeline template data', async () => {
+      const titleToSaved = 'hello timeline template';
+      await createBasicTimelineTemplate(supertest, titleToSaved);
+
+      const resp = await supertest
+        .get('/api/timelines?timeline_type=template')
+        .set('kbn-xsrf', 'true');
+
+      const templates: SavedTimeline[] = resp.body.timeline;
+
+      expect(templates.length).to.greaterThan(0);
+      expect(templates.filter((t) => t.timelineType === TimelineType.default).length).to.equal(0);
     });
   });
 }
diff --git a/x-pack/test/api_integration/apis/security_solution/tls.ts b/x-pack/test/api_integration/apis/security_solution/tls.ts
index a8e0517e6ccdb3..eadf7d2aac7aef 100644
--- a/x-pack/test/api_integration/apis/security_solution/tls.ts
+++ b/x-pack/test/api_integration/apis/security_solution/tls.ts
@@ -84,8 +84,7 @@ export default function ({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
 
-  // Failing: See https://github.com/elastic/kibana/issues/91360
-  describe.skip('Tls Test with Packetbeat', () => {
+  describe('Tls Test with Packetbeat', () => {
     describe('Tls Test', () => {
       before(() => esArchiver.load('packetbeat/tls'));
       after(() => esArchiver.unload('packetbeat/tls'));
diff --git a/x-pack/test/api_integration/services/index.ts b/x-pack/test/api_integration/services/index.ts
index 39215d3da673ae..bf5eaf9618414f 100644
--- a/x-pack/test/api_integration/services/index.ts
+++ b/x-pack/test/api_integration/services/index.ts
@@ -16,10 +16,7 @@ import { EsSupertestWithoutAuthProvider } from './es_supertest_without_auth';
 import { SupertestWithoutAuthProvider } from './supertest_without_auth';
 
 import { UsageAPIProvider } from './usage_api';
-import {
-  SecuritySolutionGraphQLClientProvider,
-  SecuritySolutionGraphQLClientFactoryProvider,
-} from './security_solution_graphql_client';
+
 import { InfraOpsSourceConfigurationProvider } from './infraops_source_configuration';
 import { InfraLogSourceConfigurationProvider } from './infra_log_source_configuration';
 import { MachineLearningProvider } from './ml';
@@ -36,8 +33,6 @@ export const services = {
   esSupertestWithoutAuth: EsSupertestWithoutAuthProvider,
   infraOpsSourceConfiguration: InfraOpsSourceConfigurationProvider,
   infraLogSourceConfiguration: InfraLogSourceConfigurationProvider,
-  securitySolutionGraphQLClient: SecuritySolutionGraphQLClientProvider,
-  securitySolutionGraphQLClientFactory: SecuritySolutionGraphQLClientFactoryProvider,
   supertestWithoutAuth: SupertestWithoutAuthProvider,
   usageAPI: UsageAPIProvider,
   ml: MachineLearningProvider,
diff --git a/x-pack/test/api_integration/services/security_solution_graphql_client.ts b/x-pack/test/api_integration/services/security_solution_graphql_client.ts
deleted file mode 100644
index 35514804f56cf5..00000000000000
--- a/x-pack/test/api_integration/services/security_solution_graphql_client.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { format as formatUrl } from 'url';
-import fetch from 'node-fetch';
-import { InMemoryCache, IntrospectionFragmentMatcher } from 'apollo-cache-inmemory';
-import { ApolloClient } from 'apollo-client';
-import { HttpLink } from 'apollo-link-http';
-
-import { FtrProviderContext } from '../ftr_provider_context';
-import introspectionQueryResultData from '../../../plugins/security_solution/public/graphql/introspection.json';
-
-interface SecuritySolutionGraphQLClientFactoryOptions {
-  username?: string;
-  password?: string;
-  basePath?: string;
-}
-
-export function SecuritySolutionGraphQLClientProvider(context: FtrProviderContext) {
-  return SecuritySolutionGraphQLClientFactoryProvider(context)();
-}
-
-export function SecuritySolutionGraphQLClientFactoryProvider({ getService }: FtrProviderContext) {
-  const config = getService('config');
-  const superAuth: string = config.get('servers.elasticsearch.auth');
-  const [superUsername, superPassword] = superAuth.split(':');
-
-  return function (options?: SecuritySolutionGraphQLClientFactoryOptions) {
-    const { username = superUsername, password = superPassword, basePath = null } = options || {};
-
-    const kbnURLWithoutAuth = formatUrl({ ...config.get('servers.kibana'), auth: false });
-
-    const httpLink = new HttpLink({
-      credentials: 'same-origin',
-      fetch: fetch as any,
-      headers: {
-        'kbn-xsrf': 'xxx',
-        authorization: `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`,
-      },
-      uri: `${kbnURLWithoutAuth}${basePath || ''}/api/solutions/security/graphql`,
-    });
-
-    return new ApolloClient({
-      cache: new InMemoryCache({
-        fragmentMatcher: new IntrospectionFragmentMatcher({
-          // @ts-expect-error apollo-cache-inmemory types don't match actual introspection data
-          introspectionQueryResultData,
-        }),
-      }),
-      link: httpLink,
-    });
-  };
-}
diff --git a/x-pack/test/apm_api_integration/configs/index.ts b/x-pack/test/apm_api_integration/configs/index.ts
index 91437a2d22e274..97d18c2419840a 100644
--- a/x-pack/test/apm_api_integration/configs/index.ts
+++ b/x-pack/test/apm_api_integration/configs/index.ts
@@ -18,7 +18,7 @@ const apmFtrConfigs = {
   rules: {
     license: 'trial' as const,
     kibanaConfig: {
-      'xpack.ruleRegistry.writeEnabled': 'true',
+      'xpack.ruleRegistry.unsafe.write.enabled': 'true',
     },
   },
 };
diff --git a/x-pack/test/apm_api_integration/tests/index.ts b/x-pack/test/apm_api_integration/tests/index.ts
index 53ec61b8d9b614..df1ed1db5900ad 100644
--- a/x-pack/test/apm_api_integration/tests/index.ts
+++ b/x-pack/test/apm_api_integration/tests/index.ts
@@ -65,12 +65,12 @@ export default function apmApiIntegrationTests(providerContext: FtrProviderConte
       loadTestFile(require.resolve('./service_overview/dependencies'));
     });
 
-    describe('service_overview/instances_primary_statistics', function () {
-      loadTestFile(require.resolve('./service_overview/instances_primary_statistics'));
+    describe('service_overview/instances_main_statistics', function () {
+      loadTestFile(require.resolve('./service_overview/instances_main_statistics'));
     });
 
-    describe('service_overview/instances_comparison_statistics', function () {
-      loadTestFile(require.resolve('./service_overview/instances_comparison_statistics'));
+    describe('service_overview/instances_detailed_statistics', function () {
+      loadTestFile(require.resolve('./service_overview/instances_detailed_statistics'));
     });
 
     // Services
@@ -102,12 +102,12 @@ export default function apmApiIntegrationTests(providerContext: FtrProviderConte
       loadTestFile(require.resolve('./services/transaction_types'));
     });
 
-    describe('services/error_groups_primary_statistics', function () {
-      loadTestFile(require.resolve('./services/error_groups_primary_statistics'));
+    describe('services/error_groups_main_statistics', function () {
+      loadTestFile(require.resolve('./services/error_groups_main_statistics'));
     });
 
-    describe('services/error_groups_comparison_statistics', function () {
-      loadTestFile(require.resolve('./services/error_groups_comparison_statistics'));
+    describe('services/error_groups_detailed_statistics', function () {
+      loadTestFile(require.resolve('./services/error_groups_detailed_statistics'));
     });
 
     // Settinges
@@ -165,12 +165,12 @@ export default function apmApiIntegrationTests(providerContext: FtrProviderConte
       loadTestFile(require.resolve('./transactions/top_transaction_groups'));
     });
 
-    describe('transactions/transactions_groups_primary_statistics', function () {
-      loadTestFile(require.resolve('./transactions/transactions_groups_primary_statistics'));
+    describe('transactions/transactions_groups_main_statistics', function () {
+      loadTestFile(require.resolve('./transactions/transactions_groups_main_statistics'));
     });
 
-    describe('transactions/transactions_groups_comparison_statistics', function () {
-      loadTestFile(require.resolve('./transactions/transactions_groups_comparison_statistics'));
+    describe('transactions/transactions_groups_detailed_statistics', function () {
+      loadTestFile(require.resolve('./transactions/transactions_groups_detailed_statistics'));
     });
 
     // feature control
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_comparison_statistics.snap b/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap
similarity index 99%
rename from x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_comparison_statistics.snap
rename to x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap
index 7b7f6fd85b71e1..99208e6cb466be 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_comparison_statistics.snap
+++ b/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`APM API tests basic apm_8.0.0 Service overview instances comparison statistics when data is loaded fetching data with comparison returns the right data for current and previous periods 5`] = `
+exports[`APM API tests basic apm_8.0.0 Service overview instances detailed statistics when data is loaded fetching data with comparison returns the right data for current and previous periods 5`] = `
 Object {
   "currentPeriod": Object {
     "02950c4c5fbb0fda1cc98c47bf4024b473a8a17629db6530d95dcee68bd54c6c": Object {
@@ -675,7 +675,7 @@ Object {
 }
 `;
 
-exports[`APM API tests basic apm_8.0.0 Service overview instances comparison statistics when data is loaded fetching data without comparison returns the right data 3`] = `
+exports[`APM API tests basic apm_8.0.0 Service overview instances detailed statistics when data is loaded fetching data without comparison returns the right data 3`] = `
 Object {
   "currentPeriod": Object {
     "02950c4c5fbb0fda1cc98c47bf4024b473a8a17629db6530d95dcee68bd54c6c": Object {
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/instances_comparison_statistics.ts b/x-pack/test/apm_api_integration/tests/service_overview/instances_detailed_statistics.ts
similarity index 95%
rename from x-pack/test/apm_api_integration/tests/service_overview/instances_comparison_statistics.ts
rename to x-pack/test/apm_api_integration/tests/service_overview/instances_detailed_statistics.ts
index 64d7e258c1fad1..b5cfd722c41dde 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/instances_comparison_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/service_overview/instances_detailed_statistics.ts
@@ -24,18 +24,18 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
   interface Response {
     status: number;
-    body: APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/comparison_statistics'>;
+    body: APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
   }
 
   registry.when(
-    'Service overview instances comparison statistics when data is not loaded',
+    'Service overview instances detailed statistics when data is not loaded',
     { config: 'basic', archives: [] },
     () => {
       describe('when data is not loaded', () => {
         it('handles the empty state', async () => {
           const response: Response = await supertest.get(
             url.format({
-              pathname: `/api/apm/services/opbeans-java/service_overview_instances/comparison_statistics`,
+              pathname: `/api/apm/services/opbeans-java/service_overview_instances/detailed_statistics`,
               query: {
                 latencyAggregationType: 'avg',
                 start,
@@ -55,7 +55,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Service overview instances comparison statistics when data is loaded',
+    'Service overview instances detailed statistics when data is loaded',
     { config: 'basic', archives: [archiveName] },
     () => {
       describe('fetching data without comparison', () => {
@@ -64,7 +64,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         beforeEach(async () => {
           response = await supertest.get(
             url.format({
-              pathname: `/api/apm/services/opbeans-java/service_overview_instances/comparison_statistics`,
+              pathname: `/api/apm/services/opbeans-java/service_overview_instances/detailed_statistics`,
               query: {
                 latencyAggregationType: 'avg',
                 start,
@@ -111,7 +111,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         beforeEach(async () => {
           response = await supertest.get(
             url.format({
-              pathname: `/api/apm/services/opbeans-java/service_overview_instances/comparison_statistics`,
+              pathname: `/api/apm/services/opbeans-java/service_overview_instances/detailed_statistics`,
               query: {
                 latencyAggregationType: 'avg',
                 numBuckets: 20,
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/instances_primary_statistics.ts b/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
similarity index 94%
rename from x-pack/test/apm_api_integration/tests/service_overview/instances_primary_statistics.ts
rename to x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
index baa95eb56a1267..8e085fab98ebf4 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/instances_primary_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
@@ -22,13 +22,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const { start, end } = archives[archiveName];
 
   registry.when(
-    'Service overview instances primary statistics when data is not loaded',
+    'Service overview instances main statistics when data is not loaded',
     { config: 'basic', archives: [] },
     () => {
       describe('when data is not loaded', () => {
         it('handles the empty state', async () => {
           const response = await apmApiSupertest({
-            endpoint: `GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics`,
+            endpoint: `GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics`,
             params: {
               path: { serviceName: 'opbeans-java' },
               query: {
@@ -48,17 +48,17 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Service overview instances primary statistics when data is loaded',
+    'Service overview instances main statistics when data is loaded',
     { config: 'basic', archives: [archiveName] },
     () => {
       describe('fetching java data', () => {
         let response: {
-          body: APIReturnType<`GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics`>;
+          body: APIReturnType<`GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics`>;
         };
 
         beforeEach(async () => {
           response = await apmApiSupertest({
-            endpoint: `GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics`,
+            endpoint: `GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics`,
             params: {
               path: { serviceName: 'opbeans-java' },
               query: {
@@ -122,12 +122,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
       describe('fetching non-java data', () => {
         let response: {
-          body: APIReturnType<`GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics`>;
+          body: APIReturnType<`GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics`>;
         };
 
         beforeEach(async () => {
           response = await apmApiSupertest({
-            endpoint: `GET /api/apm/services/{serviceName}/service_overview_instances/primary_statistics`,
+            endpoint: `GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics`,
             params: {
               path: { serviceName: 'opbeans-ruby' },
               query: {
diff --git a/x-pack/test/apm_api_integration/tests/services/__snapshots__/error_groups_comparison_statistics.snap b/x-pack/test/apm_api_integration/tests/services/__snapshots__/error_groups_detailed_statistics.snap
similarity index 91%
rename from x-pack/test/apm_api_integration/tests/services/__snapshots__/error_groups_comparison_statistics.snap
rename to x-pack/test/apm_api_integration/tests/services/__snapshots__/error_groups_detailed_statistics.snap
index 31bc29a2476ca6..36529a41e080f7 100644
--- a/x-pack/test/apm_api_integration/tests/services/__snapshots__/error_groups_comparison_statistics.snap
+++ b/x-pack/test/apm_api_integration/tests/services/__snapshots__/error_groups_detailed_statistics.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`APM API tests basic apm_8.0.0 Error groups comparison statistics when data is loaded returns the correct data 1`] = `
+exports[`APM API tests basic apm_8.0.0 Error groups detailed statistics when data is loaded returns the correct data 1`] = `
 Object {
   "groupId": "051f95eabf120ebe2f8b0399fe3e54c5",
   "timeseries": Array [
@@ -132,7 +132,7 @@ Object {
 }
 `;
 
-exports[`APM API tests basic apm_8.0.0 Error groups comparison statistics when data is loaded with previous data returns the correct data returns correct timeseries 1`] = `
+exports[`APM API tests basic apm_8.0.0 Error groups detailed statistics when data is loaded with previous data returns the correct data returns correct timeseries 1`] = `
 Object {
   "groupId": "051f95eabf120ebe2f8b0399fe3e54c5",
   "timeseries": Array [
diff --git a/x-pack/test/apm_api_integration/tests/services/error_groups_comparison_statistics.ts b/x-pack/test/apm_api_integration/tests/services/error_groups_detailed_statistics.ts
similarity index 90%
rename from x-pack/test/apm_api_integration/tests/services/error_groups_comparison_statistics.ts
rename to x-pack/test/apm_api_integration/tests/services/error_groups_detailed_statistics.ts
index 821d0515aa808e..fdbc98af03bf2b 100644
--- a/x-pack/test/apm_api_integration/tests/services/error_groups_comparison_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/services/error_groups_detailed_statistics.ts
@@ -13,7 +13,7 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { registry } from '../../common/registry';
 import { APIReturnType } from '../../../../plugins/apm/public/services/rest/createCallApmApi';
 
-type ErrorGroupsComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/comparison_statistics'>;
+type ErrorGroupsDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/detailed_statistics'>;
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -30,13 +30,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   ];
 
   registry.when(
-    'Error groups comparison statistics when data is not loaded',
+    'Error groups detailed statistics when data is not loaded',
     { config: 'basic', archives: [] },
     () => {
       it('handles empty state', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/error_groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/error_groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -54,13 +54,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Error groups comparison statistics when data is loaded',
+    'Error groups detailed statistics when data is loaded',
     { config: 'basic', archives: [archiveName] },
     () => {
       it('returns the correct data', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/error_groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/error_groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -73,7 +73,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(response.status).to.be(200);
 
-        const errorGroupsComparisonStatistics = response.body as ErrorGroupsComparisonStatistics;
+        const errorGroupsComparisonStatistics = response.body as ErrorGroupsDetailedStatistics;
         expect(Object.keys(errorGroupsComparisonStatistics.currentPeriod).sort()).to.eql(
           groupIds.sort()
         );
@@ -93,7 +93,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       it('returns an empty state when requested groupIds are not available in the given time range', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/error_groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/error_groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -111,18 +111,18 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Error groups comparison statistics when data is loaded with previous data',
+    'Error groups detailed statistics when data is loaded with previous data',
     { config: 'basic', archives: [archiveName] },
     () => {
       describe('returns the correct data', async () => {
         let response: {
           status: number;
-          body: ErrorGroupsComparisonStatistics;
+          body: ErrorGroupsDetailedStatistics;
         };
         before(async () => {
           response = await supertest.get(
             url.format({
-              pathname: `/api/apm/services/opbeans-java/error_groups/comparison_statistics`,
+              pathname: `/api/apm/services/opbeans-java/error_groups/detailed_statistics`,
               query: {
                 numBuckets: 20,
                 transactionType: 'request',
@@ -139,7 +139,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         it('returns correct timeseries', () => {
-          const errorGroupsComparisonStatistics = response.body as ErrorGroupsComparisonStatistics;
+          const errorGroupsComparisonStatistics = response.body as ErrorGroupsDetailedStatistics;
           const errorgroupsComparisonStatistics =
             errorGroupsComparisonStatistics.currentPeriod[groupIds[0]];
           expect(
@@ -149,7 +149,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         it('matches x-axis on current period and previous period', () => {
-          const errorGroupsComparisonStatistics = response.body as ErrorGroupsComparisonStatistics;
+          const errorGroupsComparisonStatistics = response.body as ErrorGroupsDetailedStatistics;
 
           const currentPeriodItems = Object.values(errorGroupsComparisonStatistics.currentPeriod);
           const previousPeriodItems = Object.values(errorGroupsComparisonStatistics.previousPeriod);
@@ -166,7 +166,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       it('returns an empty state when requested groupIds are not available in the given time range', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/error_groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/error_groups/detailed_statistics`,
             query: {
               numBuckets: 20,
               transactionType: 'request',
diff --git a/x-pack/test/apm_api_integration/tests/services/error_groups_primary_statistics.ts b/x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts
similarity index 84%
rename from x-pack/test/apm_api_integration/tests/services/error_groups_primary_statistics.ts
rename to x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts
index 61a44619ea9057..c95ba52e6052e2 100644
--- a/x-pack/test/apm_api_integration/tests/services/error_groups_primary_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts
@@ -12,7 +12,7 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { registry } from '../../common/registry';
 import { APIReturnType } from '../../../../plugins/apm/public/services/rest/createCallApmApi';
 
-type ErrorGroupsPrimaryStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/primary_statistics'>;
+type ErrorGroupsMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/main_statistics'>;
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -22,13 +22,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const { start, end } = metadata;
 
   registry.when(
-    'Error groups primary statistics when data is not loaded',
+    'Error groups main statistics when data is not loaded',
     { config: 'basic', archives: [] },
     () => {
       it('handles empty state', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/error_groups/primary_statistics`,
+            pathname: `/api/apm/services/opbeans-java/error_groups/main_statistics`,
             query: {
               start,
               end,
@@ -47,13 +47,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Error groups primary statistics when data is loaded',
+    'Error groups main statistics when data is loaded',
     { config: 'basic', archives: [archiveName] },
     () => {
       it('returns the correct data', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/error_groups/primary_statistics`,
+            pathname: `/api/apm/services/opbeans-java/error_groups/main_statistics`,
             query: {
               start,
               end,
@@ -65,12 +65,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(response.status).to.be(200);
 
-        const errorGroupPrimaryStatistics = response.body as ErrorGroupsPrimaryStatistics;
+        const errorGroupMainStatistics = response.body as ErrorGroupsMainStatistics;
 
-        expect(errorGroupPrimaryStatistics.is_aggregation_accurate).to.eql(true);
-        expect(errorGroupPrimaryStatistics.error_groups.length).to.be.greaterThan(0);
+        expect(errorGroupMainStatistics.is_aggregation_accurate).to.eql(true);
+        expect(errorGroupMainStatistics.error_groups.length).to.be.greaterThan(0);
 
-        expectSnapshot(errorGroupPrimaryStatistics.error_groups.map(({ name }) => name))
+        expectSnapshot(errorGroupMainStatistics.error_groups.map(({ name }) => name))
           .toMatchInline(`
           Array [
             "Could not write JSON: Null return value from advice does not match primitive return type for: public abstract double co.elastic.apm.opbeans.repositories.Numbers.getRevenue(); nested exception is com.fasterxml.jackson.databind.JsonMappingException: Null return value from advice does not match primitive return type for: public abstract double co.elastic.apm.opbeans.repositories.Numbers.getRevenue() (through reference chain: co.elastic.apm.opbeans.repositories.Stats[\\"numbers\\"]->com.sun.proxy.$Proxy132[\\"revenue\\"])",
@@ -81,7 +81,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           ]
         `);
 
-        const occurences = errorGroupPrimaryStatistics.error_groups.map(
+        const occurences = errorGroupMainStatistics.error_groups.map(
           ({ occurrences }) => occurrences
         );
 
@@ -97,7 +97,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           ]
         `);
 
-        const firstItem = errorGroupPrimaryStatistics.error_groups[0];
+        const firstItem = errorGroupMainStatistics.error_groups[0];
 
         expectSnapshot(firstItem).toMatchInline(`
           Object {
diff --git a/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/transactions_groups_comparison_statistics.snap b/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/transactions_groups_detailed_statistics.snap
similarity index 88%
rename from x-pack/test/apm_api_integration/tests/transactions/__snapshots__/transactions_groups_comparison_statistics.snap
rename to x-pack/test/apm_api_integration/tests/transactions/__snapshots__/transactions_groups_detailed_statistics.snap
index bc641ad1a98902..64336a4c654517 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/transactions_groups_comparison_statistics.snap
+++ b/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/transactions_groups_detailed_statistics.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns data with previous period returns correct error rate data 1`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns data with previous period returns correct error rate data 1`] = `
 Array [
   Object {
     "x": 1607436720000,
@@ -69,7 +69,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns data with previous period returns correct error rate data 2`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns data with previous period returns correct error rate data 2`] = `
 Array [
   Object {
     "x": 1607436720000,
@@ -138,7 +138,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns data with previous period returns correct latency data 1`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns data with previous period returns correct latency data 1`] = `
 Array [
   Object {
     "x": 1607436720000,
@@ -207,7 +207,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns data with previous period returns correct latency data 2`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns data with previous period returns correct latency data 2`] = `
 Array [
   Object {
     "x": 1607436720000,
@@ -276,7 +276,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns data with previous period returns correct throughput data 1`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns data with previous period returns correct throughput data 1`] = `
 Array [
   Object {
     "x": 1607436720000,
@@ -345,7 +345,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns data with previous period returns correct throughput data 2`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns data with previous period returns correct throughput data 2`] = `
 Array [
   Object {
     "x": 1607436720000,
@@ -414,7 +414,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns the correct data 1`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns the correct data 1`] = `
 Array [
   Object {
     "x": 1607435820000,
@@ -543,7 +543,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns the correct data 2`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns the correct data 2`] = `
 Array [
   Object {
     "x": 1607435820000,
@@ -672,7 +672,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns the correct data 3`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns the correct data 3`] = `
 Array [
   Object {
     "x": 1607435820000,
@@ -801,7 +801,7 @@ Array [
 ]
 `;
 
-exports[`APM API tests basic apm_8.0.0 Transaction groups comparison statistics when data is loaded returns the correct data for latency aggregation 99th percentile 1`] = `
+exports[`APM API tests basic apm_8.0.0 Transaction groups detailed statistics when data is loaded returns the correct data for latency aggregation 99th percentile 1`] = `
 Array [
   Object {
     "x": 1607435820000,
diff --git a/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_comparison_statistics.ts b/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_detailed_statistics.ts
similarity index 93%
rename from x-pack/test/apm_api_integration/tests/transactions/transactions_groups_comparison_statistics.ts
rename to x-pack/test/apm_api_integration/tests/transactions/transactions_groups_detailed_statistics.ts
index 72fb0e832412d1..303b8f715e9576 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_comparison_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_detailed_statistics.ts
@@ -15,7 +15,7 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { registry } from '../../common/registry';
 import { removeEmptyCoordinates, roundNumber } from '../../utils';
 
-type TransactionsGroupsComparisonStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/comparison_statistics'>;
+type TransactionsGroupsDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/detailed_statistics'>;
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -25,13 +25,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const transactionNames = ['DispatcherServlet#doGet', 'APIRestController#customers'];
 
   registry.when(
-    'Transaction groups comparison statistics when data is not loaded',
+    'Transaction groups detailed statistics when data is not loaded',
     { config: 'basic', archives: [] },
     () => {
       it('handles the empty state', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -50,13 +50,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Transaction groups comparison statistics when data is loaded',
+    'Transaction groups detailed statistics when data is loaded',
     { config: 'basic', archives: [archiveName] },
     () => {
       it('returns the correct data', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -73,7 +73,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         const {
           currentPeriod,
           previousPeriod,
-        } = response.body as TransactionsGroupsComparisonStatistics;
+        } = response.body as TransactionsGroupsDetailedStatistics;
 
         expect(Object.keys(currentPeriod).sort()).to.be.eql(transactionNames.sort());
 
@@ -110,7 +110,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       it('returns the correct data for latency aggregation 99th percentile', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -127,7 +127,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         const {
           currentPeriod,
           previousPeriod,
-        } = response.body as TransactionsGroupsComparisonStatistics;
+        } = response.body as TransactionsGroupsDetailedStatistics;
 
         expect(Object.keys(currentPeriod).sort()).to.be.eql(transactionNames.sort());
 
@@ -158,7 +158,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       it('returns empty when transaction name is not found', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/comparison_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/detailed_statistics`,
             query: {
               start,
               end,
@@ -175,12 +175,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       });
 
       describe('returns data with previous period', async () => {
-        let currentPeriod: TransactionsGroupsComparisonStatistics['currentPeriod'];
-        let previousPeriod: TransactionsGroupsComparisonStatistics['previousPeriod'];
+        let currentPeriod: TransactionsGroupsDetailedStatistics['currentPeriod'];
+        let previousPeriod: TransactionsGroupsDetailedStatistics['previousPeriod'];
         before(async () => {
           const response = await supertest.get(
             url.format({
-              pathname: `/api/apm/services/opbeans-java/transactions/groups/comparison_statistics`,
+              pathname: `/api/apm/services/opbeans-java/transactions/groups/detailed_statistics`,
               query: {
                 numBuckets: 20,
                 transactionType: 'request',
diff --git a/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_primary_statistics.ts b/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts
similarity index 94%
rename from x-pack/test/apm_api_integration/tests/transactions/transactions_groups_primary_statistics.ts
rename to x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts
index b6fd4054a351c9..a2da077864b995 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_primary_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts
@@ -13,7 +13,7 @@ import { FtrProviderContext } from '../../common/ftr_provider_context';
 import archives from '../../common/fixtures/es_archiver/archives_metadata';
 import { registry } from '../../common/registry';
 
-type TransactionsGroupsPrimaryStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/primary_statistics'>;
+type TransactionsGroupsPrimaryStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/transactions/groups/main_statistics'>;
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -22,13 +22,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const { start, end } = archives[archiveName];
 
   registry.when(
-    'Transaction groups primary statistics when data is not loaded',
+    'Transaction groups main statistics when data is not loaded',
     { config: 'basic', archives: [] },
     () => {
       it('handles the empty state', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/primary_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/main_statistics`,
             query: {
               start,
               end,
@@ -47,13 +47,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'Transaction groups primary statistics when data is loaded',
+    'Transaction groups main statistics when data is loaded',
     { config: 'basic', archives: [archiveName] },
     () => {
       it('returns the correct data', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/primary_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/main_statistics`,
             query: {
               start,
               end,
@@ -125,7 +125,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       it('returns the correct data for latency aggregation 99th percentile', async () => {
         const response = await supertest.get(
           url.format({
-            pathname: `/api/apm/services/opbeans-java/transactions/groups/primary_statistics`,
+            pathname: `/api/apm/services/opbeans-java/transactions/groups/main_statistics`,
             query: {
               start,
               end,
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
index e8beef3e58a431..18f98587267232 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
@@ -8,9 +8,20 @@
 /* eslint-disable @typescript-eslint/naming-convention */
 
 import expect from '@kbn/expect';
-import { CreateRulesSchema } from '../../../../plugins/security_solution/common/detection_engine/schemas/request';
+import {
+  CreateRulesSchema,
+  EqlCreateSchema,
+  QueryCreateSchema,
+  ThreatMatchCreateSchema,
+  ThresholdCreateSchema,
+} from '../../../../plugins/security_solution/common/detection_engine/schemas/request';
 import { getCreateExceptionListItemMinimalSchemaMock } from '../../../../plugins/lists/common/schemas/request/create_exception_list_item_schema.mock';
-import { deleteAllExceptions } from '../../../lists_api_integration/utils';
+import {
+  createListsIndex,
+  deleteAllExceptions,
+  deleteListsIndex,
+  importFile,
+} from '../../../lists_api_integration/utils';
 import { RulesSchema } from '../../../../plugins/security_solution/common/detection_engine/schemas/response';
 import { getCreateExceptionListMinimalSchemaMock } from '../../../../plugins/lists/common/schemas/request/create_exception_list_schema.mock';
 import { CreateExceptionListItemSchema } from '../../../../plugins/lists/common';
@@ -39,6 +50,9 @@ import {
   getSignalsByIds,
   findImmutableRuleById,
   getPrePackagedRulesStatus,
+  getRuleForSignalTesting,
+  getOpenSignals,
+  createRuleWithExceptionEntries,
 } from '../../utils';
 import { ROLES } from '../../../../plugins/security_solution/common/test';
 import { createUserAndRole, deleteUserAndRole } from '../roles_users_utils';
@@ -576,49 +590,211 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should be able to execute against an exception list that does include valid entries and get back 0 signals', async () => {
-          const { id, list_id, namespace_type, type } = await createExceptionList(
-            supertest,
-            getCreateExceptionListMinimalSchemaMock()
-          );
-
-          const exceptionListItem: CreateExceptionListItemSchema = {
-            ...getCreateExceptionListItemMinimalSchemaMock(),
-            entries: [
+          const rule: QueryCreateSchema = {
+            name: 'Simple Rule Query',
+            description: 'Simple Rule Query',
+            enabled: true,
+            risk_score: 1,
+            rule_id: 'rule-1',
+            severity: 'high',
+            index: ['auditbeat-*'],
+            type: 'query',
+            from: '1900-01-01T00:00:00.000Z',
+            query: 'host.name: "suricata-sensor-amsterdam"',
+          };
+          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+            [
               {
-                field: 'host.name', // This matches the query below which will exclude everything
+                field: 'host.name', // This matches the query above which will exclude everything
                 operator: 'included',
                 type: 'match',
                 value: 'suricata-sensor-amsterdam',
               },
             ],
+          ]);
+          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          expect(signalsOpen.hits.hits.length).equal(0);
+        });
+
+        it('generates no signals when an exception is added for an EQL rule', async () => {
+          const rule: EqlCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: 'eql-rule',
+            type: 'eql',
+            language: 'eql',
+            query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
           };
-          await createExceptionListItem(supertest, exceptionListItem);
+          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+            [
+              {
+                field: 'host.id',
+                operator: 'included',
+                type: 'match',
+                value: '8cc95778cce5407c809480e8e32ad76b',
+              },
+            ],
+          ]);
+          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          expect(signalsOpen.hits.hits.length).equal(0);
+        });
 
-          const ruleWithException: CreateRulesSchema = {
-            name: 'Simple Rule Query',
-            description: 'Simple Rule Query',
-            enabled: true,
-            risk_score: 1,
-            rule_id: 'rule-1',
+        it('generates no signals when an exception is added for a threshold rule', async () => {
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: 'threshold-rule',
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: 'host.id',
+              value: 700,
+            },
+          };
+          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+            [
+              {
+                field: 'host.id',
+                operator: 'included',
+                type: 'match',
+                value: '8cc95778cce5407c809480e8e32ad76b',
+              },
+            ],
+          ]);
+          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          expect(signalsOpen.hits.hits.length).equal(0);
+        });
+
+        it('generates no signals when an exception is added for a threat match rule', async () => {
+          const rule: ThreatMatchCreateSchema = {
+            description: 'Detecting root and admin users',
+            name: 'Query with a rule id',
             severity: 'high',
             index: ['auditbeat-*'],
-            type: 'query',
+            type: 'threat_match',
+            risk_score: 55,
+            language: 'kuery',
+            rule_id: 'rule-1',
             from: '1900-01-01T00:00:00.000Z',
-            query: 'host.name: "suricata-sensor-amsterdam"',
-            exceptions_list: [
+            query: '*:*',
+            threat_query: 'source.ip: "188.166.120.93"', // narrow things down with a query to a specific source ip
+            threat_index: ['auditbeat-*'], // We use auditbeat as both the matching index and the threat list for simplicity
+            threat_mapping: [
+              // We match host.name against host.name
               {
-                id,
-                list_id,
-                namespace_type,
-                type,
+                entries: [
+                  {
+                    field: 'host.name',
+                    value: 'host.name',
+                    type: 'mapping',
+                  },
+                ],
               },
             ],
+            threat_filters: [],
           };
-          const rule = await createRule(supertest, ruleWithException);
-          await waitForRuleSuccessOrStatus(supertest, rule.id);
-          const signalsOpen = await getSignalsByIds(supertest, [rule.id]);
+
+          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+            [
+              {
+                field: 'source.ip',
+                operator: 'included',
+                type: 'match',
+                value: '188.166.120.93',
+              },
+            ],
+          ]);
+          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
           expect(signalsOpen.hits.hits.length).equal(0);
         });
+        describe('rules with value list exceptions', () => {
+          beforeEach(async () => {
+            await createListsIndex(supertest);
+          });
+
+          afterEach(async () => {
+            await deleteListsIndex(supertest);
+          });
+
+          it('generates no signals when a value list exception is added for a query rule', async () => {
+            const valueListId = 'value-list-id';
+            await importFile(supertest, 'keyword', ['suricata-sensor-amsterdam'], valueListId);
+            const rule: QueryCreateSchema = {
+              name: 'Simple Rule Query',
+              description: 'Simple Rule Query',
+              enabled: true,
+              risk_score: 1,
+              rule_id: 'rule-1',
+              severity: 'high',
+              index: ['auditbeat-*'],
+              type: 'query',
+              from: '1900-01-01T00:00:00.000Z',
+              query: 'host.name: "suricata-sensor-amsterdam"',
+            };
+            const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+              [
+                {
+                  field: 'host.name',
+                  operator: 'included',
+                  type: 'list',
+                  list: {
+                    id: valueListId,
+                    type: 'keyword',
+                  },
+                },
+              ],
+            ]);
+            const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+            expect(signalsOpen.hits.hits.length).equal(0);
+          });
+
+          it('generates no signals when a value list exception is added for a threat match rule', async () => {
+            const valueListId = 'value-list-id';
+            await importFile(supertest, 'keyword', ['zeek-sensor-amsterdam'], valueListId);
+            const rule: ThreatMatchCreateSchema = {
+              description: 'Detecting root and admin users',
+              name: 'Query with a rule id',
+              severity: 'high',
+              index: ['auditbeat-*'],
+              type: 'threat_match',
+              risk_score: 55,
+              language: 'kuery',
+              rule_id: 'rule-1',
+              from: '1900-01-01T00:00:00.000Z',
+              query: '*:*',
+              threat_query: 'source.ip: "188.166.120.93"', // narrow things down with a query to a specific source ip
+              threat_index: ['auditbeat-*'], // We use auditbeat as both the matching index and the threat list for simplicity
+              threat_mapping: [
+                // We match host.name against host.name
+                {
+                  entries: [
+                    {
+                      field: 'host.name',
+                      value: 'host.name',
+                      type: 'mapping',
+                    },
+                  ],
+                },
+              ],
+              threat_filters: [],
+            };
+
+            const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+              [
+                {
+                  field: 'host.name',
+                  operator: 'included',
+                  type: 'list',
+                  list: {
+                    id: valueListId,
+                    type: 'keyword',
+                  },
+                },
+              ],
+            ]);
+            const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+            expect(signalsOpen.hits.hits.length).equal(0);
+          });
+        });
       });
     });
   });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
index 08fb9222e17891..6f437f7bcc8e5b 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
@@ -6,11 +6,12 @@
  */
 
 import expect from '@kbn/expect';
-import { orderBy } from 'lodash';
+import { orderBy, get } from 'lodash';
 
 import {
   EqlCreateSchema,
   QueryCreateSchema,
+  ThresholdCreateSchema,
 } from '../../../../plugins/security_solution/common/detection_engine/schemas/request';
 import { DEFAULT_SIGNALS_INDEX } from '../../../../plugins/security_solution/common/constants';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
@@ -216,19 +217,286 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       describe('EQL Rules', () => {
-        it('generates signals from EQL sequences in the expected form', async () => {
+        it('generates a correctly formatted signal from EQL non-sequence queries', async () => {
           const rule: EqlCreateSchema = {
             ...getRuleForSignalTesting(['auditbeat-*']),
             rule_id: 'eql-rule',
             type: 'eql',
             language: 'eql',
-            query: 'sequence by host.name [any where true] [any where true]',
+            query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
+          expect(signals.hits.hits.length).eql(1);
+          const fullSignal = signals.hits.hits[0]._source;
+
+          expect(fullSignal).eql({
+            '@timestamp': fullSignal['@timestamp'],
+            agent: {
+              ephemeral_id: '0010d67a-14f7-41da-be30-489fea735967',
+              hostname: 'suricata-zeek-sensor-toronto',
+              id: 'a1d7b39c-f898-4dbe-a761-efb61939302d',
+              type: 'auditbeat',
+              version: '8.0.0',
+            },
+            auditd: {
+              data: {
+                audit_enabled: '1',
+                old: '1',
+              },
+              message_type: 'config_change',
+              result: 'success',
+              sequence: 1496,
+              session: 'unset',
+              summary: {
+                actor: {
+                  primary: 'unset',
+                },
+                object: {
+                  primary: '1',
+                  type: 'audit-config',
+                },
+              },
+            },
+            cloud: {
+              instance: {
+                id: '133555295',
+              },
+              provider: 'digitalocean',
+              region: 'tor1',
+            },
+            ecs: {
+              version: '1.0.0-beta2',
+            },
+            event: {
+              action: 'changed-audit-configuration',
+              category: 'configuration',
+              module: 'auditd',
+              kind: 'signal',
+            },
+            host: {
+              architecture: 'x86_64',
+              containerized: false,
+              hostname: 'suricata-zeek-sensor-toronto',
+              id: '8cc95778cce5407c809480e8e32ad76b',
+              name: 'suricata-zeek-sensor-toronto',
+              os: {
+                codename: 'bionic',
+                family: 'debian',
+                kernel: '4.15.0-45-generic',
+                name: 'Ubuntu',
+                platform: 'ubuntu',
+                version: '18.04.2 LTS (Bionic Beaver)',
+              },
+            },
+            service: {
+              type: 'auditd',
+            },
+            user: {
+              audit: {
+                id: 'unset',
+              },
+            },
+            signal: {
+              rule: fullSignal.signal.rule,
+              original_time: fullSignal.signal.original_time,
+              status: 'open',
+              depth: 1,
+              ancestors: [
+                {
+                  depth: 0,
+                  id: '9xbRBmkBR346wHgngz2D',
+                  index: 'auditbeat-8.0.0-2019.02.19-000001',
+                  type: 'event',
+                },
+              ],
+              original_event: {
+                action: 'changed-audit-configuration',
+                category: 'configuration',
+                module: 'auditd',
+              },
+              parent: {
+                depth: 0,
+                id: '9xbRBmkBR346wHgngz2D',
+                index: 'auditbeat-8.0.0-2019.02.19-000001',
+                type: 'event',
+              },
+              parents: [
+                {
+                  depth: 0,
+                  id: '9xbRBmkBR346wHgngz2D',
+                  index: 'auditbeat-8.0.0-2019.02.19-000001',
+                  type: 'event',
+                },
+              ],
+              _meta: {
+                version: SIGNALS_TEMPLATE_VERSION,
+              },
+            },
+          });
+        });
+
+        it('generates up to max_signals for non-sequence EQL queries', async () => {
+          const rule: EqlCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: 'eql-rule',
+            type: 'eql',
+            language: 'eql',
+            query: 'any where true',
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 100, [id]);
+          const signals = await getSignalsByIds(supertest, [id], 1000);
+          const filteredSignals = signals.hits.hits.filter(
+            (signal) => signal._source.signal.depth === 1
+          );
+          expect(filteredSignals.length).eql(100);
+        });
+
+        it('uses the provided event_category_override', async () => {
+          const rule: EqlCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: 'eql-rule',
+            type: 'eql',
+            language: 'eql',
+            query: 'config_change where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
+            event_category_override: 'auditd.message_type',
           };
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
-          const signal = signals.hits.hits[0]._source.signal;
+          expect(signals.hits.hits.length).eql(1);
+          const fullSignal = signals.hits.hits[0]._source;
+
+          expect(fullSignal).eql({
+            '@timestamp': fullSignal['@timestamp'],
+            agent: {
+              ephemeral_id: '0010d67a-14f7-41da-be30-489fea735967',
+              hostname: 'suricata-zeek-sensor-toronto',
+              id: 'a1d7b39c-f898-4dbe-a761-efb61939302d',
+              type: 'auditbeat',
+              version: '8.0.0',
+            },
+            auditd: {
+              data: {
+                audit_enabled: '1',
+                old: '1',
+              },
+              message_type: 'config_change',
+              result: 'success',
+              sequence: 1496,
+              session: 'unset',
+              summary: {
+                actor: {
+                  primary: 'unset',
+                },
+                object: {
+                  primary: '1',
+                  type: 'audit-config',
+                },
+              },
+            },
+            cloud: {
+              instance: {
+                id: '133555295',
+              },
+              provider: 'digitalocean',
+              region: 'tor1',
+            },
+            ecs: {
+              version: '1.0.0-beta2',
+            },
+            event: {
+              action: 'changed-audit-configuration',
+              category: 'configuration',
+              module: 'auditd',
+              kind: 'signal',
+            },
+            host: {
+              architecture: 'x86_64',
+              containerized: false,
+              hostname: 'suricata-zeek-sensor-toronto',
+              id: '8cc95778cce5407c809480e8e32ad76b',
+              name: 'suricata-zeek-sensor-toronto',
+              os: {
+                codename: 'bionic',
+                family: 'debian',
+                kernel: '4.15.0-45-generic',
+                name: 'Ubuntu',
+                platform: 'ubuntu',
+                version: '18.04.2 LTS (Bionic Beaver)',
+              },
+            },
+            service: {
+              type: 'auditd',
+            },
+            user: {
+              audit: {
+                id: 'unset',
+              },
+            },
+            signal: {
+              rule: fullSignal.signal.rule,
+              original_time: fullSignal.signal.original_time,
+              status: 'open',
+              depth: 1,
+              ancestors: [
+                {
+                  depth: 0,
+                  id: '9xbRBmkBR346wHgngz2D',
+                  index: 'auditbeat-8.0.0-2019.02.19-000001',
+                  type: 'event',
+                },
+              ],
+              original_event: {
+                action: 'changed-audit-configuration',
+                category: 'configuration',
+                module: 'auditd',
+              },
+              parent: {
+                depth: 0,
+                id: '9xbRBmkBR346wHgngz2D',
+                index: 'auditbeat-8.0.0-2019.02.19-000001',
+                type: 'event',
+              },
+              parents: [
+                {
+                  depth: 0,
+                  id: '9xbRBmkBR346wHgngz2D',
+                  index: 'auditbeat-8.0.0-2019.02.19-000001',
+                  type: 'event',
+                },
+              ],
+              _meta: {
+                version: SIGNALS_TEMPLATE_VERSION,
+              },
+            },
+          });
+        });
+
+        it('generates building block signals from EQL sequences in the expected form', async () => {
+          const rule: EqlCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: 'eql-rule',
+            type: 'eql',
+            language: 'eql',
+            query: 'sequence by host.name [anomoly where true] [any where true]',
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 3, [id]);
+          const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
+          const buildingBlock = signals.hits.hits.find(
+            (signal) =>
+              signal._source.signal.depth === 1 &&
+              get(signal._source, 'signal.original_event.category') === 'anomoly'
+          );
+          expect(buildingBlock).not.eql(undefined);
+          const signal = buildingBlock!._source.signal;
 
           expect(signal).eql({
             rule: signal.rule,
@@ -239,26 +507,26 @@ export default ({ getService }: FtrProviderContext) => {
             ancestors: [
               {
                 depth: 0,
-                id: 'gCF0B2kBR346wHgnb7m0',
+                id: 'VhXOBmkBR346wHgnLP8T',
                 index: 'auditbeat-8.0.0-2019.02.19-000001',
                 type: 'event',
               },
             ],
             original_event: {
-              action: 'error',
-              category: 'user-login',
+              action: 'changed-promiscuous-mode-on-device',
+              category: 'anomoly',
               module: 'auditd',
             },
             parent: {
               depth: 0,
-              id: 'gCF0B2kBR346wHgnb7m0',
+              id: 'VhXOBmkBR346wHgnLP8T',
               index: 'auditbeat-8.0.0-2019.02.19-000001',
               type: 'event',
             },
             parents: [
               {
                 depth: 0,
-                id: 'gCF0B2kBR346wHgnb7m0',
+                id: 'VhXOBmkBR346wHgnLP8T',
                 index: 'auditbeat-8.0.0-2019.02.19-000001',
                 type: 'event',
               },
@@ -269,24 +537,23 @@ export default ({ getService }: FtrProviderContext) => {
           });
         });
 
-        it('generates building block signals from EQL sequences in the expected form', async () => {
+        it('generates shell signals from EQL sequences in the expected form', async () => {
           const rule: EqlCreateSchema = {
             ...getRuleForSignalTesting(['auditbeat-*']),
             rule_id: 'eql-rule',
             type: 'eql',
             language: 'eql',
-            query: 'sequence by host.name [any where true] [any where true]',
+            query: 'sequence by host.name [anomoly where true] [any where true]',
           };
           const { id } = await createRule(supertest, rule);
           await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 10, [id]);
+          await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsByRuleIds(supertest, ['eql-rule']);
           const sequenceSignal = signalsOpen.hits.hits.find(
             (signal) => signal._source.signal.depth === 2
           );
           const signal = sequenceSignal!._source.signal;
           const eventIds = signal.parents.map((event) => event.id);
-
           expect(signal).eql({
             status: 'open',
             depth: 2,
@@ -295,7 +562,7 @@ export default ({ getService }: FtrProviderContext) => {
             ancestors: [
               {
                 depth: 0,
-                id: 'gCF0B2kBR346wHgnb7m0',
+                id: 'VhXOBmkBR346wHgnLP8T',
                 index: 'auditbeat-8.0.0-2019.02.19-000001',
                 type: 'event',
               },
@@ -308,7 +575,7 @@ export default ({ getService }: FtrProviderContext) => {
               },
               {
                 depth: 0,
-                id: 'CCF0B2kBR346wHgngLtX',
+                id: '4hbXBmkBR346wHgn6fdp',
                 index: 'auditbeat-8.0.0-2019.02.19-000001',
                 type: 'event',
               },
@@ -341,6 +608,254 @@ export default ({ getService }: FtrProviderContext) => {
             },
           });
         });
+
+        it('generates up to max_signals with an EQL rule', async () => {
+          const rule: EqlCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: 'eql-rule',
+            type: 'eql',
+            language: 'eql',
+            query: 'sequence by host.name [any where true] [any where true]',
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          // For EQL rules, max_signals is the maximum number of detected sequences: each sequence has a building block
+          // alert for each event in the sequence, so max_signals=100 results in 200 building blocks in addition to
+          // 100 regular alerts
+          await waitForSignalsToBePresent(supertest, 300, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, [id], 1000);
+          expect(signalsOpen.hits.hits.length).eql(300);
+          const shellSignals = signalsOpen.hits.hits.filter(
+            (signal) => signal._source.signal.depth === 2
+          );
+          const buildingBlocks = signalsOpen.hits.hits.filter(
+            (signal) => signal._source.signal.depth === 1
+          );
+          expect(shellSignals.length).eql(100);
+          expect(buildingBlocks.length).eql(200);
+        });
+      });
+
+      describe('Threshold Rules', () => {
+        it('generates 1 signal from Threshold rules when threshold is met', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: 'host.id',
+              value: 700,
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(1);
+          const signal = signalsOpen.hits.hits[0];
+          expect(signal._source.signal.threshold_result).eql({
+            terms: [
+              {
+                field: 'host.id',
+                value: '8cc95778cce5407c809480e8e32ad76b',
+              },
+            ],
+            count: 788,
+            from: '1900-01-01T00:00:00.000Z',
+          });
+        });
+
+        it('generates 2 signals from Threshold rules when threshold is met', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: 'host.id',
+              value: 100,
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 2, [id]);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(2);
+        });
+
+        it('applies the provided query before bucketing ', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: 'host.id:"2ab45fc1c41e4c84bbd02202a7e5761f"',
+            threshold: {
+              field: 'process.name',
+              value: 21,
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(1);
+        });
+
+        it('generates no signals from Threshold rules when threshold is met and cardinality is not met', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: 'host.id',
+              value: 100,
+              cardinality: [
+                {
+                  field: 'destination.ip',
+                  value: 100,
+                },
+              ],
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(0);
+        });
+
+        it('generates no signals from Threshold rules when cardinality is met and threshold is not met', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: 'host.id',
+              value: 1000,
+              cardinality: [
+                {
+                  field: 'destination.ip',
+                  value: 5,
+                },
+              ],
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(0);
+        });
+
+        it('generates signals from Threshold rules when threshold and cardinality are both met', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: 'host.id',
+              value: 100,
+              cardinality: [
+                {
+                  field: 'destination.ip',
+                  value: 5,
+                },
+              ],
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(1);
+          const signal = signalsOpen.hits.hits[0];
+          expect(signal._source.signal.threshold_result).eql({
+            terms: [
+              {
+                field: 'host.id',
+                value: '8cc95778cce5407c809480e8e32ad76b',
+              },
+            ],
+            cardinality: [
+              {
+                field: 'destination.ip',
+                value: 7,
+              },
+            ],
+            count: 788,
+            from: '1900-01-01T00:00:00.000Z',
+          });
+        });
+
+        it('should not generate signals if only one field meets the threshold requirement', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: ['host.id', 'process.name'],
+              value: 22,
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(0);
+        });
+
+        it('generates signals from Threshold rules when bucketing by multiple fields', async () => {
+          const ruleId = 'threshold-rule';
+          const rule: ThresholdCreateSchema = {
+            ...getRuleForSignalTesting(['auditbeat-*']),
+            rule_id: ruleId,
+            type: 'threshold',
+            language: 'kuery',
+            query: '*:*',
+            threshold: {
+              field: ['host.id', 'process.name', 'event.module'],
+              value: 21,
+            },
+          };
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id);
+          const signalsOpen = await getSignalsByRuleIds(supertest, [ruleId]);
+          expect(signalsOpen.hits.hits.length).eql(1);
+          const signal = signalsOpen.hits.hits[0];
+          expect(signal._source.signal.threshold_result).eql({
+            terms: [
+              {
+                field: 'event.module',
+                value: 'system',
+              },
+              {
+                field: 'host.id',
+                value: '2ab45fc1c41e4c84bbd02202a7e5761f',
+              },
+              {
+                field: 'process.name',
+                value: 'sshd',
+              },
+            ],
+            count: 21,
+            from: '1900-01-01T00:00:00.000Z',
+          });
+        });
       });
     });
 
diff --git a/x-pack/test/detection_engine_api_integration/utils.ts b/x-pack/test/detection_engine_api_integration/utils.ts
index d821b57faf2252..55011ec055190b 100644
--- a/x-pack/test/detection_engine_api_integration/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/utils.ts
@@ -778,6 +778,17 @@ export const countDownES = async (
   );
 };
 
+/**
+ * Refresh an index, making changes available to search.
+ * Useful for tests where we want to ensure that a rule does NOT create alerts, e.g. testing exceptions.
+ * @param es The ElasticSearch handle
+ */
+export const refreshIndex = async (es: KibanaClient, index?: string) => {
+  await es.indices.refresh({
+    index,
+  });
+};
+
 /**
  * Does a plain countdown and checks against a boolean to determine if to wait and try again.
  * This is useful for over the wire things that can cause issues such as conflict or timeouts
@@ -1107,7 +1118,7 @@ export const installPrePackagedRules = async (
  */
 export const createRuleWithExceptionEntries = async (
   supertest: SuperTest<supertestAsPromised.Test>,
-  rule: QueryCreateSchema,
+  rule: CreateRulesSchema,
   entries: NonEmptyEntriesArray[]
 ): Promise<FullResponseSchema> => {
   // eslint-disable-next-line @typescript-eslint/naming-convention
@@ -1141,7 +1152,7 @@ export const createRuleWithExceptionEntries = async (
   // the rule to sometimes not filter correctly the first time with an exception list
   // or other timing issues. Then afterwards wait for the rule to have succeeded before
   // returning.
-  const ruleWithException: QueryCreateSchema = {
+  const ruleWithException: CreateRulesSchema = {
     ...rule,
     enabled: false,
     exceptions_list: [
@@ -1202,3 +1213,16 @@ export const deleteMigrations = async ({
     )
   );
 };
+
+export const getOpenSignals = async (
+  supertest: SuperTest<supertestAsPromised.Test>,
+  es: KibanaClient,
+  rule: FullResponseSchema
+) => {
+  await waitForRuleSuccessOrStatus(supertest, rule.id);
+  // Critically important that we wait for rule success AND refresh the write index in that order before we
+  // assert that no signals were created. Otherwise, signals could be written but not available to query yet
+  // when we search, causing tests that check that signals are NOT created to pass when they should fail.
+  await refreshIndex(es, rule.output_index);
+  return getSignalsByIds(supertest, [rule.id]);
+};
diff --git a/x-pack/test/examples/search_examples/index.ts b/x-pack/test/examples/search_examples/index.ts
index 13eac7566525e2..65e214cda4cf8c 100644
--- a/x-pack/test/examples/search_examples/index.ts
+++ b/x-pack/test/examples/search_examples/index.ts
@@ -23,7 +23,8 @@ export default function ({ getService, loadTestFile }: PluginFunctionalProviderC
       await esArchiver.unload('lens/basic');
     });
 
-    loadTestFile(require.resolve('./search_sessions_cache'));
     loadTestFile(require.resolve('./search_session_example'));
+    loadTestFile(require.resolve('./search_example'));
+    loadTestFile(require.resolve('./search_sessions_cache'));
   });
 }
diff --git a/x-pack/test/examples/search_examples/search_example.ts b/x-pack/test/examples/search_examples/search_example.ts
new file mode 100644
index 00000000000000..c841b595ed1195
--- /dev/null
+++ b/x-pack/test/examples/search_examples/search_example.ts
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../functional/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['common', 'timePicker']);
+  const retry = getService('retry');
+  const comboBox = getService('comboBox');
+
+  describe('Search session example', () => {
+    const appId = 'searchExamples';
+
+    before(async function () {
+      await PageObjects.common.navigateToApp(appId, { insertTimestamp: false });
+      await comboBox.set('indexPatternSelector', 'logstash-*');
+      await comboBox.set('searchBucketField', 'geo.src');
+      await comboBox.set('searchMetricField', 'memory');
+      await PageObjects.timePicker.setAbsoluteRange(
+        'Mar 1, 2015 @ 00:00:00.000',
+        'Nov 1, 2015 @ 00:00:00.000'
+      );
+    });
+
+    it('should have an other bucket', async () => {
+      await testSubjects.click('searchSourceWithOther');
+      await testSubjects.click('responseTab');
+      const codeBlock = await testSubjects.find('responseCodeBlock');
+      await retry.waitFor('get code block', async () => {
+        const visibleText = await codeBlock.getVisibleText();
+        const parsedResponse = JSON.parse(visibleText);
+        const buckets = parsedResponse.aggregations[1].buckets;
+        return (
+          buckets.length === 3 && buckets[2].key === '__other__' && buckets[2].doc_count === 9039
+        );
+      });
+    });
+
+    it('should not have an other bucket', async () => {
+      await testSubjects.click('searchSourceWithoutOther');
+      await testSubjects.click('responseTab');
+      const codeBlock = await testSubjects.find('responseCodeBlock');
+      await retry.waitFor('get code block', async () => {
+        const visibleText = await codeBlock.getVisibleText();
+        const parsedResponse = JSON.parse(visibleText);
+        const buckets = parsedResponse.aggregations[1].buckets;
+        return buckets.length === 2;
+      });
+    });
+  });
+}
diff --git a/x-pack/test/examples/search_examples/search_sessions_cache.ts b/x-pack/test/examples/search_examples/search_sessions_cache.ts
index 57b2d1665d9010..7e52849ed2a7e1 100644
--- a/x-pack/test/examples/search_examples/search_sessions_cache.ts
+++ b/x-pack/test/examples/search_examples/search_sessions_cache.ts
@@ -14,6 +14,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common']);
   const toasts = getService('toasts');
   const retry = getService('retry');
+  const comboBox = getService('comboBox');
 
   async function getExecutedAt() {
     const toast = await toasts.getToastElement(1);
@@ -26,11 +27,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     return text;
   }
 
-  describe.skip('Search session client side cache', () => {
+  describe('Search session client side cache', () => {
     const appId = 'searchExamples';
 
     before(async function () {
       await PageObjects.common.navigateToApp(appId, { insertTimestamp: false });
+      await comboBox.set('indexPatternSelector', 'logstash-*');
+      await comboBox.set('searchBucketField', 'extension.raw');
+      await comboBox.set('searchMetricField', 'phpmemory');
     });
 
     it('should cache responses by search session id', async () => {
diff --git a/x-pack/test/fleet_api_integration/apis/epm/index.js b/x-pack/test/fleet_api_integration/apis/epm/index.js
index 009e1a2dad5f15..445d9706bb9a93 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/index.js
+++ b/x-pack/test/fleet_api_integration/apis/epm/index.js
@@ -24,5 +24,6 @@ export default function loadTests({ loadTestFile }) {
     loadTestFile(require.resolve('./update_assets'));
     loadTestFile(require.resolve('./data_stream'));
     loadTestFile(require.resolve('./package_install_complete'));
+    loadTestFile(require.resolve('./install_error_rollback'));
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/install_error_rollback.ts b/x-pack/test/fleet_api_integration/apis/epm/install_error_rollback.ts
new file mode 100644
index 00000000000000..6e2ea3b96aa582
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/epm/install_error_rollback.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
+import { skipIfNoDockerRegistry } from '../../helpers';
+
+export default function (providerContext: FtrProviderContext) {
+  const { getService } = providerContext;
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+  const goodPackage = 'error_handling-0.1.0';
+  const badPackage = 'error_handling-0.2.0';
+
+  const installPackage = async (pkgkey: string) => {
+    await supertest
+      .post(`/api/fleet/epm/packages/${pkgkey}`)
+      .set('kbn-xsrf', 'xxxx')
+      .send({ force: true });
+  };
+
+  const getPackageInfo = async (pkgkey: string) => {
+    return await supertest.get(`/api/fleet/epm/packages/${pkgkey}`).set('kbn-xsrf', 'xxxx');
+  };
+
+  describe('package installation error handling and rollback', async () => {
+    skipIfNoDockerRegistry(providerContext);
+    beforeEach(async () => {
+      await esArchiver.load('empty_kibana');
+    });
+    afterEach(async () => {
+      await esArchiver.unload('empty_kibana');
+    });
+
+    it('on a fresh install, it should uninstall a broken package during rollback', async function () {
+      await supertest
+        .post(`/api/fleet/epm/packages/${badPackage}`)
+        .set('kbn-xsrf', 'xxxx')
+        .expect(422); // the broken package contains a broken visualization triggering a 422 from Kibana
+
+      const pkgInfoResponse = await getPackageInfo(badPackage);
+      expect(JSON.parse(pkgInfoResponse.text).response.status).to.be('not_installed');
+    });
+
+    it('on an upgrade, it should fall back to the previous good version during rollback', async function () {
+      await installPackage(goodPackage);
+      await supertest
+        .post(`/api/fleet/epm/packages/${badPackage}`)
+        .set('kbn-xsrf', 'xxxx')
+        .expect(422); // the broken package contains a broken visualization triggering a 422 from Kibana
+
+      const goodPkgInfoResponse = await getPackageInfo(goodPackage);
+      expect(JSON.parse(goodPkgInfoResponse.text).response.status).to.be('installed');
+      expect(JSON.parse(goodPkgInfoResponse.text).response.version).to.be('0.1.0');
+    });
+  });
+}
diff --git a/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/docs/README.md b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/docs/README.md
new file mode 100644
index 00000000000000..260499f4b00785
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/docs/README.md
@@ -0,0 +1,3 @@
+This package should install without errors.
+
+Version 0.2.0 of this package should fail during installation. We need this good version to test rollback.
\ No newline at end of file
diff --git a/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/kibana/visualization/sample_visualization.json b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/kibana/visualization/sample_visualization.json
new file mode 100644
index 00000000000000..01afe600853efa
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/kibana/visualization/sample_visualization.json
@@ -0,0 +1,14 @@
+{
+  "attributes": {
+    "description": "sample visualization",
+    "title": "sample vis title",
+    "uiStateJSON": "{}",
+    "version": 1,
+    "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Log Level\",\"field\":\"log.level\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"@timestamp per day\"},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Log levels over time [Logs Kafka] ECS\",\"type\":\"histogram\"}"
+  },
+  "id": "sample_visualization",
+  "type": "visualization",
+  "migrationVersion": {
+    "visualization": "7.7.0"
+  }
+}
diff --git a/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/manifest.yml b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/manifest.yml
new file mode 100644
index 00000000000000..bba1a6a4c347d1
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.1.0/manifest.yml
@@ -0,0 +1,20 @@
+format_version: 1.0.0
+name: error_handling 
+title: Error handling
+description: tests error handling and rollback 
+version: 0.1.0
+categories: []
+release: beta
+type: integration
+license: basic
+
+requirement:
+  elasticsearch:
+    versions: '>7.7.0'
+  kibana:
+    versions: '>7.7.0'
+
+icons:
+  - src: '/img/logo_overrides_64_color.svg'
+    size: '16x16'
+    type: 'image/svg+xml'
\ No newline at end of file
diff --git a/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/docs/README.md b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/docs/README.md
new file mode 100644
index 00000000000000..c348f801b17801
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/docs/README.md
@@ -0,0 +1,5 @@
+This package should fail during installation.
+
+Version 0.1.0 of this package should install without errors, and be rolled back to without errors.
+
+This package contains one Kibana visualization that requires a non-existent version of Kibana in order to trigger an error during installation.
\ No newline at end of file
diff --git a/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/kibana/visualization/sample_visualization.json b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/kibana/visualization/sample_visualization.json
new file mode 100644
index 00000000000000..0a4867cfe1c119
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/kibana/visualization/sample_visualization.json
@@ -0,0 +1,14 @@
+{
+  "attributes": {
+    "description": "sample visualization",
+    "title": "sample vis title",
+    "uiStateJSON": "{}",
+    "version": 1,
+    "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Log Level\",\"field\":\"log.level\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"@timestamp per day\"},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"title\":\"Log levels over time [Logs Kafka] ECS\",\"type\":\"histogram\"}"
+  },
+  "id": "sample_visualization",
+  "type": "visualization",
+  "migrationVersion": {
+    "visualization": "12.7.0"
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/manifest.yml b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/manifest.yml
new file mode 100644
index 00000000000000..2eb6a41a77ede8
--- /dev/null
+++ b/x-pack/test/fleet_api_integration/apis/fixtures/test_packages/error_handling/0.2.0/manifest.yml
@@ -0,0 +1,19 @@
+format_version: 1.0.0
+name: error_handling 
+title: Error handling
+description: tests error handling and rollback 
+version: 0.2.0
+categories: []
+release: beta
+type: integration
+license: basic
+
+requirement:
+  elasticsearch:
+    versions: '>7.7.0'
+  kibana:
+    versions: '>7.7.0'
+
+icons:
+  - src: '/img/logo_overrides_64_color.svg'
+    size: '16x16'
\ No newline at end of file
diff --git a/x-pack/test/functional/apps/dashboard/_async_dashboard.ts b/x-pack/test/functional/apps/dashboard/_async_dashboard.ts
index 5b2632ef710e4d..88848401a4c9d4 100644
--- a/x-pack/test/functional/apps/dashboard/_async_dashboard.ts
+++ b/x-pack/test/functional/apps/dashboard/_async_dashboard.ts
@@ -179,7 +179,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       log.debug('Checking area, bar and heatmap charts rendered');
       await dashboardExpect.seriesElementCount(15);
       log.debug('Checking saved searches rendered');
-      await dashboardExpect.savedSearchRowCount(50);
+      await dashboardExpect.savedSearchRowCount(11);
       log.debug('Checking input controls rendered');
       await dashboardExpect.inputControlItemCount(3);
       log.debug('Checking tag cloud rendered');
diff --git a/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts b/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts
index 56a8ab46a57da7..87ecfe0dcada92 100644
--- a/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts
+++ b/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts
@@ -15,7 +15,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const testSubjects = getService('testSubjects');
   const dashboardPanelActions = getService('dashboardPanelActions');
-  const dashboardVisualizations = getService('dashboardVisualizations');
 
   describe('dashboard lens by value', function () {
     before(async () => {
@@ -27,7 +26,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     });
 
     it('can add a lens panel by value', async () => {
-      await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
       await PageObjects.lens.createAndAddLensFromDashboard({});
       const newPanelCount = await PageObjects.dashboard.getPanelCount();
       expect(newPanelCount).to.eql(1);
diff --git a/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts b/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts
index 15c76c3367a86d..487dc90e1877ef 100644
--- a/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts
+++ b/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts
@@ -19,10 +19,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
   const log = getService('log');
   const esArchiver = getService('esArchiver');
-  const dashboardVisualizations = getService('dashboardVisualizations');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const testSubjects = getService('testSubjects');
   const appsMenu = getService('appsMenu');
+  const dashboardAddPanel = getService('dashboardAddPanel');
 
   const LAYER_NAME = 'World Countries';
   let mapCounter = 0;
@@ -33,7 +33,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     if (inViewMode) {
       await PageObjects.dashboard.switchToEditMode();
     }
-    await PageObjects.visualize.clickMapsApp();
+    await dashboardAddPanel.clickEditorMenuButton();
+    await dashboardAddPanel.clickVisType('maps');
     await PageObjects.maps.clickSaveAndReturnButton();
   }
 
@@ -82,8 +83,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     describe('adding a map by value', () => {
       it('can add a map by value', async () => {
         await createNewDashboard();
-
-        await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
         await createAndAddMapByValue();
         const newPanelCount = await PageObjects.dashboard.getPanelCount();
         expect(newPanelCount).to.eql(1);
@@ -93,7 +92,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     describe('editing a map by value', () => {
       before(async () => {
         await createNewDashboard();
-        await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
         await createAndAddMapByValue();
         await editByValueMap();
       });
@@ -112,7 +110,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     describe('editing a map and adding to map library', () => {
       beforeEach(async () => {
         await createNewDashboard();
-        await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
         await createAndAddMapByValue();
       });
 
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
index 68b057e9487ceb..b891d3cce3ba09 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
@@ -12,6 +12,7 @@ const DRILLDOWN_TO_PIE_CHART_NAME = 'Go to pie chart dashboard';
 const DRILLDOWN_TO_AREA_CHART_NAME = 'Go to area chart dashboard';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const dashboardDrilldownPanelActions = getService('dashboardDrilldownPanelActions');
   const dashboardDrilldownsManage = getService('dashboardDrilldownsManage');
@@ -27,7 +28,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const log = getService('log');
   const browser = getService('browser');
   const retry = getService('retry');
-  const testSubjects = getService('testSubjects');
   const filterBar = getService('filterBar');
   const security = getService('security');
   const spaces = getService('spaces');
@@ -49,18 +49,18 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.dashboard.gotoDashboardEditMode(
           dashboardDrilldownsManage.DASHBOARD_WITH_PIE_CHART_NAME
         );
-
         // create drilldown
         await dashboardPanelActions.openContextMenu();
         await dashboardDrilldownPanelActions.expectExistsCreateDrilldownAction();
         await dashboardDrilldownPanelActions.clickCreateDrilldown();
         await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutOpen();
+        await testSubjects.click('actionFactoryItem-DASHBOARD_TO_DASHBOARD_DRILLDOWN');
         await dashboardDrilldownsManage.fillInDashboardToDashboardDrilldownWizard({
           drilldownName: DRILLDOWN_TO_AREA_CHART_NAME,
           destinationDashboardTitle: dashboardDrilldownsManage.DASHBOARD_WITH_AREA_CHART_NAME,
         });
         await dashboardDrilldownsManage.saveChanges();
-        await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutClose();
+        await dashboardDrilldownsManage.closeFlyout();
 
         // check that drilldown notification badge is shown
         expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(1);
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts
index e0b6c6a5f4803b..5ed118c9b753a1 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_url_drilldown.ts
@@ -39,6 +39,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       const urlTemplate = `{{kibanaUrl}}/app/discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'{{date event.from}}',to:'{{date event.to}}'))&_a=(columns:!(_source),filters:{{rison context.panel.filters}},index:'{{context.panel.indexPatternId}}',interval:auto,query:(language:{{context.panel.query.language}},query:'{{context.panel.query.query}}'),sort:!())`;
 
+      await testSubjects.click('actionFactoryItem-URL_DRILLDOWN');
       await dashboardDrilldownsManage.fillInDashboardToURLDrilldownWizard({
         drilldownName: DRILLDOWN_TO_DISCOVER_URL,
         destinationURLTemplate: urlTemplate,
@@ -49,7 +50,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await testSubjects.click('urlDrilldownOpenInNewTab');
 
       await dashboardDrilldownsManage.saveChanges();
-      await dashboardDrilldownsManage.expectsCreateDrilldownFlyoutClose();
+      await dashboardDrilldownsManage.closeFlyout();
 
       // check that drilldown notification badge is shown
       expect(await PageObjects.dashboard.getPanelDrilldownCount()).to.be(2);
diff --git a/x-pack/test/functional/apps/dashboard/feature_controls/time_to_visualize_security.ts b/x-pack/test/functional/apps/dashboard/feature_controls/time_to_visualize_security.ts
index 3ebc53cc7cf270..730c00a8d5e4f1 100644
--- a/x-pack/test/functional/apps/dashboard/feature_controls/time_to_visualize_security.ts
+++ b/x-pack/test/functional/apps/dashboard/feature_controls/time_to_visualize_security.ts
@@ -21,7 +21,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     'lens',
   ]);
 
-  const dashboardVisualizations = getService('dashboardVisualizations');
+  const dashboardAddPanel = getService('dashboardAddPanel');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const dashboardExpect = getService('dashboardExpect');
   const testSubjects = getService('testSubjects');
@@ -85,7 +85,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       });
 
       it('can add a lens panel by value', async () => {
-        await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
         await PageObjects.lens.createAndAddLensFromDashboard({});
         const newPanelCount = await PageObjects.dashboard.getPanelCount();
         expect(newPanelCount).to.eql(1);
@@ -171,9 +170,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         await PageObjects.dashboard.clickNewDashboard();
         await PageObjects.dashboard.waitForRenderComplete();
 
-        await testSubjects.click('dashboardAddNewPanelButton');
-        await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
-        await PageObjects.visualize.clickMarkdownWidget();
+        await dashboardAddPanel.clickMarkdownQuickButton();
         await PageObjects.visEditor.setMarkdownTxt(originalMarkdownText);
         await PageObjects.visEditor.clickGo();
 
diff --git a/x-pack/test/functional/apps/dashboard/sync_colors.ts b/x-pack/test/functional/apps/dashboard/sync_colors.ts
index 7e54f966870c3a..09575c355913e1 100644
--- a/x-pack/test/functional/apps/dashboard/sync_colors.ts
+++ b/x-pack/test/functional/apps/dashboard/sync_colors.ts
@@ -49,7 +49,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await elasticChart.setNewChartUiDebugFlag(true);
       await PageObjects.dashboard.clickCreateDashboardPrompt();
       await dashboardAddPanel.clickCreateNewLink();
-      await dashboardAddPanel.clickVisType('lens');
       await PageObjects.header.waitUntilLoadingHasFinished();
       await PageObjects.lens.goToTimeRange();
 
@@ -68,7 +67,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.lens.save('vis1', false, true);
       await PageObjects.header.waitUntilLoadingHasFinished();
       await dashboardAddPanel.clickCreateNewLink();
-      await dashboardAddPanel.clickVisType('lens');
       await PageObjects.header.waitUntilLoadingHasFinished();
 
       await PageObjects.lens.configureDimension({
diff --git a/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js b/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
index 57925ad50d155e..37311de5341955 100644
--- a/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
+++ b/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
@@ -10,7 +10,6 @@ import expect from '@kbn/expect';
 export default function ({ getPageObjects, getService }) {
   const testSubjects = getService('testSubjects');
   const esArchiver = getService('esArchiver');
-  const dashboardVisualizations = getService('dashboardVisualizations');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const PageObjects = getPageObjects(['common', 'dashboard', 'visualize', 'lens']);
 
@@ -29,9 +28,6 @@ export default function ({ getPageObjects, getService }) {
 
     it('adds Lens visualization to empty dashboard', async () => {
       const title = 'Dashboard Test Lens';
-      await testSubjects.exists('dashboardAddNewPanelButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
-      await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
       await PageObjects.lens.createAndAddLensFromDashboard({ title, redirectToOrigin: true });
       await PageObjects.dashboard.waitForRenderComplete();
       await testSubjects.exists(`embeddablePanelHeading-${title}`);
@@ -87,9 +83,6 @@ export default function ({ getPageObjects, getService }) {
       const title = 'non-dashboard Test Lens';
       await PageObjects.dashboard.loadSavedDashboard('empty dashboard test');
       await PageObjects.dashboard.switchToEditMode();
-      await testSubjects.exists('dashboardAddNewPanelButton');
-      await testSubjects.click('dashboardAddNewPanelButton');
-      await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
       await PageObjects.lens.createAndAddLensFromDashboard({ title });
       await PageObjects.lens.notLinkedToOriginatingApp();
       await PageObjects.common.navigateToApp('dashboard');
diff --git a/x-pack/test/functional/apps/dashboard_mode/dashboard_view_mode.js b/x-pack/test/functional/apps/dashboard_mode/dashboard_view_mode.js
index 6bbf1aabe9506e..51e41fe760ddd7 100644
--- a/x-pack/test/functional/apps/dashboard_mode/dashboard_view_mode.js
+++ b/x-pack/test/functional/apps/dashboard_mode/dashboard_view_mode.js
@@ -48,10 +48,10 @@ export default function ({ getService, getPageObjects }) {
 
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.clickNewDashboard();
+      await dashboardAddPanel.addSavedSearch(savedSearchName);
       await PageObjects.dashboard.addVisualizations(
         PageObjects.dashboard.getTestVisualizationNames()
       );
-      await dashboardAddPanel.addSavedSearch(savedSearchName);
       await PageObjects.dashboard.saveDashboard(dashboardName);
     });
 
diff --git a/x-pack/test/functional/apps/lens/chart_data.ts b/x-pack/test/functional/apps/lens/chart_data.ts
index c4db59c020f131..b87d4e999d5972 100644
--- a/x-pack/test/functional/apps/lens/chart_data.ts
+++ b/x-pack/test/functional/apps/lens/chart_data.ts
@@ -37,19 +37,19 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     const expectedData = [
-      { x: '0.53.251.53', y: 4624.75 },
-      { x: '0.108.3.2', y: 7359.41 },
-      { x: '0.209.80.244', y: 6169.9 },
-      { x: '0.228.1.71', y: 7092.8 },
-      { x: '0.254.91.215', y: 3835.58 },
-      { x: '__other__', y: 5727.24 },
+      { x: '97.220.3.248', y: 19755 },
+      { x: '169.228.188.120', y: 18994 },
+      { x: '78.83.247.30', y: 17246 },
+      { x: '226.82.228.233', y: 15687 },
+      { x: '93.28.27.24', y: 15614.33 },
+      { x: 'Other', y: 5722.77 },
     ];
 
     function assertMatchesExpectedData(state: DebugState) {
       expect(
         state.bars![0].bars.map((bar) => ({
           x: bar.x,
-          y: Math.round(bar.y * 100) / 100,
+          y: Math.floor(bar.y * 100) / 100,
         }))
       ).to.eql(expectedData);
     }
@@ -91,10 +91,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const values = await Promise.all(
         range(0, 6).map((index) => PageObjects.lens.getDatatableCellText(index, 1))
       );
-      expect(terms.map((term) => (term === 'Other' ? '__other__' : term))).to.eql(
-        expectedData.map(({ x }) => x)
-      );
-      expect(values.map((value) => Math.round(100 * Number(value.replace(',', ''))) / 100)).to.eql(
+      expect(terms).to.eql(expectedData.map(({ x }) => x));
+      expect(values.map((value) => Math.floor(100 * Number(value.replace(',', ''))) / 100)).to.eql(
         expectedData.map(({ y }) => y)
       );
     });
diff --git a/x-pack/test/functional/apps/lens/dashboard.ts b/x-pack/test/functional/apps/lens/dashboard.ts
index a15176d76f9538..1490abb320ca64 100644
--- a/x-pack/test/functional/apps/lens/dashboard.ts
+++ b/x-pack/test/functional/apps/lens/dashboard.ts
@@ -134,7 +134,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await filterBar.addFilter('geo.dest', 'is', 'LS');
 
       await dashboardAddPanel.clickCreateNewLink();
-      await dashboardAddPanel.clickVisType('lens');
       await PageObjects.header.waitUntilLoadingHasFinished();
       const hasGeoDestFilter = await filterBar.hasFilter('geo.dest', 'LS');
       expect(hasGeoDestFilter).to.be(false);
@@ -200,7 +199,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.dashboard.clickNewDashboard();
 
       await dashboardAddPanel.clickCreateNewLink();
-      await dashboardAddPanel.clickVisType('lens');
       await PageObjects.header.waitUntilLoadingHasFinished();
       await PageObjects.lens.goToTimeRange();
 
diff --git a/x-pack/test/functional/apps/lens/lens_tagging.ts b/x-pack/test/functional/apps/lens/lens_tagging.ts
index 7ce31709498fcc..6fff2baa2d0ccb 100644
--- a/x-pack/test/functional/apps/lens/lens_tagging.ts
+++ b/x-pack/test/functional/apps/lens/lens_tagging.ts
@@ -14,7 +14,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const retry = getService('retry');
   const find = getService('find');
-  const dashboardVisualizations = getService('dashboardVisualizations');
+  const dashboardAddPanel = getService('dashboardAddPanel');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const PageObjects = getPageObjects([
     'common',
@@ -39,8 +39,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     it('adds a new tag to a Lens visualization', async () => {
       // create lens
-      await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
-      await PageObjects.visualize.clickLensWidget();
+      await dashboardAddPanel.clickCreateNewLink();
       await PageObjects.lens.goToTimeRange();
       await PageObjects.lens.configureDimension({
         dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
diff --git a/x-pack/test/functional/apps/maps/embeddable/embeddable_library.js b/x-pack/test/functional/apps/maps/embeddable/embeddable_library.js
index 40e73f0d8a7632..9bff4e56c6c5be 100644
--- a/x-pack/test/functional/apps/maps/embeddable/embeddable_library.js
+++ b/x-pack/test/functional/apps/maps/embeddable/embeddable_library.js
@@ -15,7 +15,6 @@ export default function ({ getPageObjects, getService }) {
   const security = getService('security');
   const dashboardAddPanel = getService('dashboardAddPanel');
   const dashboardPanelActions = getService('dashboardPanelActions');
-  const dashboardVisualizations = getService('dashboardVisualizations');
 
   describe('maps in embeddable library', () => {
     before(async () => {
@@ -34,8 +33,7 @@ export default function ({ getPageObjects, getService }) {
       });
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.clickNewDashboard();
-      await dashboardAddPanel.clickCreateNewLink();
-      await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
+      await dashboardAddPanel.clickEditorMenuButton();
       await PageObjects.visualize.clickMapsApp();
       await PageObjects.header.waitUntilLoadingHasFinished();
       await PageObjects.maps.waitForLayersToLoad();
diff --git a/x-pack/test/functional/apps/maps/embeddable/save_and_return.js b/x-pack/test/functional/apps/maps/embeddable/save_and_return.js
index a3abb01b4cf9f0..a7e649548306ba 100644
--- a/x-pack/test/functional/apps/maps/embeddable/save_and_return.js
+++ b/x-pack/test/functional/apps/maps/embeddable/save_and_return.js
@@ -11,7 +11,6 @@ export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'maps', 'visualize']);
   const dashboardAddPanel = getService('dashboardAddPanel');
   const dashboardPanelActions = getService('dashboardPanelActions');
-  const dashboardVisualizations = getService('dashboardVisualizations');
   const testSubjects = getService('testSubjects');
   const security = getService('security');
 
@@ -37,9 +36,8 @@ export default function ({ getPageObjects, getService }) {
       beforeEach(async () => {
         await PageObjects.common.navigateToApp('dashboard');
         await PageObjects.dashboard.clickNewDashboard();
-        await dashboardAddPanel.clickCreateNewLink();
-        await await dashboardVisualizations.ensureNewVisualizationDialogIsShowing();
-        await PageObjects.visualize.clickMapsApp();
+        await dashboardAddPanel.clickEditorMenuButton();
+        await dashboardAddPanel.clickVisType('maps');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await PageObjects.maps.waitForLayersToLoad();
       });
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
index 5e6a08751c932c..80d64ffa15d49f 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
@@ -62,6 +62,7 @@ export default function ({ getService }: FtrProviderContext) {
             { color: '#D3DAE6', percentage: 8 },
             { color: '#F5F7FA', percentage: 15 },
           ],
+          runtimeFieldsEditorContent: ['{', '  "uppercase_y": {', '    "type": "keyword",'],
           row: {
             type: 'classification',
             status: 'stopped',
@@ -113,9 +114,9 @@ export default function ({ getService }: FtrProviderContext) {
             JSON.stringify(testData.runtimeFields)
           );
           await ml.dataFrameAnalyticsCreation.applyRuntimeMappings();
-          await ml.dataFrameAnalyticsCreation.assertRuntimeMappingsEditorContent([
-            '{"uppercase_y":{"type":"keyword","script":"emit(params._source.y.toUpperCase())"}}',
-          ]);
+          await ml.dataFrameAnalyticsCreation.assertRuntimeMappingsEditorContent(
+            testData.expected.runtimeFieldsEditorContent
+          );
 
           await ml.testExecution.logTestStep('inputs the dependent variable');
           await ml.dataFrameAnalyticsCreation.assertDependentVariableInputExists();
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
index e73a477d21b1b0..3866642383b223 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
@@ -72,6 +72,11 @@ export default function ({ getService }: FtrProviderContext) {
             // anti-aliasing
             { color: '#F5F7FA', percentage: 30 },
           ],
+          runtimeFieldsEditorContent: [
+            '{',
+            '  "lowercase_central_air": {',
+            '    "type": "keyword",',
+          ],
           row: {
             type: 'outlier_detection',
             status: 'stopped',
@@ -124,9 +129,9 @@ export default function ({ getService }: FtrProviderContext) {
             JSON.stringify(testData.runtimeFields)
           );
           await ml.dataFrameAnalyticsCreation.applyRuntimeMappings();
-          await ml.dataFrameAnalyticsCreation.assertRuntimeMappingsEditorContent([
-            '{"lowercase_central_air":{"type":"keyword","script":"emit(params._source.CentralAir.toLowerCase())"}}',
-          ]);
+          await ml.dataFrameAnalyticsCreation.assertRuntimeMappingsEditorContent(
+            testData.expected.runtimeFieldsEditorContent
+          );
 
           await ml.testExecution.logTestStep('does not display the dependent variable input');
           await ml.dataFrameAnalyticsCreation.assertDependentVariableInputMissing();
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
index 540fbc10fa0fc3..a65d8986595ccc 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
@@ -55,6 +55,7 @@ export default function ({ getService }: FtrProviderContext) {
             { color: '#F5F7FA', percentage: 10 },
             { color: '#D3DAE6', percentage: 3 },
           ],
+          runtimeFieldsEditorContent: ['{', '  "uppercase_stab": {', '    "type": "keyword",'],
           row: {
             type: 'regression',
             status: 'stopped',
@@ -107,9 +108,9 @@ export default function ({ getService }: FtrProviderContext) {
             JSON.stringify(testData.runtimeFields)
           );
           await ml.dataFrameAnalyticsCreation.applyRuntimeMappings();
-          await ml.dataFrameAnalyticsCreation.assertRuntimeMappingsEditorContent([
-            '{"uppercase_stab":{"type":"keyword","script":"emit(params._source.stabf.toUpperCase())"}}',
-          ]);
+          await ml.dataFrameAnalyticsCreation.assertRuntimeMappingsEditorContent(
+            testData.expected.runtimeFieldsEditorContent
+          );
 
           await ml.testExecution.logTestStep('inputs the dependent variable');
           await ml.dataFrameAnalyticsCreation.assertDependentVariableInputExists();
diff --git a/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts b/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts
index f7bfd7f7a4c62e..d4eb45619b7f7b 100644
--- a/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts
+++ b/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts
@@ -58,7 +58,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const ml = getService('ml');
   const PageObjects = getPageObjects(['common', 'timePicker', 'dashboard']);
-  const dashboardAddPanel = getService('dashboardAddPanel');
 
   describe('anomaly charts', function () {
     this.tags(['mlqa']);
@@ -87,10 +86,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('can open job selection flyout', async () => {
           await PageObjects.dashboard.clickCreateDashboardPrompt();
           await ml.dashboardEmbeddables.assertDashboardIsEmpty();
-          await dashboardAddPanel.clickOpenAddPanel();
-          await dashboardAddPanel.ensureAddPanelIsShowing();
-          await dashboardAddPanel.clickAddNewEmbeddableLink('ml_anomaly_charts');
-          await ml.dashboardJobSelectionTable.assertJobSelectionTableExists();
+          await ml.dashboardEmbeddables.openJobSelectionFlyout();
         });
 
         it('can select jobs', async () => {
diff --git a/x-pack/test/functional/apps/security/doc_level_security_roles.js b/x-pack/test/functional/apps/security/doc_level_security_roles.js
index 341a0a97073dcd..356216232b0fa3 100644
--- a/x-pack/test/functional/apps/security/doc_level_security_roles.js
+++ b/x-pack/test/functional/apps/security/doc_level_security_roles.js
@@ -76,7 +76,7 @@ export default function ({ getService, getPageObjects }) {
       });
       const rowData = await PageObjects.discover.getDocTableIndex(1);
       expect(rowData).to.be(
-        'name:ABC Company name.keyword:ABC Company region:EAST region.keyword:EAST _id:doc1 _index:dlstest _score:0 _type: -'
+        'nameABC Companyname.keywordABC CompanyregionEASTregion.keywordEAST_iddoc1_indexdlstest_score0_type -'
       );
     });
     after('logout', async () => {
diff --git a/x-pack/test/functional/apps/security/field_level_security.js b/x-pack/test/functional/apps/security/field_level_security.js
index 5466e8d58e8e92..220a70b2ae9f02 100644
--- a/x-pack/test/functional/apps/security/field_level_security.js
+++ b/x-pack/test/functional/apps/security/field_level_security.js
@@ -108,9 +108,7 @@ export default function ({ getService, getPageObjects }) {
         expect(hitCount).to.be('2');
       });
       const rowData = await PageObjects.discover.getDocTableIndex(1);
-      expect(rowData).to.be(
-        'customer_name:ABC Company customer_name.keyword:ABC Company customer_region:WEST customer_region.keyword:WEST customer_ssn:444.555.6666 customer_ssn.keyword:444.555.6666 runtime_customer_ssn:444.555.6666 calculated at runtime _id:2 _index:flstest _score:0 _type: -'
-      );
+      expect(rowData).to.contain('ssn');
     });
 
     it('user customer2 should not see ssn', async function () {
@@ -122,9 +120,7 @@ export default function ({ getService, getPageObjects }) {
         expect(hitCount).to.be('2');
       });
       const rowData = await PageObjects.discover.getDocTableIndex(1);
-      expect(rowData).to.be(
-        'customer_name:ABC Company customer_name.keyword:ABC Company customer_region:WEST customer_region.keyword:WEST _id:2 _index:flstest _score:0 _type: -'
-      );
+      expect(rowData).not.to.contain('ssn');
     });
 
     after(async function () {
diff --git a/x-pack/test/functional/apps/visualize/precalculated_histogram.ts b/x-pack/test/functional/apps/visualize/precalculated_histogram.ts
index 459a497355e0d6..20111b8f4f1e02 100644
--- a/x-pack/test/functional/apps/visualize/precalculated_histogram.ts
+++ b/x-pack/test/functional/apps/visualize/precalculated_histogram.ts
@@ -27,8 +27,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     it('appears correctly in discover', async function () {
       await PageObjects.common.navigateToApp('discover');
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await PageObjects.discover.clickFieldListItemAdd('histogram-content');
       const rowData = await PageObjects.discover.getDocTableIndex(1);
-      expect(rowData.includes('"values":[0.3,1,3,4.2,4.8]')).to.be.ok();
+      expect(rowData).to.contain('"values":[0.3,1,3,4.2,4.8]');
     });
 
     describe('works in visualizations', () => {
diff --git a/x-pack/test/functional/es_archives/auditbeat/default/data.json b/x-pack/test/functional/es_archives/auditbeat/default/data.json
new file mode 100644
index 00000000000000..b10f3cc73ec6ab
--- /dev/null
+++ b/x-pack/test/functional/es_archives/auditbeat/default/data.json
@@ -0,0 +1,110231 @@
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Rs93UmcBTFzn_XoLWT6M",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:11.544Z",
+      "process": {
+        "pid": "31964",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.87.213"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "128.199.87.213",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.87.213",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192383,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R893UmcBTFzn_XoLWT6M",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:12.110Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31966",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.40.116.98"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.40.116.98",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192384,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SM93UmcBTFzn_XoLWT6M",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:12.111Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31966",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.40.116.98"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.40.116.98",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192385,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Sc93UmcBTFzn_XoLWT6M",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:12.224Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31966"
+      },
+      "source": {
+        "ip": "89.40.116.98"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "sequence": 192386,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "89.40.116.98",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "89.40.116.98"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A89-UmcBTFzn_XoLj91w",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:04.229Z",
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "187.188.146.35",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142249,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "187.188.146.35"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BM9-UmcBTFzn_XoLj91w",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:04.231Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "187.188.146.35"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142250,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "187.188.146.35"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Bc9-UmcBTFzn_XoLj91w",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:04.295Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "187.188.146.35",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142251,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "187.188.146.35"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "187.188.146.35"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3M99UmcBTFzn_XoL9c8q",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:24.736Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31771"
+      },
+      "source": {
+        "ip": "185.66.213.116"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.66.213.116",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186194
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3c99UmcBTFzn_XoL9c8q",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:24.738Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186195,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "185.66.213.116",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31771",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "185.66.213.116"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3s99UmcBTFzn_XoL9c8q",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:24.872Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31771",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.66.213.116"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "185.66.213.116",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186196,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "185.66.213.116"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNCAUmcBTFzn_XoLVQS1",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:00.521Z",
+      "source": {
+        "ip": "202.138.233.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142255,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "202.138.233.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19202",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cdCAUmcBTFzn_XoLVQS1",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:00.523Z",
+      "process": {
+        "pid": "19202",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.138.233.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142256,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "202.138.233.92",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctCAUmcBTFzn_XoLVQS1",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:00.758Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19202",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.138.233.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "202.138.233.92",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "202.138.233.92",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142257,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Lc9_UmcBTFzn_XoL2_og",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:29.142Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "183.6.176.182"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "183.6.176.182"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142252,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19199",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ls9_UmcBTFzn_XoL2_og",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:29.143Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142253,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "183.6.176.182"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19199",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "183.6.176.182"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "L89_UmcBTFzn_XoL2_og",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:29.337Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "183.6.176.182",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "183.6.176.182",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142254
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19199",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "183.6.176.182"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0c9_UmcBTFzn_XoL8Ptt",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:34.595Z",
+      "source": {
+        "ip": "82.165.64.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "82.165.64.156",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186200,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31787"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0s9_UmcBTFzn_XoL8Ptt",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:34.596Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "82.165.64.156"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186201
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31787",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.165.64.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "089_UmcBTFzn_XoL8Ptt",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:34.710Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31787",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.165.64.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "82.165.64.156",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186202,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "82.165.64.156",
+          "terminal": "ssh"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ns9_UmcBTFzn_XoLYe_m",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:58.109Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31779",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186197,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "46.148.18.163"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n89_UmcBTFzn_XoLYe_m",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:58.110Z",
+      "auditd": {
+        "sequence": 186198,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31779",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oM9_UmcBTFzn_XoLYe_m",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:58.253Z",
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "46.148.18.163",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "46.148.18.163"
+          }
+        },
+        "sequence": 186199,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31779",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hM-AUmcBTFzn_XoLEf64",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:43.118Z",
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186203,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "74.208.43.208",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31789",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hc-AUmcBTFzn_XoLEf64",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:43.119Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "74.208.43.208",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186204,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31789",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "74.208.43.208"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hs-AUmcBTFzn_XoLEf64",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:43.146Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186205,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "74.208.43.208",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "74.208.43.208",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31789",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "74.208.43.208"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "m89-UmcBTFzn_XoL1OLk",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:22.009Z",
+      "source": {
+        "ip": "201.75.60.100"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "201.75.60.100"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184237,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24759",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "nM9-UmcBTFzn_XoL1OLk",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:22.011Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "24759",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.75.60.100"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184238,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "201.75.60.100",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "nc9-UmcBTFzn_XoL1OLk",
+    "source": {
+      "@timestamp": "2018-11-27T00:08:22.241Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24759"
+      },
+      "source": {
+        "ip": "201.75.60.100"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184239,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "201.75.60.100"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "201.75.60.100",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Vc9_UmcBTFzn_XoLb_AH",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.469Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184240,
+        "result": "success"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "24768",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Vs9_UmcBTFzn_XoLb_AH",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.469Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "24768",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184241,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V89_UmcBTFzn_XoLb_AH",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.471Z",
+      "user": {
+        "auid": "0",
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24768",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9854",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184243
+      },
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WM9_UmcBTFzn_XoLb_AH",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.574Z",
+      "auditd": {
+        "result": "success",
+        "session": "9854",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184244
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "24768"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Wc9_UmcBTFzn_XoLb_AH",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.575Z",
+      "auditd": {
+        "session": "9854",
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        },
+        "sequence": 184245,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "process": {
+        "pid": "24768",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W89_UmcBTFzn_XoLb_DG",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.660Z",
+      "auditd": {
+        "sequence": 192396,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:accounting",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "32020"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XM9_UmcBTFzn_XoLb_DG",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.660Z",
+      "auditd": {
+        "sequence": 192397,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "32020"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xc9_UmcBTFzn_XoLb_DG",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.661Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "process": {
+        "pid": "32020",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9858",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        },
+        "sequence": 192399
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xs9_UmcBTFzn_XoLb_DG",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.756Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "32020",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192400,
+        "result": "success",
+        "session": "9858"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X89_UmcBTFzn_XoLb_DG",
+    "source": {
+      "@timestamp": "2018-11-27T00:09:01.757Z",
+      "auditd": {
+        "sequence": 192401,
+        "result": "success",
+        "session": "9858",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "32020",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tNCGUmcBTFzn_XoLwJHN",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.150Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28080",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 44083,
+        "result": "success",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tdCGUmcBTFzn_XoLwJHN",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.150Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28080",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:accounting"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44082
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ttCGUmcBTFzn_XoLwJHN",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.150Z",
+      "process": {
+        "pid": "28080",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44085,
+        "result": "success",
+        "session": "1442",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "t9CGUmcBTFzn_XoLwJHN",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.154Z",
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28080",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 44086,
+        "result": "success",
+        "session": "1442",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "uNCGUmcBTFzn_XoLwJHN",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.154Z",
+      "auditd": {
+        "session": "1442",
+        "data": {
+          "op": "PAM:session_close",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 44087,
+        "result": "success"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28080",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "udCGUmcBTFzn_XoLwJHb",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.168Z",
+      "auditd": {
+        "sequence": 142264,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19244",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "utCGUmcBTFzn_XoLwJHb",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.169Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19244",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142265,
+        "result": "success"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "u9CGUmcBTFzn_XoLwJHb",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.171Z",
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "19244",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 142267,
+        "result": "success",
+        "session": "3502"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vNCGUmcBTFzn_XoLwJHb",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.174Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "process": {
+        "pid": "19244",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "3502",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142268,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vdCGUmcBTFzn_XoLwJHb",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.175Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "19244",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        },
+        "sequence": 142269,
+        "result": "success",
+        "session": "3502",
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vtCGUmcBTFzn_XoLwJH4",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.195Z",
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12297",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:accounting"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43110,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "v9CGUmcBTFzn_XoLwJH4",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.195Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12297",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 43111,
+        "result": "success"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wNCGUmcBTFzn_XoLwJH4",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.195Z",
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "12297",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 43113,
+        "result": "success",
+        "session": "1251",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wdCGUmcBTFzn_XoLwJH4",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.195Z",
+      "auditd": {
+        "session": "1251",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43114,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12297",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wtCGUmcBTFzn_XoLwJH4",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.199Z",
+      "process": {
+        "pid": "12297",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "1251",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_close"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 43115,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dCGUmcBTFzn_XoLwpF3",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.580Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24860",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:accounting",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184252
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tCGUmcBTFzn_XoLwpF3",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.581Z",
+      "process": {
+        "pid": "24860",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184253,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "29CGUmcBTFzn_XoLwpF3",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.582Z",
+      "auditd": {
+        "sequence": 184255,
+        "result": "success",
+        "session": "9855",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "24860"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3NCGUmcBTFzn_XoLwpF3",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.585Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24860",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9855",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        },
+        "sequence": 184256,
+        "result": "success"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3dCGUmcBTFzn_XoLwpF3",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.586Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "24860",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9855",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184257
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7dCGUmcBTFzn_XoLw5Er",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.761Z",
+      "process": {
+        "pid": "32105",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192405,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tCGUmcBTFzn_XoLw5Er",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.762Z",
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192406
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32105",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79CGUmcBTFzn_XoLw5Er",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.763Z",
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32105",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192408,
+        "result": "success",
+        "session": "9859",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_open"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NCGUmcBTFzn_XoLw5Er",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.766Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "32105"
+      },
+      "auditd": {
+        "sequence": 192409,
+        "result": "success",
+        "session": "9859",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8dCGUmcBTFzn_XoLw5Er",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.767Z",
+      "event": {
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32105",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9859",
+        "data": {
+          "op": "PAM:session_close",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192410,
+        "result": "success"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tCGUmcBTFzn_XoLw5GT",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.863Z",
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "31840",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186230,
+        "result": "success",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-9CGUmcBTFzn_XoLw5GT",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.864Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31840",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186231,
+        "result": "success",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_NCGUmcBTFzn_XoLw5GT",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.866Z",
+      "process": {
+        "pid": "31840",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 186233,
+        "result": "success",
+        "session": "3510",
+        "data": {
+          "op": "PAM:session_open",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dCGUmcBTFzn_XoLw5GT",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.868Z",
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "31840",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186234,
+        "result": "success",
+        "session": "3510"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tCGUmcBTFzn_XoLw5GT",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:01.869Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "31840"
+      },
+      "auditd": {
+        "sequence": 186235,
+        "result": "success",
+        "session": "3510",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdCFUmcBTFzn_XoLNW-m",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:19.990Z",
+      "source": {
+        "ip": "181.58.119.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43101,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "181.58.119.34",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12279",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtCFUmcBTFzn_XoLNW-m",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:19.990Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "181.58.119.34",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43102
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12279",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "181.58.119.34"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9CFUmcBTFzn_XoLNW-m",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:20.098Z",
+      "source": {
+        "ip": "181.58.119.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "181.58.119.34",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "181.58.119.34",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43103,
+        "result": "fail"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12279"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9dCFUmcBTFzn_XoLPm_6",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:22.384Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24844"
+      },
+      "source": {
+        "ip": "78.217.134.141"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184246,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "78.217.134.141"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9tCFUmcBTFzn_XoLPm_6",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:22.385Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24844"
+      },
+      "source": {
+        "ip": "78.217.134.141"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184247,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "78.217.134.141",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99CFUmcBTFzn_XoLPm_6",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:22.546Z",
+      "process": {
+        "pid": "24844",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "78.217.134.141"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "78.217.134.141",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "78.217.134.141",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184248,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZdCGUmcBTFzn_XoLhYxL",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:45.917Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "212.144.234.165"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43104
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12288",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "212.144.234.165"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtCGUmcBTFzn_XoLhYxL",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:45.917Z",
+      "source": {
+        "ip": "212.144.234.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "212.144.234.165",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43105,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12288",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9CGUmcBTFzn_XoLhYxL",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:46.029Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12288",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "212.144.234.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "sequence": 43106,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "212.144.234.165",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "212.144.234.165"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtCGUmcBTFzn_XoLj44z",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:48.454Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12290",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.165.64.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "82.165.64.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43107,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "C9CGUmcBTFzn_XoLj44z",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:48.458Z",
+      "process": {
+        "pid": "12290",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.165.64.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "82.165.64.156"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43108,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DNCGUmcBTFzn_XoLj44z",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:48.574Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "82.165.64.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43109,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "82.165.64.156"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12290"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "82.165.64.156"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XdCGUmcBTFzn_XoLspGv",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:57.541Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "24857",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "90.63.218.214"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "90.63.218.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184249,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XtCGUmcBTFzn_XoLspGv",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:57.542Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "90.63.218.214"
+          }
+        },
+        "sequence": 184250,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24857",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "90.63.218.214"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9CGUmcBTFzn_XoLspGv",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:57.654Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24857",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "90.63.218.214"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184251,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "90.63.218.214",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "90.63.218.214",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNCDUmcBTFzn_XoLe0qz",
+    "source": {
+      "@timestamp": "2018-11-27T00:13:26.761Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31815",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.221.237"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186221,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "178.128.221.237"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdCDUmcBTFzn_XoLe0qz",
+    "source": {
+      "@timestamp": "2018-11-27T00:13:26.762Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.128.221.237",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186222,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "31815",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.221.237"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gtCDUmcBTFzn_XoLe0qz",
+    "source": {
+      "@timestamp": "2018-11-27T00:13:26.955Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31815",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.221.237"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186223,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "178.128.221.237",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "178.128.221.237",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNCFUmcBTFzn_XoLinbC",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:41.783Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31832"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186227,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "odCFUmcBTFzn_XoLinbC",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:41.784Z",
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186228
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31832",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "otCFUmcBTFzn_XoLinbC",
+    "source": {
+      "@timestamp": "2018-11-27T00:15:41.927Z",
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "46.148.18.163",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "46.148.18.163"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186229,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "31832",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5tCEUmcBTFzn_XoLU1tS",
+    "source": {
+      "@timestamp": "2018-11-27T00:14:22.056Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31823"
+      },
+      "source": {
+        "ip": "185.241.4.160"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "185.241.4.160",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 186224,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59CEUmcBTFzn_XoLU1tS",
+    "source": {
+      "@timestamp": "2018-11-27T00:14:22.061Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31823",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.241.4.160"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186225,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "185.241.4.160",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NCEUmcBTFzn_XoLU1tS",
+    "source": {
+      "@timestamp": "2018-11-27T00:14:22.221Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31823"
+      },
+      "source": {
+        "ip": "185.241.4.160"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "185.241.4.160",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "185.241.4.160",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186226,
+        "result": "fail"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9CFUmcBTFzn_XoL031l",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:00.377Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "117.102.68.188",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44076,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28053"
+      },
+      "source": {
+        "ip": "117.102.68.188"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ENCFUmcBTFzn_XoL031l",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:00.377Z",
+      "source": {
+        "ip": "117.102.68.188"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44077,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "117.102.68.188"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28053",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdCFUmcBTFzn_XoL031l",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:00.581Z",
+      "auditd": {
+        "sequence": 44078,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "117.102.68.188",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "117.102.68.188",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28053",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "117.102.68.188"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19CGUmcBTFzn_XoLC4FO",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:14.690Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.183.42.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44079,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28062",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.183.42.58"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NCGUmcBTFzn_XoLC4FO",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:14.690Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28062",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.183.42.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44080,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.183.42.58",
+            "type": "user-session"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dCGUmcBTFzn_XoLC4FO",
+    "source": {
+      "@timestamp": "2018-11-27T00:16:14.802Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28062",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.183.42.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44081,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "91.183.42.58",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "91.183.42.58"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dtCJUmcBTFzn_XoL_tm6",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:33.614Z",
+      "auditd": {
+        "sequence": 44091,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "209.59.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28150",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.59.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "d9CJUmcBTFzn_XoL_tm6",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:33.614Z",
+      "auditd": {
+        "sequence": 44092,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "209.59.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28150",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "209.59.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "eNCJUmcBTFzn_XoL_tm6",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:33.698Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28150"
+      },
+      "source": {
+        "ip": "209.59.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44093,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "209.59.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "209.59.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ptCKUmcBTFzn_XoLDtsd",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:37.550Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "106.51.72.37",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44094,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28153",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "106.51.72.37"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p9CKUmcBTFzn_XoLDtsd",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:37.550Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28153"
+      },
+      "source": {
+        "ip": "106.51.72.37"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44095,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "106.51.72.37",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qNCKUmcBTFzn_XoLDtsd",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:37.782Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28153",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "106.51.72.37"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44096,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "106.51.72.37"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "106.51.72.37",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5tGMUmcBTFzn_XoLPwqH",
+    "source": {
+      "@timestamp": "2018-11-27T00:23:01.275Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31880",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.105.123.11"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186254,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.105.123.11",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59GMUmcBTFzn_XoLPwqH",
+    "source": {
+      "@timestamp": "2018-11-27T00:23:01.276Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "46.105.123.11"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186255
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31880",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.105.123.11"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NGMUmcBTFzn_XoLPwqH",
+    "source": {
+      "@timestamp": "2018-11-27T00:23:01.383Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31880",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.105.123.11"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186256,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "46.105.123.11"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "46.105.123.11"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtCKUmcBTFzn_XoL0uxn",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:27.805Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "213.143.97.179",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 142270,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19271",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "213.143.97.179"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9CKUmcBTFzn_XoL0uxn",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:27.807Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142271,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "213.143.97.179"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19271",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "213.143.97.179"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNCKUmcBTFzn_XoL0uxn",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:27.937Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142272,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "213.143.97.179"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "213.143.97.179",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19271",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "213.143.97.179"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtCLUmcBTFzn_XoLLPOM",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:50.882Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24899",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.99.252.97"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "192.99.252.97",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184273,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9CLUmcBTFzn_XoLLPOM",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:50.883Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24899"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "192.99.252.97"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184274,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "192.99.252.97"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNCLUmcBTFzn_XoLLPOM",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:50.926Z",
+      "process": {
+        "pid": "24899",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "192.99.252.97"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "192.99.252.97",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184275,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "192.99.252.97"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A9CKUmcBTFzn_XoLrulM",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:18.562Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186251,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "163.172.35.93"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31872"
+      },
+      "source": {
+        "ip": "163.172.35.93"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BNCKUmcBTFzn_XoLrulM",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:18.563Z",
+      "source": {
+        "ip": "163.172.35.93"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "163.172.35.93",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186252
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "31872",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BdCKUmcBTFzn_XoLrulM",
+    "source": {
+      "@timestamp": "2018-11-27T00:21:18.669Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31872",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "163.172.35.93"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186253,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "163.172.35.93"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "163.172.35.93",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VtCKUmcBTFzn_XoLLt0C",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:45.720Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24889",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "122.175.55.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "122.175.55.196",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184270,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9CKUmcBTFzn_XoLLt0C",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:45.721Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24889",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "122.175.55.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184271,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "122.175.55.196",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WNCKUmcBTFzn_XoLLt0C",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:45.977Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "122.175.55.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "122.175.55.196",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "122.175.55.196",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184272
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24889",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNGNUmcBTFzn_XoLiyd2",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:26.252Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "145.239.137.89"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "145.239.137.89",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192426,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32155",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdGNUmcBTFzn_XoLiyd2",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:26.253Z",
+      "source": {
+        "ip": "145.239.137.89"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192427,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "145.239.137.89",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32155"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtGNUmcBTFzn_XoLiyd2",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:26.370Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32155"
+      },
+      "source": {
+        "ip": "145.239.137.89"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "145.239.137.89",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192428,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "145.239.137.89",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QNGLUmcBTFzn_XoL7gTu",
+    "source": {
+      "@timestamp": "2018-11-27T00:22:40.643Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32146",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "52.189.217.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "52.189.217.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192423
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdGLUmcBTFzn_XoL7gTu",
+    "source": {
+      "@timestamp": "2018-11-27T00:22:40.644Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32146",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "52.189.217.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "52.189.217.7",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192424,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtGLUmcBTFzn_XoL7gTu",
+    "source": {
+      "@timestamp": "2018-11-27T00:22:40.849Z",
+      "process": {
+        "pid": "32146",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "52.189.217.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "52.189.217.7"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "52.189.217.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192425,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_9GMUmcBTFzn_XoL1xdJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:23:40.121Z",
+      "process": {
+        "pid": "28213",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.133.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44097,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.59.133.18",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANGMUmcBTFzn_XoL1xhJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:23:40.125Z",
+      "process": {
+        "pid": "28213",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.133.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44098,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.59.133.18",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdGMUmcBTFzn_XoL1xhJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:23:40.237Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "139.59.133.18",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44099,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "139.59.133.18"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28213",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.133.18"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ydGRUmcBTFzn_XoL6IZr",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:12.188Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "54.37.154.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.37.154.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43119,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12362",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytGRUmcBTFzn_XoL6IZr",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:12.188Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12362",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.154.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.37.154.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43120,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9GRUmcBTFzn_XoL6IZr",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:12.300Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43121,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "54.37.154.254"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "54.37.154.254",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12362",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "54.37.154.254"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UtGRUmcBTFzn_XoL7YcV",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:13.387Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24953",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.104.220.26"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "86.104.220.26",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184288
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "U9GRUmcBTFzn_XoL7YcV",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:13.388Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24953"
+      },
+      "source": {
+        "ip": "86.104.220.26"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "86.104.220.26",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 184289,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNGRUmcBTFzn_XoL7YcV",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:13.531Z",
+      "process": {
+        "pid": "24953",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.104.220.26"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184290,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "86.104.220.26",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "86.104.220.26"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdGPUmcBTFzn_XoLtVea",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:48.111Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "19304",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.162.29.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "121.162.29.165",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142276,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtGPUmcBTFzn_XoLtVea",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:48.112Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19304"
+      },
+      "source": {
+        "ip": "121.162.29.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "121.162.29.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142277,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Q9GPUmcBTFzn_XoLtVea",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:48.273Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19304",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.162.29.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "121.162.29.165",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "121.162.29.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142278,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1tGPUmcBTFzn_XoL8FvF",
+    "source": {
+      "@timestamp": "2018-11-27T00:27:03.259Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142279,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "103.56.207.96",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19306",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.56.207.96"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19GPUmcBTFzn_XoL8FvF",
+    "source": {
+      "@timestamp": "2018-11-27T00:27:03.260Z",
+      "process": {
+        "pid": "19306",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.56.207.96"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "103.56.207.96"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142280
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NGPUmcBTFzn_XoL8FvF",
+    "source": {
+      "@timestamp": "2018-11-27T00:27:03.463Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19306",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.56.207.96"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "103.56.207.96",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "103.56.207.96"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142281,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l9GQUmcBTFzn_XoL0m8i",
+    "source": {
+      "@timestamp": "2018-11-27T00:28:00.952Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31904"
+      },
+      "source": {
+        "ip": "122.152.225.120"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186260,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "122.152.225.120",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mNGQUmcBTFzn_XoL0m8i",
+    "source": {
+      "@timestamp": "2018-11-27T00:28:00.954Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31904"
+      },
+      "source": {
+        "ip": "122.152.225.120"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186261,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "122.152.225.120",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mdGQUmcBTFzn_XoL0m8i",
+    "source": {
+      "@timestamp": "2018-11-27T00:28:01.157Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "122.152.225.120"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "122.152.225.120"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186262,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31904"
+      },
+      "source": {
+        "ip": "122.152.225.120"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "nNGTUmcBTFzn_XoLCp-5",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:26.511Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32530"
+      },
+      "source": {
+        "ip": "173.167.200.227"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "173.167.200.227"
+          }
+        },
+        "sequence": 192434
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ndGTUmcBTFzn_XoLCp-5",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:26.512Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32530",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "173.167.200.227"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "173.167.200.227",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192435,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntGTUmcBTFzn_XoLCp-5",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:26.557Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32530",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "173.167.200.227"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "173.167.200.227",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192436,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "173.167.200.227",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdGQUmcBTFzn_XoLtmz7",
+    "source": {
+      "@timestamp": "2018-11-27T00:27:54.000Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31902",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "184.170.7.230"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186257,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "184.170.7.230",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztGQUmcBTFzn_XoLtmz7",
+    "source": {
+      "@timestamp": "2018-11-27T00:27:54.002Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "31902",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "184.170.7.230"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "184.170.7.230",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186258,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z9GQUmcBTFzn_XoLtmz7",
+    "source": {
+      "@timestamp": "2018-11-27T00:27:54.541Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31902",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "184.170.7.230"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "184.170.7.230"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "184.170.7.230",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186259,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdGSUmcBTFzn_XoLx5oM",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:09.185Z",
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12372"
+      },
+      "source": {
+        "ip": "86.229.8.199"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "86.229.8.199",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43125,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtGSUmcBTFzn_XoLx5oM",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:09.185Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "86.229.8.199"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43126,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12372",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.229.8.199"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Q9GSUmcBTFzn_XoLx5oM",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:09.329Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12372"
+      },
+      "source": {
+        "ip": "86.229.8.199"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "86.229.8.199",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43127,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "86.229.8.199",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tGSUmcBTFzn_XoLe5Pk",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:49.943Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12370",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.197.44.25"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43122,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.197.44.25",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69GSUmcBTFzn_XoLe5Pk",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:49.943Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12370",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.197.44.25"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.197.44.25",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43123,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7NGSUmcBTFzn_XoLe5Pk",
+    "source": {
+      "@timestamp": "2018-11-27T00:29:49.975Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "138.197.44.25",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "138.197.44.25",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43124,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12370",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.197.44.25"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59GRUmcBTFzn_XoLFXXo",
+    "source": {
+      "@timestamp": "2018-11-27T00:28:18.298Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28318"
+      },
+      "source": {
+        "ip": "200.35.110.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "200.35.110.58"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44112
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NGRUmcBTFzn_XoLFXXo",
+    "source": {
+      "@timestamp": "2018-11-27T00:28:18.298Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28318"
+      },
+      "source": {
+        "ip": "200.35.110.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44113,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "200.35.110.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dGRUmcBTFzn_XoLFXXo",
+    "source": {
+      "@timestamp": "2018-11-27T00:28:18.414Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "200.35.110.58",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "200.35.110.58",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44114
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28318",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.35.110.58"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9KXUmcBTFzn_XoLtQab",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:32.401Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31943",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.43.198"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "164.132.43.198"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186269,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNKXUmcBTFzn_XoLtQab",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:32.402Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186270,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "164.132.43.198",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31943"
+      },
+      "source": {
+        "ip": "164.132.43.198"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdKXUmcBTFzn_XoLtQab",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:32.510Z",
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31943",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.43.198"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186271,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "164.132.43.198",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "164.132.43.198",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNKXUmcBTFzn_XoLxggy",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:36.648Z",
+      "process": {
+        "pid": "19353",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.55.214.3"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.55.214.3",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142285
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CdKXUmcBTFzn_XoLxggy",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:36.650Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142286,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "46.55.214.3"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19353",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.55.214.3"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtKXUmcBTFzn_XoLxggy",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:36.800Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "46.55.214.3"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142287,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "46.55.214.3"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19353",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.55.214.3"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9KYUmcBTFzn_XoL9yJk",
+    "source": {
+      "@timestamp": "2018-11-27T00:36:54.778Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "125.63.92.170",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142288
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19361"
+      },
+      "source": {
+        "ip": "125.63.92.170"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNKYUmcBTFzn_XoL9yJk",
+    "source": {
+      "@timestamp": "2018-11-27T00:36:54.779Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "125.63.92.170",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142289,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19361",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "125.63.92.170"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdKYUmcBTFzn_XoL9yJk",
+    "source": {
+      "@timestamp": "2018-11-27T00:36:55.043Z",
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19361",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "125.63.92.170"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "125.63.92.170",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142290,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "125.63.92.170"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8tKZUmcBTFzn_XoLZyud",
+    "source": {
+      "@timestamp": "2018-11-27T00:37:23.507Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "180.151.228.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186272
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31951"
+      },
+      "source": {
+        "ip": "180.151.228.58"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "89KZUmcBTFzn_XoLZyud",
+    "source": {
+      "@timestamp": "2018-11-27T00:37:23.508Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "180.151.228.58",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186273,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31951",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "180.151.228.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9NKZUmcBTFzn_XoLZyud",
+    "source": {
+      "@timestamp": "2018-11-27T00:37:23.776Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31951",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "180.151.228.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "180.151.228.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186274,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "180.151.228.58"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtGWUmcBTFzn_XoLwfK7",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:29.968Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32558",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.24.100.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.24.100.205",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192440,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "B9GWUmcBTFzn_XoLwfK7",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:29.969Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "32558",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.24.100.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "211.24.100.205",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192441,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNGWUmcBTFzn_XoLwfK7",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:30.179Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32558"
+      },
+      "source": {
+        "ip": "211.24.100.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "211.24.100.205"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "211.24.100.205",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192442
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pdKaUmcBTFzn_XoL802l",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:04.878Z",
+      "process": {
+        "pid": "31959",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.251.239.72"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "46.251.239.72"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186275,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ptKaUmcBTFzn_XoL802l",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:04.879Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31959",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.251.239.72"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186276,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.251.239.72",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p9KaUmcBTFzn_XoL802l",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:04.990Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31959",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.251.239.72"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.251.239.72",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186277,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "46.251.239.72"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9KXUmcBTFzn_XoLowUZ",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:27.663Z",
+      "source": {
+        "ip": "185.254.97.113"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.254.97.113",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186266,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31941",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNKXUmcBTFzn_XoLowUZ",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:27.664Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "185.254.97.113"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.254.97.113"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186267,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31941",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdKXUmcBTFzn_XoLowUZ",
+    "source": {
+      "@timestamp": "2018-11-27T00:35:27.773Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31941",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.254.97.113"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "185.254.97.113",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186268,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "185.254.97.113"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9GWUmcBTFzn_XoL7_UK",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:41.567Z",
+      "process": {
+        "pid": "19345",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.84.76.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "202.84.76.146",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142282
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNGWUmcBTFzn_XoL7_UK",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:41.568Z",
+      "process": {
+        "pid": "19345",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.84.76.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "202.84.76.146",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 142283
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idGWUmcBTFzn_XoL7_UK",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:41.795Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19345",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.84.76.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "202.84.76.146"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "202.84.76.146",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142284,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StKaUmcBTFzn_XoL5kzE",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.594Z",
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:accounting"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 184300
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "25011"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9KaUmcBTFzn_XoL5kzE",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.594Z",
+      "process": {
+        "pid": "25011",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184301,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNKaUmcBTFzn_XoL5kzE",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.596Z",
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25011",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9856",
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_open",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184303
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdKaUmcBTFzn_XoL5kzE",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.697Z",
+      "auditd": {
+        "session": "9856",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        },
+        "sequence": 184304,
+        "result": "success"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25011",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TtKaUmcBTFzn_XoL5kzE",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.698Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25011",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184305,
+        "result": "success",
+        "session": "9856"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9KaUmcBTFzn_XoL50x5",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.774Z",
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:accounting"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192443,
+        "result": "success",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32579",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WNKaUmcBTFzn_XoL50x5",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.774Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "32579"
+      },
+      "auditd": {
+        "sequence": 192444,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WdKaUmcBTFzn_XoL50x5",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.776Z",
+      "process": {
+        "pid": "32579",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9860",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192446,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WtKaUmcBTFzn_XoL50x5",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.873Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192447,
+        "result": "success",
+        "session": "9860",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        }
+      },
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32579",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9KaUmcBTFzn_XoL50x5",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:01.874Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "32579",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192448,
+        "result": "success",
+        "session": "9860"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9KbUmcBTFzn_XoLP1QB",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:24.137Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.68.111.27",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44121,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28526",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.111.27"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNKbUmcBTFzn_XoLP1QB",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:24.137Z",
+      "source": {
+        "ip": "138.68.111.27"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "138.68.111.27",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44122,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28526",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XdKbUmcBTFzn_XoLP1QB",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:24.241Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28526",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.111.27"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "138.68.111.27"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "138.68.111.27",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44123
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNKiUmcBTFzn_XoLvfm3",
+    "source": {
+      "@timestamp": "2018-11-27T00:47:35.372Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19424",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "137.74.114.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142300,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "137.74.114.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CdKiUmcBTFzn_XoLvfm3",
+    "source": {
+      "@timestamp": "2018-11-27T00:47:35.374Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19424"
+      },
+      "source": {
+        "ip": "137.74.114.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "137.74.114.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142301,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtKiUmcBTFzn_XoLvfm3",
+    "source": {
+      "@timestamp": "2018-11-27T00:47:35.480Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19424"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "137.74.114.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "137.74.114.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142302,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "137.74.114.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qdOkUmcBTFzn_XoLDBVT",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:01.033Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25113",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.67.246.139"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "121.67.246.139",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184309,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtOkUmcBTFzn_XoLDBVT",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:01.034Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184310,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "121.67.246.139",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25113",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "121.67.246.139"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9OkUmcBTFzn_XoLDBVT",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:01.224Z",
+      "auditd": {
+        "data": {
+          "hostname": "121.67.246.139",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "121.67.246.139",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184311,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25113",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.67.246.139"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qNOkUmcBTFzn_XoLgx_7",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:31.664Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25115",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "179.228.242.120"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "179.228.242.120",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184312,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qdOkUmcBTFzn_XoLgx_7",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:31.665Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25115",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "179.228.242.120"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "179.228.242.120",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184313,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtOkUmcBTFzn_XoLgx_7",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:31.831Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25115",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "179.228.242.120"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "179.228.242.120",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184314,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "179.228.242.120"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtKiUmcBTFzn_XoL-P7X",
+    "source": {
+      "@timestamp": "2018-11-27T00:47:50.509Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19431",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "39.110.219.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "39.110.219.91",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142303,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "B9KiUmcBTFzn_XoL-P7X",
+    "source": {
+      "@timestamp": "2018-11-27T00:47:50.511Z",
+      "source": {
+        "ip": "39.110.219.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142304,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "39.110.219.91",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19431",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNKiUmcBTFzn_XoL-P7X",
+    "source": {
+      "@timestamp": "2018-11-27T00:47:50.642Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19431",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "39.110.219.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "39.110.219.91",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142305,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "39.110.219.91"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9OkUmcBTFzn_XoLABX7",
+    "source": {
+      "@timestamp": "2018-11-27T00:48:58.129Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19439",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "41.89.47.14"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142306,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "41.89.47.14",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNOkUmcBTFzn_XoLABX7",
+    "source": {
+      "@timestamp": "2018-11-27T00:48:58.130Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "41.89.47.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142307,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19439",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "41.89.47.14"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdOkUmcBTFzn_XoLABX7",
+    "source": {
+      "@timestamp": "2018-11-27T00:48:58.365Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "41.89.47.14",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "41.89.47.14",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142308
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19439",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "41.89.47.14"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNOkUmcBTFzn_XoL8ilB",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:59.894Z",
+      "process": {
+        "pid": "32019",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "105.16.153.210"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "105.16.153.210",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186284
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdOkUmcBTFzn_XoL8ilB",
+    "source": {
+      "@timestamp": "2018-11-27T00:49:59.895Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32019",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "105.16.153.210"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "105.16.153.210",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186285,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gtOkUmcBTFzn_XoL8ilB",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:00.158Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32019",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "105.16.153.210"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186286,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "105.16.153.210",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "105.16.153.210"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdOlUmcBTFzn_XoLkjc2",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:40.838Z",
+      "source": {
+        "ip": "188.166.243.150"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44130,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "188.166.243.150",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28746",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtOlUmcBTFzn_XoLkjc2",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:40.842Z",
+      "source": {
+        "ip": "188.166.243.150"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.166.243.150",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44131
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28746"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9OlUmcBTFzn_XoLkjc2",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:41.034Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "188.166.243.150",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "188.166.243.150"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44132,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28746",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.166.243.150"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdOmUmcBTFzn_XoLCEHk",
+    "source": {
+      "@timestamp": "2018-11-27T00:51:11.223Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43140,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "194.35.114.10"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12495",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "194.35.114.10"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JtOmUmcBTFzn_XoLCEHk",
+    "source": {
+      "@timestamp": "2018-11-27T00:51:11.223Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12495"
+      },
+      "source": {
+        "ip": "194.35.114.10"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "194.35.114.10"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43141,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9OmUmcBTFzn_XoLCEHk",
+    "source": {
+      "@timestamp": "2018-11-27T00:51:11.503Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12495"
+      },
+      "source": {
+        "ip": "194.35.114.10"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "194.35.114.10",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "194.35.114.10",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43142
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dOlUmcBTFzn_XoLvzre",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:52.531Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.131.178.223",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44133,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28750",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.178.223"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0tOlUmcBTFzn_XoLvzre",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:52.531Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "104.131.178.223",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44134,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28750"
+      },
+      "source": {
+        "ip": "104.131.178.223"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "09OlUmcBTFzn_XoLvzre",
+    "source": {
+      "@timestamp": "2018-11-27T00:50:52.559Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28750",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.178.223"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "104.131.178.223"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.131.178.223",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44135
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7NSvUmcBTFzn_XoL9Rog",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:01.525Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25194",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.219.52.136"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "211.219.52.136"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184321,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7dSvUmcBTFzn_XoL9Rog",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:01.526Z",
+      "auditd": {
+        "sequence": 184322,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.219.52.136",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25194",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "211.219.52.136"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tSvUmcBTFzn_XoL9Rog",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:01.686Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25194",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.219.52.136"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "211.219.52.136",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184323,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "211.219.52.136"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "btOsUmcBTFzn_XoLdc7t",
+    "source": {
+      "@timestamp": "2018-11-27T00:58:12.354Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19491",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.234.241.55"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "91.234.241.55",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142312,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "b9OsUmcBTFzn_XoLdc7t",
+    "source": {
+      "@timestamp": "2018-11-27T00:58:12.355Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19491"
+      },
+      "source": {
+        "ip": "91.234.241.55"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "91.234.241.55",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 142313,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNOsUmcBTFzn_XoLdc7t",
+    "source": {
+      "@timestamp": "2018-11-27T00:58:12.497Z",
+      "source": {
+        "ip": "91.234.241.55"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "91.234.241.55",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142314,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "91.234.241.55"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19491"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VtOsUmcBTFzn_XoLGcfx",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:48.807Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19483",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.121.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142309,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.0.121.168",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9OsUmcBTFzn_XoLGcfx",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:48.808Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19483",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.121.168"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.0.121.168",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142310
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WNOsUmcBTFzn_XoLGcfx",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:48.917Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19483",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.121.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142311,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "128.0.121.168",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.0.121.168",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p9SvUmcBTFzn_XoLTQyw",
+    "source": {
+      "@timestamp": "2018-11-27T01:01:18.662Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "220.135.55.172",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192458,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32763",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "220.135.55.172"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qNSvUmcBTFzn_XoLTQyw",
+    "source": {
+      "@timestamp": "2018-11-27T01:01:18.663Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "220.135.55.172",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192459,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32763",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "220.135.55.172"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qdSvUmcBTFzn_XoLTQyw",
+    "source": {
+      "@timestamp": "2018-11-27T01:01:18.839Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "220.135.55.172"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "220.135.55.172"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192460,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32763",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "220.135.55.172"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztOuUmcBTFzn_XoLCvAK",
+    "source": {
+      "@timestamp": "2018-11-27T00:59:55.808Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19499",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "13.77.75.153"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "13.77.75.153",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142315
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z9OuUmcBTFzn_XoLCvAK",
+    "source": {
+      "@timestamp": "2018-11-27T00:59:55.809Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19499"
+      },
+      "source": {
+        "ip": "13.77.75.153"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "13.77.75.153",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142316,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NOuUmcBTFzn_XoLCvAK",
+    "source": {
+      "@timestamp": "2018-11-27T00:59:55.852Z",
+      "process": {
+        "pid": "19499",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "13.77.75.153"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "13.77.75.153",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142317,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "13.77.75.153",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59SwUmcBTFzn_XoLmSiw",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:43.654Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186290,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32075",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NSwUmcBTFzn_XoLmSiw",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:43.655Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32075",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186291,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dSwUmcBTFzn_XoLmSiw",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:43.688Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32075",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186292,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANSwUmcBTFzn_XoL0C7C",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:57.752Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32082",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186293,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdSwUmcBTFzn_XoL0C7C",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:57.754Z",
+      "process": {
+        "pid": "32082",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 186294,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtSwUmcBTFzn_XoL0C7C",
+    "source": {
+      "@timestamp": "2018-11-27T01:02:57.784Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32082"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186295
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "t9OuUmcBTFzn_XoLHfKW",
+    "source": {
+      "@timestamp": "2018-11-27T01:00:00.805Z",
+      "source": {
+        "ip": "178.128.127.228"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.128.127.228",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44145,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28933",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "uNOuUmcBTFzn_XoLHfKW",
+    "source": {
+      "@timestamp": "2018-11-27T01:00:00.809Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "28933",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.127.228"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44146,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.128.127.228",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "udOuUmcBTFzn_XoLHfKW",
+    "source": {
+      "@timestamp": "2018-11-27T01:00:01.001Z",
+      "auditd": {
+        "sequence": 44147,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "178.128.127.228"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.128.127.228",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28933",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.127.228"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNOtUmcBTFzn_XoL8u_M",
+    "source": {
+      "@timestamp": "2018-11-27T00:59:49.852Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.197.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44142,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28930"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bdOtUmcBTFzn_XoL8u_M",
+    "source": {
+      "@timestamp": "2018-11-27T00:59:49.852Z",
+      "auditd": {
+        "sequence": 44143,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.197.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "28930",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "btOtUmcBTFzn_XoL8u_M",
+    "source": {
+      "@timestamp": "2018-11-27T00:59:49.964Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28930",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44144,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "164.132.197.108",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "164.132.197.108"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ptS1UmcBTFzn_XoL0JuA",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:25.366Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "345"
+      },
+      "source": {
+        "ip": "5.186.77.221"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "5.186.77.221",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192473
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p9S1UmcBTFzn_XoL0JuA",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:25.367Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192474,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "5.186.77.221"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "345"
+      },
+      "source": {
+        "ip": "5.186.77.221"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qNS1UmcBTFzn_XoL0JuA",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:25.506Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "345"
+      },
+      "source": {
+        "ip": "5.186.77.221"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192475,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "5.186.77.221",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "5.186.77.221",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NS1UmcBTFzn_XoL2Jxv",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:27.396Z",
+      "source": {
+        "ip": "24.37.251.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186326,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "24.37.251.196",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32127",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dS1UmcBTFzn_XoL2Jxv",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:27.397Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32127"
+      },
+      "source": {
+        "ip": "24.37.251.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "24.37.251.196",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186327
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tS1UmcBTFzn_XoL2Jxv",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:27.453Z",
+      "source": {
+        "ip": "24.37.251.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "24.37.251.196"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "24.37.251.196",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186328
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32127",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ydSzUmcBTFzn_XoLp2tF",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:03.738Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "178.128.124.241",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186311,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32108"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "178.128.124.241"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytSzUmcBTFzn_XoLp2tF",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:03.739Z",
+      "process": {
+        "pid": "32108",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.124.241"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "178.128.124.241",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186312,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9SzUmcBTFzn_XoLp2tF",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:03.933Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32108",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "178.128.124.241"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186313,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "178.128.124.241",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "secondary": "178.128.124.241",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UtSzUmcBTFzn_XoLrWwF",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:05.210Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32110"
+      },
+      "source": {
+        "ip": "191.92.71.194"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186314,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "191.92.71.194",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "U9SzUmcBTFzn_XoLrWwF",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:05.211Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32110"
+      },
+      "source": {
+        "ip": "191.92.71.194"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "191.92.71.194",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186315
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNSzUmcBTFzn_XoLrWwF",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:05.347Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "191.92.71.194"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186316,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "191.92.71.194",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "191.92.71.194",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32110",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztS0UmcBTFzn_XoLK3fA",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:37.654Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "327",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "106.241.53.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192467,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "106.241.53.82"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z9S0UmcBTFzn_XoLK3fA",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:37.655Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "106.241.53.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192468,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "327",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "106.241.53.82"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NS0UmcBTFzn_XoLK3fA",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:37.861Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "327",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "106.241.53.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "106.241.53.82",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "106.241.53.82"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192469
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "k9S0UmcBTFzn_XoLPHgu",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:41.860Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "330"
+      },
+      "source": {
+        "ip": "170.210.88.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "170.210.88.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192470,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lNS0UmcBTFzn_XoLPHgu",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:41.861Z",
+      "auditd": {
+        "sequence": 192471,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "170.210.88.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "330",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "170.210.88.50"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ldS0UmcBTFzn_XoLPHgu",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:42.073Z",
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "170.210.88.50",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "170.210.88.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192472,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "330",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "170.210.88.50"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bdS1UmcBTFzn_XoLo5cq",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:13.760Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186323,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32125",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "btS1UmcBTFzn_XoLo5cq",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:13.761Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32125"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186324
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "b9S1UmcBTFzn_XoLo5cq",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:13.791Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32125"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186325,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9S0UmcBTFzn_XoLsoI4",
+    "source": {
+      "@timestamp": "2018-11-27T01:07:12.077Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186320,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32117",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNS0UmcBTFzn_XoLsoI4",
+    "source": {
+      "@timestamp": "2018-11-27T01:07:12.079Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186321,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32117",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddS0UmcBTFzn_XoLsoI4",
+    "source": {
+      "@timestamp": "2018-11-27T01:07:12.110Z",
+      "auditd": {
+        "sequence": 186322,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "U9SzUmcBTFzn_XoLw27K",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:11.040Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186317,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32112",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNSzUmcBTFzn_XoLw27K",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:11.041Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186318,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32112",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VdSzUmcBTFzn_XoLw27K",
+    "source": {
+      "@timestamp": "2018-11-27T01:06:11.071Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32112",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186319,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "o9S0UmcBTFzn_XoL1YXV",
+    "source": {
+      "@timestamp": "2018-11-27T01:07:21.191Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44148,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "29074",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pNS0UmcBTFzn_XoL1YXV",
+    "source": {
+      "@timestamp": "2018-11-27T01:07:21.195Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44149,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29074",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pdS0UmcBTFzn_XoL1YXV",
+    "source": {
+      "@timestamp": "2018-11-27T01:07:21.243Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "104.234.223.14",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "104.234.223.14"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44150
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29074"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dtS2UmcBTFzn_XoLXqd2",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.707Z",
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184324
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25243",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "d9S2UmcBTFzn_XoLXqd2",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.708Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25243",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184325,
+        "result": "success"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "eNS2UmcBTFzn_XoLXqd2",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.710Z",
+      "process": {
+        "pid": "25243",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184327,
+        "result": "success",
+        "session": "9857",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "edS2UmcBTFzn_XoLXqd2",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.806Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "25243",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184328,
+        "result": "success",
+        "session": "9857",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "etS2UmcBTFzn_XoLXqd2",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.808Z",
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25243",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184329,
+        "result": "success",
+        "session": "9857",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_close"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "t9S2UmcBTFzn_XoLX6cl",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.883Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "348",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192476,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "uNS2UmcBTFzn_XoLX6cl",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.884Z",
+      "event": {
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "348",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192477,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "udS2UmcBTFzn_XoLX6cl",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.885Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        },
+        "sequence": 192479,
+        "result": "success",
+        "session": "9861",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "348",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "utS2UmcBTFzn_XoLX6cl",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.981Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192480,
+        "result": "success",
+        "session": "9861",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "348",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "u9S2UmcBTFzn_XoLX6cl",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:01.982Z",
+      "event": {
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "0",
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "348",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9861",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        },
+        "sequence": 192481,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItS2UmcBTFzn_XoLBKBn",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:38.649Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.228.67",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44151,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29096",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9S2UmcBTFzn_XoLBKBn",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:38.649Z",
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.228.67",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44152
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29096",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNS2UmcBTFzn_XoLBKBn",
+    "source": {
+      "@timestamp": "2018-11-27T01:08:38.757Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29096",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "178.33.228.67",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "178.33.228.67",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44153,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNS4UmcBTFzn_XoLIM6c",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:56.938Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184333,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "91.230.8.194"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "91.230.8.194"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25299",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.230.8.194"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NS4UmcBTFzn_XoLMc9n",
+    "source": {
+      "@timestamp": "2018-11-27T01:11:01.244Z",
+      "process": {
+        "pid": "29148",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "85.234.34.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "85.234.34.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44158,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dS4UmcBTFzn_XoLMc9n",
+    "source": {
+      "@timestamp": "2018-11-27T01:11:01.244Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29148",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "85.234.34.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "85.234.34.92"
+          }
+        },
+        "sequence": 44159,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tS4UmcBTFzn_XoLMc9n",
+    "source": {
+      "@timestamp": "2018-11-27T01:11:01.400Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29148"
+      },
+      "source": {
+        "ip": "85.234.34.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44160,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "85.234.34.92",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "85.234.34.92"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctS3UmcBTFzn_XoLgcD-",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:16.337Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "79.137.64.132",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186333,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32141",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "79.137.64.132"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9S3UmcBTFzn_XoLgcD-",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:16.339Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "79.137.64.132"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186334,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "79.137.64.132",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32141"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNS3UmcBTFzn_XoLgcD-",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:16.445Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "79.137.64.132"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186335,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "79.137.64.132",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "79.137.64.132",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32141",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "u9S3UmcBTFzn_XoLh8GC",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:17.752Z",
+      "auditd": {
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186336,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32148",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9S2UmcBTFzn_XoLtK-X",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:23.757Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192482,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "109.202.18.235",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "397",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "109.202.18.235"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNS2UmcBTFzn_XoLtK-X",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:23.758Z",
+      "process": {
+        "pid": "397",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "109.202.18.235"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "109.202.18.235",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192483,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adS2UmcBTFzn_XoLtK-X",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:23.948Z",
+      "source": {
+        "ip": "109.202.18.235"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192484,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "109.202.18.235",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "109.202.18.235"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "397"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BdS4UmcBTFzn_XoLFs5k",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:54.329Z",
+      "auditd": {
+        "sequence": 184330,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "188.68.54.39",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25297",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.68.54.39"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtS4UmcBTFzn_XoLFs5k",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:54.330Z",
+      "auditd": {
+        "sequence": 184331,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.68.54.39",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25297",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.68.54.39"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "B9S4UmcBTFzn_XoLFs5k",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:54.443Z",
+      "source": {
+        "ip": "188.68.54.39"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184332,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "188.68.54.39",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "188.68.54.39",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25297",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9S2UmcBTFzn_XoLf6s6",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:10.091Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186329
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32135",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNS2UmcBTFzn_XoLf6s6",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:10.092Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32135",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186330,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GdS2UmcBTFzn_XoLf6s6",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:10.235Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32135"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "46.148.18.163"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186331,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l9S2UmcBTFzn_XoLxbHN",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:28.162Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "399",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.68.38.86"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192485,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "103.68.38.86",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mNS2UmcBTFzn_XoLxbHN",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:28.163Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "103.68.38.86"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192486
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "399"
+      },
+      "source": {
+        "ip": "103.68.38.86"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mdS2UmcBTFzn_XoLxbHN",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:28.435Z",
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "103.68.38.86",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192487,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "103.68.38.86",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "399",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "103.68.38.86"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdS3UmcBTFzn_XoL-8sa",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:47.311Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "29142",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.37.69"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44155,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.37.69",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtS3UmcBTFzn_XoL-8sa",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:47.315Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29142",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.37.69"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.37.69",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44156,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9S3UmcBTFzn_XoL-8sa",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:47.419Z",
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "51.38.37.69",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "51.38.37.69"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44157,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29142"
+      },
+      "source": {
+        "ip": "51.38.37.69"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "itS2UmcBTFzn_XoLlayd",
+    "source": {
+      "@timestamp": "2018-11-27T01:09:15.827Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32137",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186332
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9S3UmcBTFzn_XoLlcLB",
+    "source": {
+      "@timestamp": "2018-11-27T01:10:21.397Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "29135",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.31.198"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "142.93.31.198"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "142.93.31.198",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44154,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PdW9UmcBTFzn_XoLr0tl",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.176Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "29271"
+      },
+      "auditd": {
+        "sequence": 44173,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PtW9UmcBTFzn_XoLr0tl",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.176Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29271",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44174,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        }
+      },
+      "event": {
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "P9W9UmcBTFzn_XoLr0tl",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.180Z",
+      "process": {
+        "pid": "29271",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 44176,
+        "result": "success",
+        "session": "1444",
+        "data": {
+          "op": "PAM:session_open",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QNW9UmcBTFzn_XoLr0tl",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.180Z",
+      "process": {
+        "pid": "29271",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 44177,
+        "result": "success",
+        "session": "1444",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdW9UmcBTFzn_XoLr0tl",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.180Z",
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29271",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 44178,
+        "result": "success",
+        "session": "1444",
+        "data": {
+          "op": "PAM:session_close",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtW9UmcBTFzn_XoLr0ty",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.191Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19593",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 142321,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:accounting",
+          "terminal": "cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Q9W9UmcBTFzn_XoLr0ty",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.191Z",
+      "process": {
+        "pid": "19593",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142322,
+        "result": "success",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RNW9UmcBTFzn_XoLr0ty",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.193Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "process": {
+        "pid": "19593",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 142324,
+        "result": "success",
+        "session": "3503",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RdW9UmcBTFzn_XoLr0ty",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.196Z",
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19593",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 142325,
+        "result": "success",
+        "session": "3503",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RtW9UmcBTFzn_XoLr0ty",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.196Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19593",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:session_close",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142326,
+        "result": "success",
+        "session": "3503"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WdW9UmcBTFzn_XoLr0uP",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.214Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12641",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:accounting",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 43155,
+        "result": "success",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WtW9UmcBTFzn_XoLr0uP",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.214Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12641",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43156
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9W9UmcBTFzn_XoLr0uP",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.218Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "uid": "0",
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "12641"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:session_open",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 43158,
+        "result": "success",
+        "session": "1252"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNW9UmcBTFzn_XoLr0uP",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.218Z",
+      "auditd": {
+        "sequence": 43159,
+        "result": "success",
+        "session": "1252",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12641",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XdW9UmcBTFzn_XoLr0uP",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.222Z",
+      "process": {
+        "pid": "12641",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "1252",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 43160,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adW9UmcBTFzn_XoLsUvf",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.812Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "25339",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184337,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atW9UmcBTFzn_XoLsUvf",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.813Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25339",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184338,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9W9UmcBTFzn_XoLsUvf",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.814Z",
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25339",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184340,
+        "result": "success",
+        "session": "9858"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNW9UmcBTFzn_XoLsUvf",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.817Z",
+      "process": {
+        "pid": "25339",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9858",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184341
+      },
+      "event": {
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bdW9UmcBTFzn_XoLsUvf",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.818Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "25339"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184342,
+        "result": "success",
+        "session": "9858",
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        }
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9W-UmcBTFzn_XoL5GZq",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:20.287Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19602",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.59.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "209.59.65.109"
+          }
+        },
+        "sequence": 142327,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNW-UmcBTFzn_XoL5GZq",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:20.288Z",
+      "source": {
+        "ip": "209.59.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142328,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "209.59.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19602",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bdW-UmcBTFzn_XoL5GZq",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:20.382Z",
+      "auditd": {
+        "sequence": 142329,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "209.59.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "209.59.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19602",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.59.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9W-UmcBTFzn_XoL6WZS",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:21.543Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "95.156.31.74"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "95.156.31.74"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142330,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19604",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNW-UmcBTFzn_XoL6WZS",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:21.545Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19604",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "95.156.31.74"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142331,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "95.156.31.74",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idW-UmcBTFzn_XoL6WZS",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:21.689Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19604",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "95.156.31.74"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "95.156.31.74"
+        },
+        "summary": {
+          "object": {
+            "secondary": "95.156.31.74",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142332
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "39W_UmcBTFzn_XoLD2nn",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:31.420Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32215",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186386,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4NW_UmcBTFzn_XoLD2nn",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:31.421Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32215",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186387,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4dW_UmcBTFzn_XoLD2nn",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:31.453Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32215"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186388,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adW_UmcBTFzn_XoLeXOw",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:58.502Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32217",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186389,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "46.148.18.163",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atW_UmcBTFzn_XoLeXOw",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:58.503Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "46.148.18.163",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186390,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32217",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9W_UmcBTFzn_XoLeXOw",
+    "source": {
+      "@timestamp": "2018-11-27T01:18:58.645Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32217",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "46.148.18.163"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186391,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctW-UmcBTFzn_XoLJVU7",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:31.345Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32207",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186383,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9W-UmcBTFzn_XoLJVU7",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:31.346Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32207",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186384,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNW-UmcBTFzn_XoLJVU7",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:31.378Z",
+      "process": {
+        "pid": "32207",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186385,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdW9UmcBTFzn_XoLfkeK",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:48.669Z",
+      "source": {
+        "ip": "115.146.127.132"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "115.146.127.132",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43152,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12639",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtW9UmcBTFzn_XoLfkeK",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:48.669Z",
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "115.146.127.132",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43153,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12639",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.132"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9W9UmcBTFzn_XoLfkeK",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:48.873Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43154,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "115.146.127.132",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "115.146.127.132"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12639",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.132"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9W9UmcBTFzn_XoLUUI6",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:37.072Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32202"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186374,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNW9UmcBTFzn_XoLUUI6",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:37.073Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32202"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186375,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdW9UmcBTFzn_XoLUUI6",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:37.104Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186376,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32202"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "btW9UmcBTFzn_XoLskuL",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.885Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186377,
+        "result": "success",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32204",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "b9W9UmcBTFzn_XoLskuL",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.886Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "32204"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186378
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNW9UmcBTFzn_XoLskuL",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.887Z",
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        },
+        "sequence": 186380,
+        "result": "success",
+        "session": "3511",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_open"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32204",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cdW9UmcBTFzn_XoLskuL",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.890Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32204",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 186381,
+        "result": "success",
+        "session": "3511",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctW9UmcBTFzn_XoLskuL",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.891Z",
+      "process": {
+        "pid": "32204",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186382,
+        "result": "success",
+        "session": "3511"
+      },
+      "event": {
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9W9UmcBTFzn_XoLskuR",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.987Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "458"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 192494,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNW9UmcBTFzn_XoLskuR",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.988Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "458",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192495,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddW9UmcBTFzn_XoLskuR",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.989Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "458",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9862",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        },
+        "sequence": 192497,
+        "result": "success"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dtW9UmcBTFzn_XoLskuR",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.992Z",
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "process": {
+        "pid": "458",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9862",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192498,
+        "result": "success"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "d9W9UmcBTFzn_XoLskuR",
+    "source": {
+      "@timestamp": "2018-11-27T01:17:01.993Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "458",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192499,
+        "result": "success",
+        "session": "9862",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_close"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p9W_UmcBTFzn_XoLs3cF",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:13.179Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "created"
+        ]
+      },
+      "file": {
+        "uid": 0,
+        "owner": "root",
+        "inode": "121",
+        "mtime": "2018-11-27T01:19:13.174Z",
+        "size": 20,
+        "type": "file",
+        "gid": 0,
+        "mode": "0000",
+        "path": "/etc/sed4Tvfpv",
+        "ctime": "2018-11-27T01:19:13.174Z",
+        "group": "root"
+      },
+      "hash": {
+        "sha1": "c7f9a550b77ece79052aa1a630098b911883abde"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qNW_UmcBTFzn_XoLs3cF",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:13.180Z",
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "updated"
+        ]
+      },
+      "file": {
+        "group": "root",
+        "inode": "121",
+        "gid": 0,
+        "type": "file",
+        "mtime": "2018-11-27T01:19:13.178Z",
+        "ctime": "2018-11-27T01:19:13.178Z",
+        "uid": 0,
+        "mode": "0000",
+        "owner": "root",
+        "path": "/etc/sed4Tvfpv",
+        "size": 51
+      },
+      "hash": {
+        "sha1": "4dac5cd40b12d209e8a87bf8089fadab9edfca00"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qdW_UmcBTFzn_XoLs3cF",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:13.187Z",
+      "file": {
+        "path": "/etc/sed4Tvfpv"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "attributes_modified"
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtW_UmcBTFzn_XoLs3cF",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:13.188Z",
+      "event": {
+        "action": [
+          "moved"
+        ],
+        "module": "file_integrity"
+      },
+      "file": {
+        "path": "/etc/sed4Tvfpv"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9W_UmcBTFzn_XoLs3cF",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:13.195Z",
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "created"
+        ]
+      },
+      "file": {
+        "type": "file",
+        "owner": "root",
+        "mtime": "2018-11-27T01:19:13.178Z",
+        "ctime": "2018-11-27T01:19:13.178Z",
+        "group": "root",
+        "path": "/etc/hosts",
+        "gid": 0,
+        "uid": 0,
+        "inode": "121",
+        "mode": "0644",
+        "size": 209
+      },
+      "hash": {
+        "sha1": "ac0139feba2533b2670370c22551547341fde295"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNbJUmcBTFzn_XoL6leU",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:22.705Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25784",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.245.204.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "152.245.204.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 184359
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XdbJUmcBTFzn_XoL6leU",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:22.707Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25784",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.245.204.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "152.245.204.82",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184360,
+        "result": "fail"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XtbJUmcBTFzn_XoL6leU",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:22.717Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25783"
+      },
+      "source": {
+        "ip": "152.245.204.82"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184361,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "152.245.204.82",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9bJUmcBTFzn_XoL6leU",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:22.719Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184362,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "152.245.204.82"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25783",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.245.204.82"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNbJUmcBTFzn_XoL6leU",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:22.897Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25784",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.245.204.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "152.245.204.82",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "152.245.204.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184363,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdbJUmcBTFzn_XoL6leU",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:22.918Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "152.245.204.82"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "152.245.204.82"
+          }
+        },
+        "sequence": 184364
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25783"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "152.245.204.82"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DNbKUmcBTFzn_XoLGlxF",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:34.971Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32299",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186434
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DdbKUmcBTFzn_XoLGlxF",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:34.972Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32299"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186435,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DtbKUmcBTFzn_XoLGlxF",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:35.002Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32299",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186436,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9bJUmcBTFzn_XoLAkOP",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:23.365Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32290",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186431,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNbJUmcBTFzn_XoLAkOP",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:23.366Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32290"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186432
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdbJUmcBTFzn_XoLAkOP",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:23.397Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186433,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32290"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtbLUmcBTFzn_XoLIXLc",
+    "source": {
+      "@timestamp": "2018-11-27T01:31:42.449Z",
+      "auditd": {
+        "sequence": 186437,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32307",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9bLUmcBTFzn_XoLIXLc",
+    "source": {
+      "@timestamp": "2018-11-27T01:31:42.450Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32307"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186438,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNbLUmcBTFzn_XoLIXLc",
+    "source": {
+      "@timestamp": "2018-11-27T01:31:42.481Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32307"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186439,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "udbLUmcBTFzn_XoLfHlZ",
+    "source": {
+      "@timestamp": "2018-11-27T01:32:05.615Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "173.167.200.227",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192532,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "562"
+      },
+      "source": {
+        "ip": "173.167.200.227"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "utbLUmcBTFzn_XoLfHlZ",
+    "source": {
+      "@timestamp": "2018-11-27T01:32:05.616Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "562"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "173.167.200.227"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192533,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "173.167.200.227"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "u9bLUmcBTFzn_XoLfHlZ",
+    "source": {
+      "@timestamp": "2018-11-27T01:32:05.661Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "562",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "173.167.200.227"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "173.167.200.227",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "173.167.200.227",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192534,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtbJUmcBTFzn_XoLK0dG",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:33.789Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "548",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.50.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.68.50.250",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192529,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9bJUmcBTFzn_XoLK0dG",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:33.789Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "548"
+      },
+      "source": {
+        "ip": "138.68.50.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192530,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "138.68.50.250"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNbJUmcBTFzn_XoLK0dG",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:33.830Z",
+      "auditd": {
+        "sequence": 192531,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "138.68.50.250",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "138.68.50.250",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "548",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.50.250"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtbKUmcBTFzn_XoLRF8K",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:45.664Z",
+      "process": {
+        "pid": "29595",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.249.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44189,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "138.68.249.156",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9bKUmcBTFzn_XoLRF8K",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:45.664Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29595"
+      },
+      "source": {
+        "ip": "138.68.249.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.68.249.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44190
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNbKUmcBTFzn_XoLRF8K",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:45.708Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29595",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.249.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44191,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "138.68.249.156"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "138.68.249.156",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNbKUmcBTFzn_XoL3Gzp",
+    "source": {
+      "@timestamp": "2018-11-27T01:31:24.795Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "200.160.115.234",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44192,
+        "result": "fail"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29609",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.160.115.234"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdbKUmcBTFzn_XoL3Gzp",
+    "source": {
+      "@timestamp": "2018-11-27T01:31:24.795Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "200.160.115.234",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44193
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29609",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.160.115.234"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gtbKUmcBTFzn_XoL3Gzp",
+    "source": {
+      "@timestamp": "2018-11-27T01:31:24.971Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44194,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "200.160.115.234",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "200.160.115.234",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29609",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.160.115.234"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNbKUmcBTFzn_XoLLl55",
+    "source": {
+      "@timestamp": "2018-11-27T01:30:40.139Z",
+      "process": {
+        "pid": "29592",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44188,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "164.132.197.108",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "164.132.197.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdbNUmcBTFzn_XoLn6nH",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:25.758Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 186449,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32327",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YtbNUmcBTFzn_XoLn6nH",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:25.759Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32327",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186450
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Y9bNUmcBTFzn_XoLn6nH",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:25.789Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32327",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186451
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adbNUmcBTFzn_XoLo6mE",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:26.614Z",
+      "process": {
+        "pid": "12750",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "101.89.114.94"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43176,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "101.89.114.94",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atbNUmcBTFzn_XoLo6mE",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:26.614Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12750",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "101.89.114.94"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43177,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "101.89.114.94",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9bNUmcBTFzn_XoLo6mE",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:26.814Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12750",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "101.89.114.94"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "101.89.114.94",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43178,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "101.89.114.94",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tbPUmcBTFzn_XoLbtDN",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:24.291Z",
+      "process": {
+        "pid": "32340",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186458,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "29bPUmcBTFzn_XoLbtDN",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:24.292Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186459,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32340",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3NbPUmcBTFzn_XoLbtDN",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:24.322Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32340",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186460,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EtbOUmcBTFzn_XoLf7xx",
+    "source": {
+      "@timestamp": "2018-11-27T01:35:22.989Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186455,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32333"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E9bOUmcBTFzn_XoLf7xx",
+    "source": {
+      "@timestamp": "2018-11-27T01:35:22.990Z",
+      "process": {
+        "pid": "32333",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186456,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNbOUmcBTFzn_XoLf7xx",
+    "source": {
+      "@timestamp": "2018-11-27T01:35:23.020Z",
+      "process": {
+        "pid": "32333",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186457,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tbMUmcBTFzn_XoLzZY6",
+    "source": {
+      "@timestamp": "2018-11-27T01:33:31.856Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32317",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186443,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69bMUmcBTFzn_XoLzZY6",
+    "source": {
+      "@timestamp": "2018-11-27T01:33:31.857Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32317",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186444,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7NbMUmcBTFzn_XoLzZY6",
+    "source": {
+      "@timestamp": "2018-11-27T01:33:31.887Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32317",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 186445,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdbMUmcBTFzn_XoLAYZs",
+    "source": {
+      "@timestamp": "2018-11-27T01:32:39.681Z",
+      "auditd": {
+        "sequence": 186440,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32315",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EtbMUmcBTFzn_XoLAYZs",
+    "source": {
+      "@timestamp": "2018-11-27T01:32:39.682Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32315",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186441,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E9bMUmcBTFzn_XoLAYZs",
+    "source": {
+      "@timestamp": "2018-11-27T01:32:39.713Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32315",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186442
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dbOUmcBTFzn_XoLD7I4",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:54.285Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32330",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186452,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "178.33.228.67"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tbOUmcBTFzn_XoLD7I4",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:54.286Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32330",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "178.33.228.67",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186453,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69bOUmcBTFzn_XoLD7I4",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:54.394Z",
+      "process": {
+        "pid": "32330",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186454,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "178.33.228.67",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.33.228.67",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tbOUmcBTFzn_XoL_cbV",
+    "source": {
+      "@timestamp": "2018-11-27T01:35:55.371Z",
+      "source": {
+        "ip": "85.113.39.134"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "85.113.39.134",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192535,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "583"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-9bOUmcBTFzn_XoL_cbV",
+    "source": {
+      "@timestamp": "2018-11-27T01:35:55.372Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "583"
+      },
+      "source": {
+        "ip": "85.113.39.134"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "sequence": 192536,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "85.113.39.134"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_NbOUmcBTFzn_XoL_cbV",
+    "source": {
+      "@timestamp": "2018-11-27T01:35:55.530Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192537,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "85.113.39.134",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "85.113.39.134"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "583",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "85.113.39.134"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xdbMUmcBTFzn_XoLx5bh",
+    "source": {
+      "@timestamp": "2018-11-27T01:33:30.481Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "131.72.141.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "131.72.141.34"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43173,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtbMUmcBTFzn_XoLx5bh",
+    "source": {
+      "@timestamp": "2018-11-27T01:33:30.485Z",
+      "process": {
+        "pid": "12742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "131.72.141.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43174,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "131.72.141.34",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "x9bMUmcBTFzn_XoLx5bh",
+    "source": {
+      "@timestamp": "2018-11-27T01:33:30.637Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "131.72.141.34",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "131.72.141.34",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43175,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "131.72.141.34"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WtbNUmcBTFzn_XoLcqUk",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:14.073Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32325",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.33.178"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.33.178",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186446,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9bNUmcBTFzn_XoLcqUk",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:14.075Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32325"
+      },
+      "source": {
+        "ip": "51.38.33.178"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.33.178",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186447
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNbNUmcBTFzn_XoLcqUk",
+    "source": {
+      "@timestamp": "2018-11-27T01:34:14.182Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32325"
+      },
+      "source": {
+        "ip": "51.38.33.178"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.38.33.178",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186448,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.38.33.178"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9bQUmcBTFzn_XoLRuMO",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:19.393Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12766",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "117.172.59.127"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "117.172.59.127"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43182
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNbQUmcBTFzn_XoLRuMO",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:19.393Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12766"
+      },
+      "source": {
+        "ip": "117.172.59.127"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "117.172.59.127",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43183,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XdbQUmcBTFzn_XoLRuMO",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:19.649Z",
+      "process": {
+        "pid": "12766",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "117.172.59.127"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "117.172.59.127"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "117.172.59.127"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43184,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "otbQUmcBTFzn_XoLVOSA",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:23.093Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12773",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.85.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43185,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "193.70.85.206"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "193.70.85.206",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtbQUmcBTFzn_XoLaudn",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:28.701Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32348"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186461,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "B9bQUmcBTFzn_XoLaudn",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:28.702Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186462,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32348"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNbQUmcBTFzn_XoLaudn",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:28.734Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32348"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186463,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E9bRUmcBTFzn_XoLKPdd",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:17.330Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19716"
+      },
+      "source": {
+        "ip": "93.157.241.40"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "93.157.241.40",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142343,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNbRUmcBTFzn_XoLKPdd",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:17.331Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19716",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "93.157.241.40"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "93.157.241.40",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142344,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdbRUmcBTFzn_XoLKPdd",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:17.539Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19716",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "93.157.241.40"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "93.157.241.40",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "93.157.241.40",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142345,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qNbPUmcBTFzn_XoL8dwD",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:57.625Z",
+      "process": {
+        "pid": "25824",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "94.23.0.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "94.23.0.13",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184365,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qdbPUmcBTFzn_XoL8dwD",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:57.626Z",
+      "source": {
+        "ip": "94.23.0.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "94.23.0.13"
+          }
+        },
+        "sequence": 184366,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25824",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtbPUmcBTFzn_XoL8dwD",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:57.733Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25824"
+      },
+      "source": {
+        "ip": "94.23.0.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184367,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "94.23.0.13",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "94.23.0.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "T9bQUmcBTFzn_XoLQeNm",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:18.204Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.203.185.59",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192544
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "595",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.185.59"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UNbQUmcBTFzn_XoLQeNm",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:18.205Z",
+      "process": {
+        "pid": "595",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.185.59"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192545,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "159.203.185.59"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UdbQUmcBTFzn_XoLQeNm",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:18.237Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "159.203.185.59",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192546,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "159.203.185.59"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "595",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.185.59"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RdbQUmcBTFzn_XoLGOA5",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:07.663Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "593",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.242.169.217"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "82.242.169.217",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192541,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RtbQUmcBTFzn_XoLGOA5",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:07.664Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "82.242.169.217",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192542,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "593",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.242.169.217"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R9bQUmcBTFzn_XoLGOA5",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:08.073Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "593",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.242.169.217"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192543,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "82.242.169.217",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "82.242.169.217",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtbPUmcBTFzn_XoL29qM",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:52.130Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.230.8.194",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 192538
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "591"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "91.230.8.194"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9bPUmcBTFzn_XoL29qM",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:52.131Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "591",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.230.8.194"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.230.8.194",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192539
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNbPUmcBTFzn_XoL29qM",
+    "source": {
+      "@timestamp": "2018-11-27T01:36:52.258Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "91.230.8.194",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "91.230.8.194",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192540
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "591",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.230.8.194"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vtbQUmcBTFzn_XoLKeAA",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:11.956Z",
+      "source": {
+        "ip": "51.254.201.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "51.254.201.64"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43179,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12764",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "v9bQUmcBTFzn_XoLKeAA",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:11.956Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12764",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.254.201.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.254.201.64",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43180,
+        "result": "fail"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wNbQUmcBTFzn_XoLKeAA",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:12.064Z",
+      "process": {
+        "pid": "12764",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.254.201.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43181,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "51.254.201.64",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "51.254.201.64"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltbQUmcBTFzn_XoL3fAn",
+    "source": {
+      "@timestamp": "2018-11-27T01:37:58.076Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.17.40.237",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142342,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "46.17.40.237"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19713",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.17.40.237"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VtfUUmcBTFzn_XoLxEaR",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:13.909Z",
+      "source": {
+        "ip": "147.75.96.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.75.96.90",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44195,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29821",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9fUUmcBTFzn_XoLxEaR",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:13.913Z",
+      "source": {
+        "ip": "147.75.96.90"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44196,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.75.96.90",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29821"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WNfUUmcBTFzn_XoLxEaR",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:13.945Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29821"
+      },
+      "source": {
+        "ip": "147.75.96.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44197,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "147.75.96.90",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "147.75.96.90"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wtfUUmcBTFzn_XoLzEYU",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:15.845Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29824",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.4.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44198,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "144.217.4.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "w9fUUmcBTFzn_XoLzEYU",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:15.845Z",
+      "process": {
+        "pid": "29824",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.4.14"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44199,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "144.217.4.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xNfUUmcBTFzn_XoLzEYU",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:15.889Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29824",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.4.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44200,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "144.217.4.14"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "144.217.4.14",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NfUUmcBTFzn_XoL0Ubg",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:17.334Z",
+      "process": {
+        "pid": "19742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "192.252.209.190"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "192.252.209.190",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 142355
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dfUUmcBTFzn_XoL0Ubg",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:17.335Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "192.252.209.190",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142356,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.252.209.190"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0tfUUmcBTFzn_XoL0Ubg",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:17.366Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.252.209.190"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142357,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "192.252.209.190"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "192.252.209.190",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tNfUUmcBTFzn_XoLIDfE",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:31.994Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19739",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.196.12.151"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "82.196.12.151",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142352,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tdfUUmcBTFzn_XoLIDfE",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:31.995Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "82.196.12.151",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142353,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19739",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.196.12.151"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ttfUUmcBTFzn_XoLIDfE",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:32.100Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19739",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.196.12.151"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142354,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "82.196.12.151"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "82.196.12.151",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dfVUmcBTFzn_XoLRFCU",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:46.698Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "202.28.34.200",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 184380
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25911",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tfVUmcBTFzn_XoLRFCU",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:46.700Z",
+      "auditd": {
+        "sequence": 184381,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "202.28.34.200",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25911"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_9fVUmcBTFzn_XoLRFCU",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:46.932Z",
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "202.28.34.200"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "202.28.34.200",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184382,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25911",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANfUUmcBTFzn_XoL5ElJ",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:22.047Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25908"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184377,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdfUUmcBTFzn_XoL5ElJ",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:22.048Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184378,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25908",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtfUUmcBTFzn_XoL5ElJ",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:22.097Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25908",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184379,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "104.234.223.14",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79fUUmcBTFzn_XoLuUSW",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:11.115Z",
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186479,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32381",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NfUUmcBTFzn_XoLuUSW",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:11.116Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32381",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186480,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8dfUUmcBTFzn_XoLuUSW",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:11.146Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32381",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186481,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntfUUmcBTFzn_XoLPzou",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:39.780Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25901",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.91.116.197"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.91.116.197",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184374,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9fUUmcBTFzn_XoLPzou",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:39.781Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25901",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.91.116.197"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.91.116.197",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184375,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNfUUmcBTFzn_XoLPzou",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:39.902Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25901"
+      },
+      "source": {
+        "ip": "185.91.116.197"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "185.91.116.197",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "185.91.116.197",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 184376,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdfUUmcBTFzn_XoLaj6n",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:50.908Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32377"
+      },
+      "source": {
+        "ip": "37.187.113.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186476,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.187.113.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TtfUUmcBTFzn_XoLaj6n",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:50.909Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186477,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.187.113.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32377"
+      },
+      "source": {
+        "ip": "37.187.113.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "T9fUUmcBTFzn_XoLaj6n",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:51.016Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32377",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.113.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "37.187.113.229"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "37.187.113.229"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186478,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdfVUmcBTFzn_XoLildy",
+    "source": {
+      "@timestamp": "2018-11-27T01:43:04.584Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "92.222.47.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184383,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25918",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "92.222.47.243"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gtfVUmcBTFzn_XoLildy",
+    "source": {
+      "@timestamp": "2018-11-27T01:43:04.585Z",
+      "source": {
+        "ip": "92.222.47.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "92.222.47.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184384,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25918",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "g9fVUmcBTFzn_XoLildy",
+    "source": {
+      "@timestamp": "2018-11-27T01:43:04.690Z",
+      "source": {
+        "ip": "92.222.47.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "92.222.47.243",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "92.222.47.243",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184385,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25918"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tfUUmcBTFzn_XoL-0sw",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:27.906Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.21.16.108",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44201,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29828",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.21.16.108"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79fUUmcBTFzn_XoL-0sw",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:27.906Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "29828",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.21.16.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.21.16.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44202,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NfUUmcBTFzn_XoL-0sw",
+    "source": {
+      "@timestamp": "2018-11-27T01:42:28.038Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29828",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.21.16.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "185.21.16.108",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "185.21.16.108"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44203,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNfcUmcBTFzn_XoLuPTT",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:55.209Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32438"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186506,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdfcUmcBTFzn_XoLuPTT",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:55.210Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186507,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32438"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NtfcUmcBTFzn_XoLuPTT",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:55.240Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32438",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186508,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OtfcUmcBTFzn_XoLu_Sp",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:55.885Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.80.6.244",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142382,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19808",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.80.6.244"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "O9fcUmcBTFzn_XoLu_Sp",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:55.886Z",
+      "source": {
+        "ip": "178.80.6.244"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "178.80.6.244"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142383,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19808",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PNfcUmcBTFzn_XoLu_Sp",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:56.100Z",
+      "auditd": {
+        "data": {
+          "hostname": "178.80.6.244",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "178.80.6.244"
+          }
+        },
+        "sequence": 142384,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19808",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.80.6.244"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ttfaUmcBTFzn_XoL780P",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:58.021Z",
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.236.181.158"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142376,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19793",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "t9faUmcBTFzn_XoL780P",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:58.022Z",
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.236.181.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142377,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19793",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "uNfaUmcBTFzn_XoL780P",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:58.064Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "104.236.181.158"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "104.236.181.158"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142378,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19793",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tNfbUmcBTFzn_XoLTdQu",
+    "source": {
+      "@timestamp": "2018-11-27T01:49:22.116Z",
+      "process": {
+        "pid": "19795",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "153.142.75.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "153.142.75.192",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 142379
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tdfbUmcBTFzn_XoLTdQu",
+    "source": {
+      "@timestamp": "2018-11-27T01:49:22.117Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19795",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "153.142.75.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142380,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "153.142.75.192",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ttfbUmcBTFzn_XoLTdQu",
+    "source": {
+      "@timestamp": "2018-11-27T01:49:22.274Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19795",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "153.142.75.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "153.142.75.192"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "153.142.75.192",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142381,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GtfaUmcBTFzn_XoLLr2X",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:08.749Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19785",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "190.0.10.138"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 142373,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9faUmcBTFzn_XoLLr2X",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:08.750Z",
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "190.0.10.138",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142374
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19785",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNfaUmcBTFzn_XoLLr2X",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:08.857Z",
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142375,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "190.0.10.138",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "190.0.10.138"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19785",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9faUmcBTFzn_XoLbcKr",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:24.897Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32420"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186500,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNfaUmcBTFzn_XoLbcKr",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:24.899Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186501,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32420"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdfaUmcBTFzn_XoLbcKr",
+    "source": {
+      "@timestamp": "2018-11-27T01:48:24.929Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186502,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32420",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItfZUmcBTFzn_XoLRqn8",
+    "source": {
+      "@timestamp": "2018-11-27T01:47:09.456Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32412"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186497,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9fZUmcBTFzn_XoLRqn8",
+    "source": {
+      "@timestamp": "2018-11-27T01:47:09.457Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32412",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186498,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNfZUmcBTFzn_XoLRqn8",
+    "source": {
+      "@timestamp": "2018-11-27T01:47:09.491Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32412",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186499,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtfbUmcBTFzn_XoLltt6",
+    "source": {
+      "@timestamp": "2018-11-27T01:49:40.879Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186503,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32428",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9fbUmcBTFzn_XoLltt6",
+    "source": {
+      "@timestamp": "2018-11-27T01:49:40.881Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32428"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186504
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNfbUmcBTFzn_XoLltt6",
+    "source": {
+      "@timestamp": "2018-11-27T01:49:40.911Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186505,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32428"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNfZUmcBTFzn_XoL6LbT",
+    "source": {
+      "@timestamp": "2018-11-27T01:47:50.888Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19783",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "176.31.75.53"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142370,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "176.31.75.53"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdfZUmcBTFzn_XoL6LbT",
+    "source": {
+      "@timestamp": "2018-11-27T01:47:50.889Z",
+      "source": {
+        "ip": "176.31.75.53"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142371,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "176.31.75.53",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19783",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztfZUmcBTFzn_XoL6LbT",
+    "source": {
+      "@timestamp": "2018-11-27T01:47:50.996Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "176.31.75.53"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "176.31.75.53",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142372,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19783",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "176.31.75.53"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dfcUmcBTFzn_XoLVuuz",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:30.087Z",
+      "source": {
+        "ip": "178.33.45.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44204,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.45.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29987"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tfcUmcBTFzn_XoLVuuz",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:30.087Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "29987",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.45.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.45.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44205,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69fcUmcBTFzn_XoLVuuz",
+    "source": {
+      "@timestamp": "2018-11-27T01:50:30.195Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29987",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.45.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44206,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "178.33.45.156"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.33.45.156",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "i9jhUmcBTFzn_XoLAlEZ",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:36.110Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26002"
+      },
+      "source": {
+        "ip": "178.48.181.9"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "178.48.181.9",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 184395
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jNjhUmcBTFzn_XoLAlEZ",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:36.111Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26002"
+      },
+      "source": {
+        "ip": "178.48.181.9"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184396,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.48.181.9",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jdjhUmcBTFzn_XoLAlEZ",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:36.272Z",
+      "source": {
+        "ip": "178.48.181.9"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184397,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "178.48.181.9",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "178.48.181.9"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26002"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNjhUmcBTFzn_XoLBFLi",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:36.824Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186518,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32466",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HdjhUmcBTFzn_XoLBFLi",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:36.825Z",
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32466",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186519,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HtjhUmcBTFzn_XoLBFLi",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:36.858Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186520,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32466",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9jhUmcBTFzn_XoLml-F",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:15.131Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "83.99.24.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186524,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32470",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "83.99.24.14"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNjhUmcBTFzn_XoLml-F",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:15.132Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32470"
+      },
+      "source": {
+        "ip": "83.99.24.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "83.99.24.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186525,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdjhUmcBTFzn_XoLml-F",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:15.245Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32470",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "83.99.24.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "83.99.24.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186526,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "83.99.24.14"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YtjhUmcBTFzn_XoLml-F",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:15.822Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "51.38.68.237"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186527,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32472",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.68.237"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Y9jhUmcBTFzn_XoLml-F",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:15.823Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32472",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "51.38.68.237"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186528,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "51.38.68.237"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZNjhUmcBTFzn_XoLml-F",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:15.930Z",
+      "auditd": {
+        "sequence": 186529,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "51.38.68.237"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "51.38.68.237"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32472"
+      },
+      "source": {
+        "ip": "51.38.68.237"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jNjgUmcBTFzn_XoL304M",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:27.134Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30088",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.142.225"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.121.142.225",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44210,
+        "result": "fail"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jdjgUmcBTFzn_XoL304M",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:27.134Z",
+      "process": {
+        "pid": "30088",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "91.121.142.225"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "91.121.142.225"
+          }
+        },
+        "sequence": 44211
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jtjgUmcBTFzn_XoL304M",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:27.238Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30088",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.142.225"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "91.121.142.225"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "91.121.142.225"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44212,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "j9jgUmcBTFzn_XoL304M",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:27.846Z",
+      "source": {
+        "ip": "104.234.223.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44213,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30090",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kNjgUmcBTFzn_XoL304M",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:27.850Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "104.234.223.14",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44214
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30090"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdjgUmcBTFzn_XoL304M",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:27.898Z",
+      "process": {
+        "pid": "30090",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.234.223.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44215,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "104.234.223.14",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.234.223.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vNjfUmcBTFzn_XoL8jpi",
+    "source": {
+      "@timestamp": "2018-11-27T01:54:26.552Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32457",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186515,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vdjfUmcBTFzn_XoL8jpi",
+    "source": {
+      "@timestamp": "2018-11-27T01:54:26.553Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32457"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186516,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vtjfUmcBTFzn_XoL8jpi",
+    "source": {
+      "@timestamp": "2018-11-27T01:54:26.584Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186517,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32457",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59jgUmcBTFzn_XoLk0ht",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:07.779Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "65.127.203.242",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142395,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19840",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "65.127.203.242"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NjgUmcBTFzn_XoLk0ht",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:07.780Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19840",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "65.127.203.242"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "65.127.203.242",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142396,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6djgUmcBTFzn_XoLk0ht",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:07.840Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19840",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "65.127.203.242"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "65.127.203.242",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 142397,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "65.127.203.242",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "P9jhUmcBTFzn_XoLbFvp",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:03.454Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.197.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186521
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32468",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QNjhUmcBTFzn_XoLbFvp",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:03.455Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32468",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "164.132.197.108"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186522,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdjhUmcBTFzn_XoLbFvp",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:03.574Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "164.132.197.108",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "164.132.197.108",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186523,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32468",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kNjgUmcBTFzn_XoLv0zp",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:19.167Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "752",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "36.84.80.31"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "36.84.80.31",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192556,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdjgUmcBTFzn_XoLv0zp",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:19.168Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192557,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "36.84.80.31",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "752",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "36.84.80.31"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktjgUmcBTFzn_XoLv0zp",
+    "source": {
+      "@timestamp": "2018-11-27T01:55:19.429Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "36.84.80.31"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "36.84.80.31",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192558
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "752",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "36.84.80.31"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_NjhUmcBTFzn_XoLd1s3",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:06.089Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "197.149.137.86",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44216,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30106",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "197.149.137.86"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_djhUmcBTFzn_XoLd1s3",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:06.089Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30106",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "197.149.137.86"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "197.149.137.86",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44217,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tjhUmcBTFzn_XoLd1s3",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:06.317Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30106",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "197.149.137.86"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "197.149.137.86",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44218,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "197.149.137.86",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JtjhUmcBTFzn_XoL7GYK",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:36.000Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26010",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.191.209"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184398,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "54.37.191.209"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "54.37.191.209",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NtjlUmcBTFzn_XoLuLrU",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:45.031Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26032",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.145.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.145.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184399,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9jlUmcBTFzn_XoLuLrU",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:45.032Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26032",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.145.205"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.145.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184400
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONjlUmcBTFzn_XoLuLrU",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:45.255Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "128.199.145.205",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.145.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184401
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26032",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "128.199.145.205"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdjlUmcBTFzn_XoLubrj",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:45.301Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32510"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186545,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OtjlUmcBTFzn_XoLubrj",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:45.302Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186546
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32510"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "O9jlUmcBTFzn_XoLubrj",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:45.333Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186547,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32510",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R9jlUmcBTFzn_XoLvrqH",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:46.487Z",
+      "source": {
+        "ip": "51.254.140.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43217,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "51.254.140.108"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12917",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNjlUmcBTFzn_XoLvrqH",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:46.487Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12917",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "51.254.140.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43218,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "51.254.140.108"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdjlUmcBTFzn_XoLvrqH",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:46.595Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12917",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.254.140.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43219,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "51.254.140.108",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.254.140.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StjlUmcBTFzn_XoLvrqH",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:47.131Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12919",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "79.133.56.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "79.133.56.139",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43220,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9jlUmcBTFzn_XoLvrqH",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:47.135Z",
+      "process": {
+        "pid": "12919",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "79.133.56.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "79.133.56.139",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43221
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNjlUmcBTFzn_XoLvrqH",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:47.243Z",
+      "source": {
+        "ip": "79.133.56.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "79.133.56.139"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "79.133.56.139"
+          }
+        },
+        "sequence": 43222
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12919"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wdjmUmcBTFzn_XoL8NQE",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:04.698Z",
+      "process": {
+        "pid": "19884",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "50.71.229.131"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "50.71.229.131",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142407
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wtjmUmcBTFzn_XoL8NQE",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:04.699Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19884",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "50.71.229.131"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142408,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "50.71.229.131",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "w9jmUmcBTFzn_XoL8NQE",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:04.762Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "50.71.229.131"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142409,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "50.71.229.131",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "50.71.229.131",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19884",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xdjmUmcBTFzn_XoL8tSP",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:05.349Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32513"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186548,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtjmUmcBTFzn_XoL8tSP",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:05.350Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32513"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186549,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "x9jmUmcBTFzn_XoL8tSP",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:05.381Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32513",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186550,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9jlUmcBTFzn_XoLPq9B",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:13.654Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142398,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.182.55.191",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19871",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.182.55.191"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WNjlUmcBTFzn_XoLPq9B",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:13.656Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.182.55.191",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142399,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19871",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.182.55.191"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WdjlUmcBTFzn_XoLPq9B",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:13.762Z",
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19871",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.182.55.191"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142400,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "217.182.55.191",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "217.182.55.191",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4djmUmcBTFzn_XoLT8Yc",
+    "source": {
+      "@timestamp": "2018-11-27T02:01:23.506Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.121.110.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142401,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19879"
+      },
+      "source": {
+        "ip": "91.121.110.50"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4tjmUmcBTFzn_XoLT8Yc",
+    "source": {
+      "@timestamp": "2018-11-27T02:01:23.507Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142402,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.121.110.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19879",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "91.121.110.50"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "49jmUmcBTFzn_XoLT8Yc",
+    "source": {
+      "@timestamp": "2018-11-27T02:01:23.614Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "91.121.110.50",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "91.121.110.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142403,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19879",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.110.50"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktjnUmcBTFzn_XoLvuUr",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:57.473Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32520"
+      },
+      "source": {
+        "ip": "213.191.147.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "213.191.147.66"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186551,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "k9jnUmcBTFzn_XoLvuUr",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:57.474Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186552,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "213.191.147.66",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32520",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "213.191.147.66"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lNjnUmcBTFzn_XoLvuUr",
+    "source": {
+      "@timestamp": "2018-11-27T02:02:57.617Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32520",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "213.191.147.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186553,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "213.191.147.66"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "213.191.147.66",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tjmUmcBTFzn_XoLlMzO",
+    "source": {
+      "@timestamp": "2018-11-27T02:01:41.348Z",
+      "source": {
+        "ip": "211.219.52.136"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.219.52.136",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142404,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19881",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79jmUmcBTFzn_XoLlMzO",
+    "source": {
+      "@timestamp": "2018-11-27T02:01:41.349Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19881",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.219.52.136"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "211.219.52.136",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142405
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NjmUmcBTFzn_XoLlMzO",
+    "source": {
+      "@timestamp": "2018-11-27T02:01:41.509Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19881",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.219.52.136"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "211.219.52.136",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142406,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "211.219.52.136",
+          "terminal": "ssh"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9joUmcBTFzn_XoLK-92",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:25.452Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32523"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186554,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNjoUmcBTFzn_XoLK-92",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:25.453Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32523"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186555
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idjoUmcBTFzn_XoLK-92",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:25.484Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32523",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186556
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtjoUmcBTFzn_XoLAuyv",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:15.008Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "191.255.74.211",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43223
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12938",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "191.255.74.211"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9joUmcBTFzn_XoLAuyv",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:15.008Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "191.255.74.211"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43224
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12938",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "191.255.74.211"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNjoUmcBTFzn_XoLAuyv",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:15.172Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "191.255.74.211",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "191.255.74.211",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43225,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12938",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "191.255.74.211"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9jlUmcBTFzn_XoLX7Lz",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:22.277Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "152.115.61.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44222,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "152.115.61.52",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30191",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNjlUmcBTFzn_XoLX7Lz",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:22.277Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "152.115.61.52"
+          }
+        },
+        "sequence": 44223,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30191",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.115.61.52"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GdjlUmcBTFzn_XoLX7Lz",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:22.397Z",
+      "process": {
+        "pid": "30191",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.115.61.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "152.115.61.52",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "152.115.61.52"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44224
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtnuUmcBTFzn_XoLAnDn",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:48.280Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30394"
+      },
+      "source": {
+        "ip": "185.227.110.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.227.110.251"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44237,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "B9nuUmcBTFzn_XoLAnDn",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:48.280Z",
+      "source": {
+        "ip": "185.227.110.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44238,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.227.110.251",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30394"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNnuUmcBTFzn_XoLAnDn",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:48.468Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30394",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.227.110.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "185.227.110.251"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "185.227.110.251",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44239,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9nuUmcBTFzn_XoLDHBr",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:50.721Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "218.149.228.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "218.149.228.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184418,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26142",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNnuUmcBTFzn_XoLDHBr",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:50.722Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26142",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "218.149.228.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "218.149.228.158",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184419,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdnuUmcBTFzn_XoLDHBr",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:51.346Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184420,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "218.149.228.158",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "218.149.228.158"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26142",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "218.149.228.158"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79ntUmcBTFzn_XoLGltv",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:48.772Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186566,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32556",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NntUmcBTFzn_XoLGltv",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:48.774Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186567,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32556",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8dntUmcBTFzn_XoLGltv",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:48.804Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186568,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32556",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99ntUmcBTFzn_XoLHFsj",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:49.207Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184409,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "145.239.82.62",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26086",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "145.239.82.62"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NntUmcBTFzn_XoLHFsj",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:49.208Z",
+      "auditd": {
+        "sequence": 184410,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "145.239.82.62",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26086",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "145.239.82.62"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dntUmcBTFzn_XoLHFsj",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:49.341Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26086"
+      },
+      "source": {
+        "ip": "145.239.82.62"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "145.239.82.62",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184411,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "145.239.82.62"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNntUmcBTFzn_XoLc2Oa",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:11.600Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "109.115.54.245"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142413,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "109.115.54.245",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CdntUmcBTFzn_XoLc2Oa",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:11.601Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "109.115.54.245",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142414,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19924"
+      },
+      "source": {
+        "ip": "109.115.54.245"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtntUmcBTFzn_XoLc2Oa",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:11.721Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "109.115.54.245"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "109.115.54.245",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "109.115.54.245",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142415
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RNnuUmcBTFzn_XoLWnfO",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:10.787Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32565"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186569,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RdnuUmcBTFzn_XoLWnfO",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:10.788Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186570,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32565",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RtnuUmcBTFzn_XoLWnfO",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:10.819Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32565",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186571,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdntUmcBTFzn_XoLiGV_",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:16.902Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19926",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "71.90.181.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142416,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "71.90.181.64",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtntUmcBTFzn_XoLiGV_",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:16.903Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19926",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "71.90.181.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "71.90.181.64",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142417
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A9ntUmcBTFzn_XoLiGV_",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:16.974Z",
+      "auditd": {
+        "sequence": 142418,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "71.90.181.64"
+        },
+        "summary": {
+          "object": {
+            "secondary": "71.90.181.64",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19926",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "71.90.181.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tntUmcBTFzn_XoLSl-h",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.110Z",
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "830",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192568,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:accounting",
+          "acct": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "29ntUmcBTFzn_XoLSl-h",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.110Z",
+      "auditd": {
+        "sequence": 192569,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "830",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3NntUmcBTFzn_XoLSl-h",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.112Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "830",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:session_open",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192571,
+        "result": "success",
+        "session": "9864"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3dntUmcBTFzn_XoLSl-h",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.215Z",
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "830",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192572,
+        "result": "success",
+        "session": "9864",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3tntUmcBTFzn_XoLSl-h",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.216Z",
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "830",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:session_close",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192573,
+        "result": "success",
+        "session": "9864"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dntUmcBTFzn_XoLTV_Y",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.933Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26094",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184412,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:accounting",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tntUmcBTFzn_XoLTV_Y",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.933Z",
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26094",
+        "exe": "/usr/sbin/cron"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184413,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_9ntUmcBTFzn_XoLTV_Y",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:01.935Z",
+      "auditd": {
+        "result": "success",
+        "session": "9860",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184415
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26094",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANntUmcBTFzn_XoLTWDY",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:02.034Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "9860",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184416,
+        "result": "success"
+      },
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26094",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdntUmcBTFzn_XoLTWDY",
+    "source": {
+      "@timestamp": "2018-11-27T02:09:02.035Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26094",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_close"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        },
+        "sequence": 184417,
+        "result": "success",
+        "session": "9860"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "odnuUmcBTFzn_XoLa3iq",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:15.075Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.244.25.108"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 44240,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30401"
+      },
+      "source": {
+        "ip": "185.244.25.108"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "otnuUmcBTFzn_XoLa3iq",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:15.075Z",
+      "process": {
+        "pid": "30401",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "185.244.25.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.244.25.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44241,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "o9nuUmcBTFzn_XoLa3iq",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:15.175Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "185.244.25.108",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "185.244.25.108",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44242,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30401",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.244.25.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z9nuUmcBTFzn_XoLh3rt",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:22.335Z",
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "146.196.59.36",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 44243,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30405",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "146.196.59.36"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NnuUmcBTFzn_XoLh3rt",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:22.335Z",
+      "source": {
+        "ip": "146.196.59.36"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "146.196.59.36"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44244
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30405",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dnuUmcBTFzn_XoLh3rt",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:22.583Z",
+      "process": {
+        "pid": "30405",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "146.196.59.36"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44245,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "146.196.59.36",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "146.196.59.36"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9tnuUmcBTFzn_XoLM3ME",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:00.602Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "created"
+        ]
+      },
+      "file": {
+        "size": 0,
+        "type": "file",
+        "uid": 0,
+        "owner": "root",
+        "group": "root",
+        "mode": "0000",
+        "mtime": "2018-11-27T02:10:00.596Z",
+        "gid": 0,
+        "inode": "185",
+        "path": "/etc/sed6b0EHM",
+        "ctime": "2018-11-27T02:10:00.596Z"
+      },
+      "hash": {
+        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99nuUmcBTFzn_XoLM3ME",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:00.603Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "updated"
+        ]
+      },
+      "file": {
+        "inode": "185",
+        "size": 50,
+        "type": "file",
+        "uid": 0,
+        "owner": "root",
+        "mode": "0000",
+        "path": "/etc/sed6b0EHM",
+        "group": "root",
+        "mtime": "2018-11-27T02:10:00.600Z",
+        "ctime": "2018-11-27T02:10:00.600Z",
+        "gid": 0
+      },
+      "hash": {
+        "sha1": "58a8b2bb04893785eb5a48598a16a3fa8ad2fa36"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NnuUmcBTFzn_XoLM3ME",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:00.605Z",
+      "file": {
+        "path": "/etc/sed6b0EHM"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "attributes_modified"
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dnuUmcBTFzn_XoLM3ME",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:00.606Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "moved"
+        ]
+      },
+      "file": {
+        "path": "/etc/sed6b0EHM"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tnuUmcBTFzn_XoLM3ME",
+    "source": {
+      "@timestamp": "2018-11-27T02:10:00.607Z",
+      "event": {
+        "action": [
+          "created"
+        ],
+        "module": "file_integrity"
+      },
+      "file": {
+        "owner": "root",
+        "uid": 0,
+        "mode": "0644",
+        "inode": "185",
+        "mtime": "2018-11-27T02:10:00.600Z",
+        "gid": 0,
+        "group": "root",
+        "path": "/etc/hosts",
+        "ctime": "2018-11-27T02:10:00.600Z",
+        "type": "file",
+        "size": 205
+      },
+      "hash": {
+        "sha1": "5a4ccf92aa02bc100c5b20faeed3691286e039e5"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VdnzUmcBTFzn_XoLR-PG",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:33.590Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "51.75.23.199",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43238
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13014",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.75.23.199"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VtnzUmcBTFzn_XoLR-PG",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:33.590Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13014"
+      },
+      "source": {
+        "ip": "51.75.23.199"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43239,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.75.23.199",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9nzUmcBTFzn_XoLR-PG",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:33.702Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13014",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.75.23.199"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "51.75.23.199",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43240,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.75.23.199"
+        }
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3tnzUmcBTFzn_XoLUOOL",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:35.841Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "939"
+      },
+      "source": {
+        "ip": "181.28.191.54"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "181.28.191.54",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192586,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "39nzUmcBTFzn_XoLUOOL",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:35.843Z",
+      "auditd": {
+        "sequence": 192587,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "181.28.191.54",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "939"
+      },
+      "source": {
+        "ip": "181.28.191.54"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4NnzUmcBTFzn_XoLUOOL",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:36.030Z",
+      "auditd": {
+        "sequence": 192588,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "181.28.191.54",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "181.28.191.54"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "939",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "181.28.191.54"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NnxUmcBTFzn_XoLYbnr",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:29.217Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "180.76.239.66"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 184427,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26172"
+      },
+      "source": {
+        "ip": "180.76.239.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dnxUmcBTFzn_XoLYbnr",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:29.218Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26172",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "180.76.239.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "180.76.239.66"
+          }
+        },
+        "sequence": 184428,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tnxUmcBTFzn_XoLYbnr",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:29.430Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184429,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "180.76.239.66",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "180.76.239.66",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26172",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "180.76.239.66"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "H9nxUmcBTFzn_XoLY7rL",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:29.694Z",
+      "process": {
+        "pid": "30475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.43.198"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44252,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.43.198",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INnxUmcBTFzn_XoLY7rL",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:29.694Z",
+      "source": {
+        "ip": "164.132.43.198"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.43.198",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44253,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30475",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "IdnxUmcBTFzn_XoLY7rL",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:29.798Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.43.198"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "164.132.43.198",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "164.132.43.198",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44254
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LtnwUmcBTFzn_XoL5q-R",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:57.636Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32583"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186578,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "L9nwUmcBTFzn_XoL5q-R",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:57.638Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186579
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32583",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MNnwUmcBTFzn_XoL5q-R",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:57.669Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186580
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32583",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctnyUmcBTFzn_XoLDsgI",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:13.278Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32591"
+      },
+      "source": {
+        "ip": "182.61.32.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186581,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "182.61.32.147"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9nyUmcBTFzn_XoLDsgI",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:13.279Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "182.61.32.147",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186582,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32591"
+      },
+      "source": {
+        "ip": "182.61.32.147"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNnyUmcBTFzn_XoLDsgI",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:13.485Z",
+      "source": {
+        "ip": "182.61.32.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186583,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "182.61.32.147"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "182.61.32.147",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32591"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9nyUmcBTFzn_XoLLcvi",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:21.431Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186584,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32593"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNnyUmcBTFzn_XoLLcvi",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:21.432Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          }
+        },
+        "sequence": 186585,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32593",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdnyUmcBTFzn_XoLLcvi",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:21.462Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186586,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32593",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdnxUmcBTFzn_XoL1sT3",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:59.181Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "201.155.38.30"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "201.155.38.30"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 192580,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NtnxUmcBTFzn_XoL1sT3",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:59.183Z",
+      "source": {
+        "ip": "201.155.38.30"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "201.155.38.30",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 192581,
+        "result": "fail"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "924",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9nxUmcBTFzn_XoL1sT3",
+    "source": {
+      "@timestamp": "2018-11-27T02:13:59.755Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.155.38.30"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "201.155.38.30"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "201.155.38.30"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192582,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9nxUmcBTFzn_XoL58U9",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:03.342Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13001"
+      },
+      "source": {
+        "ip": "137.74.199.177"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43235,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "137.74.199.177"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNnxUmcBTFzn_XoL58U9",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:03.342Z",
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13001",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "137.74.199.177"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43236,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "137.74.199.177",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdnxUmcBTFzn_XoL58U9",
+    "source": {
+      "@timestamp": "2018-11-27T02:14:03.458Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "137.74.199.177",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "137.74.199.177",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43237,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13001"
+      },
+      "source": {
+        "ip": "137.74.199.177"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jNnzUmcBTFzn_XoLLeBy",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:26.857Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "937",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "190.0.10.138",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192583,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jdnzUmcBTFzn_XoLLeBy",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:26.858Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "937",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "190.0.10.138"
+          }
+        },
+        "sequence": 192584,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jtnzUmcBTFzn_XoLLeBy",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:26.950Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "937",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "190.0.10.138"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "190.0.10.138",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192585
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9nzUmcBTFzn_XoLXeXh",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:39.252Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "142.93.18.15"
+          }
+        },
+        "sequence": 44255,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30517",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.18.15"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNnzUmcBTFzn_XoLXeXh",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:39.252Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30517",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.18.15"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "142.93.18.15",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44256
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "odnzUmcBTFzn_XoLXeXh",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:39.292Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30517",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.18.15"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "142.93.18.15",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44257,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "142.93.18.15",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Utr3UmcBTFzn_XoLVD0D",
+    "source": {
+      "@timestamp": "2018-11-27T02:19:58.873Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "164.132.197.108",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 184439,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26214",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "U9r3UmcBTFzn_XoLVD0D",
+    "source": {
+      "@timestamp": "2018-11-27T02:19:58.874Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26214",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.197.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184440
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNr3UmcBTFzn_XoLVD0D",
+    "source": {
+      "@timestamp": "2018-11-27T02:19:58.986Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "164.132.197.108"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "164.132.197.108",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184441,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26214",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.197.108"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltr3UmcBTFzn_XoLWD2x",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:00.071Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32625",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186602,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l9r3UmcBTFzn_XoLWD2x",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:00.072Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186603,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32625",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mNr3UmcBTFzn_XoLWD2x",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:00.103Z",
+      "process": {
+        "pid": "32625",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186604,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "htr4UmcBTFzn_XoLpVlZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:25.223Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "37.195.105.57"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43262,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13059",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.195.105.57"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9r4UmcBTFzn_XoLpVlZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:25.227Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13059",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.195.105.57"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.195.105.57",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43263,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNr4UmcBTFzn_XoLpVlZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:25.431Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13059",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.195.105.57"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "sequence": 43264,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "37.195.105.57",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "37.195.105.57",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idr4UmcBTFzn_XoLpVnm",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:25.372Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32633"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186605,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "itr4UmcBTFzn_XoLpVnm",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:25.373Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186606,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32633",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "i9r4UmcBTFzn_XoLpVnm",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:25.404Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32633",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186607,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6Nr4UmcBTFzn_XoL4l6d",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:40.914Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "20001",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.62.233.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142431,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "82.62.233.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dr4UmcBTFzn_XoL4l6d",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:40.915Z",
+      "process": {
+        "pid": "20001",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "82.62.233.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "82.62.233.163",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142432,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tr4UmcBTFzn_XoL4l6d",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:41.064Z",
+      "source": {
+        "ip": "82.62.233.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "82.62.233.163"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "82.62.233.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142433,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20001",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xtr5UmcBTFzn_XoL9Ha7",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:51.088Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32641"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186608,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9r5UmcBTFzn_XoL9Ha7",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:51.090Z",
+      "auditd": {
+        "sequence": 186609,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32641",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNr5UmcBTFzn_XoL9Ha7",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:51.120Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32641",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186610,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZNr5UmcBTFzn_XoL03NO",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:42.532Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "104.248.11.46",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 192601
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "986",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.11.46"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Zdr5UmcBTFzn_XoL03NO",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:42.533Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "986"
+      },
+      "source": {
+        "ip": "104.248.11.46"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.248.11.46",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192602
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ztr5UmcBTFzn_XoL03NO",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:42.564Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "986"
+      },
+      "source": {
+        "ip": "104.248.11.46"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "104.248.11.46",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.248.11.46",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192603,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xdr5UmcBTFzn_XoL23R3",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:44.622Z",
+      "source": {
+        "ip": "91.67.54.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "91.67.54.251"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192604,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "988",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xtr5UmcBTFzn_XoL23R3",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:44.623Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "988",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.67.54.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "sequence": 192605,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.67.54.251",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9r5UmcBTFzn_XoL23R3",
+    "source": {
+      "@timestamp": "2018-11-27T02:22:44.754Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "988",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.67.54.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "91.67.54.251"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "91.67.54.251",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192606,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INr4UmcBTFzn_XoLPlHT",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:58.980Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30623"
+      },
+      "source": {
+        "ip": "35.189.59.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "35.189.59.154",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44267,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Idr4UmcBTFzn_XoLPlHT",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:58.980Z",
+      "source": {
+        "ip": "35.189.59.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "35.189.59.154"
+          }
+        },
+        "sequence": 44268,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30623",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Itr4UmcBTFzn_XoLPlHT",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:59.156Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "35.189.59.154",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "35.189.59.154",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44269
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30623",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "35.189.59.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7Nr3UmcBTFzn_XoLyEYO",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:28.574Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30616"
+      },
+      "source": {
+        "ip": "91.196.149.76"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44264,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.196.149.76",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7dr3UmcBTFzn_XoLyEYO",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:28.574Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "91.196.149.76",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44265,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30616"
+      },
+      "source": {
+        "ip": "91.196.149.76"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tr3UmcBTFzn_XoLyEYO",
+    "source": {
+      "@timestamp": "2018-11-27T02:20:28.710Z",
+      "process": {
+        "pid": "30616",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.196.149.76"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "91.196.149.76"
+        },
+        "summary": {
+          "object": {
+            "secondary": "91.196.149.76",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 44266,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "str3UmcBTFzn_XoLOzru",
+    "source": {
+      "@timestamp": "2018-11-27T02:19:52.704Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13051",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.38.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43259,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "193.70.38.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "s9r3UmcBTFzn_XoLOzru",
+    "source": {
+      "@timestamp": "2018-11-27T02:19:52.704Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "13051",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.38.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "193.70.38.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43260,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tNr3UmcBTFzn_XoLOzru",
+    "source": {
+      "@timestamp": "2018-11-27T02:19:52.820Z",
+      "process": {
+        "pid": "13051",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.38.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "193.70.38.229"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "193.70.38.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43261,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "O9r9UmcBTFzn_XoL4syL",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:08.552Z",
+      "source": {
+        "ip": "150.95.110.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "150.95.110.147",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43265,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "13101",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PNr9UmcBTFzn_XoL4syL",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:08.552Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13101",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "150.95.110.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "150.95.110.147",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43266
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Pdr9UmcBTFzn_XoL4syL",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:08.760Z",
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "150.95.110.147"
+        },
+        "summary": {
+          "object": {
+            "secondary": "150.95.110.147",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43267,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13101"
+      },
+      "source": {
+        "ip": "150.95.110.147"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5tr9UmcBTFzn_XoL7Mz5",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:11.246Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186617,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32666"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59r9UmcBTFzn_XoL7Mz5",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:11.247Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32666"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186618,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6Nr9UmcBTFzn_XoL7Mz5",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:11.279Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32666",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186619,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtr7UmcBTFzn_XoLqZv2",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:43.020Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "134.175.33.189"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142434
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20021",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "134.175.33.189"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9r7UmcBTFzn_XoLqZv2",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:43.021Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "134.175.33.189",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142435,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20021",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "134.175.33.189"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNr7UmcBTFzn_XoLqZv2",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:43.229Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142436,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "134.175.33.189",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "134.175.33.189",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20021"
+      },
+      "source": {
+        "ip": "134.175.33.189"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9r7UmcBTFzn_XoLRZIS",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:17.192Z",
+      "process": {
+        "pid": "32649",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186611,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WNr7UmcBTFzn_XoLRZIS",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:17.193Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186612,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32649",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Wdr7UmcBTFzn_XoLRZIS",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:17.223Z",
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32649",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186613,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tdr8UmcBTFzn_XoLmK-a",
+    "source": {
+      "@timestamp": "2018-11-27T02:25:44.112Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186614
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32658",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ttr8UmcBTFzn_XoLmK-a",
+    "source": {
+      "@timestamp": "2018-11-27T02:25:44.114Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186615,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32658"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "t9r8UmcBTFzn_XoLmK-a",
+    "source": {
+      "@timestamp": "2018-11-27T02:25:44.144Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186616
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32658",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Kdr8UmcBTFzn_XoL8rcs",
+    "source": {
+      "@timestamp": "2018-11-27T02:26:07.005Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1003",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.12.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "144.217.12.168",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 192607,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ktr8UmcBTFzn_XoL8rcs",
+    "source": {
+      "@timestamp": "2018-11-27T02:26:07.006Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1003",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.12.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "144.217.12.168",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192608
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9r8UmcBTFzn_XoL8rcs",
+    "source": {
+      "@timestamp": "2018-11-27T02:26:07.048Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1003",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.12.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "144.217.12.168",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "144.217.12.168",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192609
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dr7UmcBTFzn_XoLa5XB",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:27.095Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26248",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.138.6.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.138.6.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184442,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tr7UmcBTFzn_XoLa5XB",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:27.096Z",
+      "process": {
+        "pid": "26248",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.138.6.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184443,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.138.6.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69r7UmcBTFzn_XoLa5XB",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:27.306Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26248",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.138.6.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "159.138.6.50",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "159.138.6.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184444,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mdr9UmcBTFzn_XoLS7_z",
+    "source": {
+      "@timestamp": "2018-11-27T02:26:30.024Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.228.67",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192610,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1010",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mtr9UmcBTFzn_XoLS7_z",
+    "source": {
+      "@timestamp": "2018-11-27T02:26:30.025Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1010",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "178.33.228.67",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192611,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "m9r9UmcBTFzn_XoLS7_z",
+    "source": {
+      "@timestamp": "2018-11-27T02:26:30.133Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "178.33.228.67",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.33.228.67",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192612,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1010"
+      },
+      "source": {
+        "ip": "178.33.228.67"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Gdr-UmcBTFzn_XoLHdFd",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:23.630Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "213.34.172.74",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44273
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30753"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "213.34.172.74"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Gtr-UmcBTFzn_XoLHdFd",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:23.634Z",
+      "source": {
+        "ip": "213.34.172.74"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "213.34.172.74",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44274
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30753"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9r-UmcBTFzn_XoLHdFd",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:23.758Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30753",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "213.34.172.74"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44275,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "213.34.172.74",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "213.34.172.74",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "o9r7UmcBTFzn_XoLJpB1",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:09.351Z",
+      "process": {
+        "pid": "30690",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "175.205.114.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "175.205.114.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44270
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pNr7UmcBTFzn_XoLJpB1",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:09.351Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "175.205.114.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44271,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30690",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "175.205.114.52"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pdr7UmcBTFzn_XoLJpB1",
+    "source": {
+      "@timestamp": "2018-11-27T02:24:09.523Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "175.205.114.52"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "175.205.114.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44272
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30690"
+      },
+      "source": {
+        "ip": "175.205.114.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3NsDU2cBTFzn_XoLlEgC",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:21.687Z",
+      "auditd": {
+        "sequence": 186632,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "92.86.47.26",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "92.86.47.26"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32702",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "92.86.47.26"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9sDU2cBTFzn_XoLmUlp",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:23.071Z",
+      "auditd": {
+        "sequence": 192616,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "145.239.137.89"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1048"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "145.239.137.89"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNsDU2cBTFzn_XoLmUlp",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:23.072Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1048",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "145.239.137.89"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "145.239.137.89",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192617
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bdsDU2cBTFzn_XoLmUlp",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:23.187Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "145.239.137.89",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "145.239.137.89"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192618,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1048",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "145.239.137.89"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "f9sDU2cBTFzn_XoLp0rb",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:26.769Z",
+      "auditd": {
+        "sequence": 142437,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "115.113.54.122",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "20065",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.113.54.122"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNsDU2cBTFzn_XoLp0rb",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:26.771Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "115.113.54.122",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142438,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "20065",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.113.54.122"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdsDU2cBTFzn_XoLp0rb",
+    "source": {
+      "@timestamp": "2018-11-27T02:33:27.053Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20065",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.113.54.122"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "115.113.54.122",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "115.113.54.122",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142439,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9sGU2cBTFzn_XoLiIku",
+    "source": {
+      "@timestamp": "2018-11-27T02:36:35.268Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26335",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.59.9.162"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "37.59.9.162"
+          }
+        },
+        "sequence": 184445
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNsGU2cBTFzn_XoLiIku",
+    "source": {
+      "@timestamp": "2018-11-27T02:36:35.269Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26335"
+      },
+      "source": {
+        "ip": "37.59.9.162"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "37.59.9.162"
+          }
+        },
+        "sequence": 184446
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdsGU2cBTFzn_XoLiIku",
+    "source": {
+      "@timestamp": "2018-11-27T02:36:35.380Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26335",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.59.9.162"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "37.59.9.162",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184447,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "37.59.9.162",
+          "terminal": "ssh"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "uNsFU2cBTFzn_XoLNGx8",
+    "source": {
+      "@timestamp": "2018-11-27T02:35:08.305Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "81.174.25.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "81.174.25.52"
+          }
+        },
+        "sequence": 192619
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1062",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "udsFU2cBTFzn_XoLNGx8",
+    "source": {
+      "@timestamp": "2018-11-27T02:35:08.307Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1062",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.25.52"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192620,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "81.174.25.52"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "utsFU2cBTFzn_XoLNGx8",
+    "source": {
+      "@timestamp": "2018-11-27T02:35:08.440Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "81.174.25.52"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "81.174.25.52",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192621
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1062",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.25.52"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yNsFU2cBTFzn_XoLA2fV",
+    "source": {
+      "@timestamp": "2018-11-27T02:34:55.845Z",
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "74.208.43.208",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44282,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30899"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ydsFU2cBTFzn_XoLA2fV",
+    "source": {
+      "@timestamp": "2018-11-27T02:34:55.849Z",
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "74.208.43.208",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44283,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30899",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytsFU2cBTFzn_XoLA2fV",
+    "source": {
+      "@timestamp": "2018-11-27T02:34:55.873Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30899"
+      },
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "74.208.43.208",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "74.208.43.208",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44284
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vNsHU2cBTFzn_XoLOZig",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:20.688Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30953",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "87.249.215.83"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44289,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "87.249.215.83"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vdsHU2cBTFzn_XoLOZig",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:20.688Z",
+      "source": {
+        "ip": "87.249.215.83"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "87.249.215.83",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 44290,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30953"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vtsHU2cBTFzn_XoLOZig",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:20.864Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30953",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "87.249.215.83"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "87.249.215.83"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "87.249.215.83"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44291,
+        "result": "fail"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MtsEU2cBTFzn_XoLzWOC",
+    "source": {
+      "@timestamp": "2018-11-27T02:34:41.940Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30892",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "175.116.217.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "175.116.217.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44279,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9sEU2cBTFzn_XoLzWOC",
+    "source": {
+      "@timestamp": "2018-11-27T02:34:41.944Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30892",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "175.116.217.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "175.116.217.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44280,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNsEU2cBTFzn_XoLzWOC",
+    "source": {
+      "@timestamp": "2018-11-27T02:34:42.116Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "175.116.217.13"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "175.116.217.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44281,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30892",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "175.116.217.13"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59sHU2cBTFzn_XoLBZOc",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:07.375Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30947",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.55.190.46"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "45.55.190.46"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44286
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NsHU2cBTFzn_XoLBZOc",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:07.375Z",
+      "auditd": {
+        "sequence": 44287,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "45.55.190.46",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30947",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.55.190.46"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dsHU2cBTFzn_XoLBZOc",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:07.407Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "45.55.190.46"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "45.55.190.46",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "45.55.190.46",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44288
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30947",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Y9sGU2cBTFzn_XoL6ZGy",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:00.227Z",
+      "source": {
+        "ip": "103.48.12.177"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44285,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "103.48.12.177",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "103.48.12.177"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30943",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNsJU2cBTFzn_XoLCcBJ",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:19.382Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "167.99.84.229",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43278,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13175",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "167.99.84.229"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdsJU2cBTFzn_XoLCcBJ",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:19.386Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13175"
+      },
+      "source": {
+        "ip": "167.99.84.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43279,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "167.99.84.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JtsJU2cBTFzn_XoLCcBJ",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:19.486Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13175"
+      },
+      "source": {
+        "ip": "167.99.84.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "167.99.84.229",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "167.99.84.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43280,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9sJU2cBTFzn_XoLCcCX",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:19.468Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.223.28.0",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184454,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26405",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.223.28.0"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNsJU2cBTFzn_XoLCcCX",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:19.469Z",
+      "source": {
+        "ip": "89.223.28.0"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.223.28.0",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184455
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26405",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdsJU2cBTFzn_XoLCcCX",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:19.630Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26405"
+      },
+      "source": {
+        "ip": "89.223.28.0"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "89.223.28.0",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "89.223.28.0",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184456,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7dsJU2cBTFzn_XoLVsZ3",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:39.149Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.166.58.40",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192640,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1141",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.166.58.40"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tsJU2cBTFzn_XoLVsZ3",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:39.150Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.166.58.40",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192641,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1141",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.166.58.40"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79sJU2cBTFzn_XoLVsZ3",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:39.256Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1141"
+      },
+      "source": {
+        "ip": "188.166.58.40"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "188.166.58.40",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "188.166.58.40",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192642
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtsJU2cBTFzn_XoLWMfm",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:39.771Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.59.171.172",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44295
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31024",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.171.172"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9sJU2cBTFzn_XoLWMfm",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:39.771Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31024",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.171.172"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "139.59.171.172"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44296,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNsJU2cBTFzn_XoLWMfm",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:39.863Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31024",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.171.172"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "139.59.171.172",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "139.59.171.172"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44297,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNsIU2cBTFzn_XoLc7MQ",
+    "source": {
+      "@timestamp": "2018-11-27T02:38:40.934Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1086"
+      },
+      "source": {
+        "ip": "139.99.168.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.99.168.192",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192628,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HdsIU2cBTFzn_XoLc7MQ",
+    "source": {
+      "@timestamp": "2018-11-27T02:38:40.935Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1086",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.99.168.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "139.99.168.192"
+          }
+        },
+        "sequence": 192629,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HtsIU2cBTFzn_XoLc7MQ",
+    "source": {
+      "@timestamp": "2018-11-27T02:38:41.215Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "139.99.168.192",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "139.99.168.192",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192630,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1086",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.99.168.192"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "nNsJU2cBTFzn_XoLTcVS",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:36.808Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1139",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "52.60.179.151"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "52.60.179.151",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192637,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ndsJU2cBTFzn_XoLTcVS",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:36.809Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "52.60.179.151",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192638,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1139",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "52.60.179.151"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntsJU2cBTFzn_XoLTcVS",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:36.855Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "52.60.179.151"
+        },
+        "summary": {
+          "object": {
+            "secondary": "52.60.179.151",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192639,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1139",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "52.60.179.151"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNsHU2cBTFzn_XoLr6LF",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:50.939Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1076",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.114.136"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.187.114.136",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 192622
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdsHU2cBTFzn_XoLr6LF",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:50.940Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "37.187.114.136",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192623
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1076",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.114.136"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stsHU2cBTFzn_XoLr6LF",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:51.046Z",
+      "auditd": {
+        "sequence": 192624,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "37.187.114.136",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "37.187.114.136"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1076",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.114.136"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9sIU2cBTFzn_XoLPq6w",
+    "source": {
+      "@timestamp": "2018-11-27T02:38:27.526Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1084",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "85.214.81.104"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "85.214.81.104",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192625,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNsIU2cBTFzn_XoLPq6w",
+    "source": {
+      "@timestamp": "2018-11-27T02:38:27.527Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "85.214.81.104"
+          }
+        },
+        "sequence": 192626,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1084",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "85.214.81.104"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdsIU2cBTFzn_XoLPq6w",
+    "source": {
+      "@timestamp": "2018-11-27T02:38:27.644Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1084"
+      },
+      "source": {
+        "ip": "85.214.81.104"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "85.214.81.104",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "85.214.81.104",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 192627,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9sJU2cBTFzn_XoLm8zp",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:56.927Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "13.66.193.177",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186633,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "32736",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "13.66.193.177"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONsJU2cBTFzn_XoLm8zp",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:56.928Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "13.66.193.177",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186634,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32736",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "13.66.193.177"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdsJU2cBTFzn_XoLm8zp",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:56.989Z",
+      "source": {
+        "ip": "13.66.193.177"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186635,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "13.66.193.177"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "13.66.193.177"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "32736",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "btsHU2cBTFzn_XoLaZwR",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:32.833Z",
+      "source": {
+        "ip": "36.67.135.42"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "36.67.135.42",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44292
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30958"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "b9sHU2cBTFzn_XoLaZwR",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:32.837Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30958"
+      },
+      "source": {
+        "ip": "36.67.135.42"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "36.67.135.42",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44293
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNsHU2cBTFzn_XoLaZwR",
+    "source": {
+      "@timestamp": "2018-11-27T02:37:33.045Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44294,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "36.67.135.42",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "36.67.135.42",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30958",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "36.67.135.42"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNsIU2cBTFzn_XoLwbmn",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.052Z",
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184448
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26360",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XdsIU2cBTFzn_XoLwbmn",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.052Z",
+      "process": {
+        "pid": "26360",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184449,
+        "result": "success"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XtsIU2cBTFzn_XoLwbmn",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.054Z",
+      "process": {
+        "pid": "26360",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:session_open",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184451,
+        "result": "success",
+        "session": "9862"
+      },
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X9sIU2cBTFzn_XoLwbmn",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.154Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "26360",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9862",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184452,
+        "result": "success"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNsIU2cBTFzn_XoLwbmn",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.156Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "uid": "root",
+          "auid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26360",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        },
+        "sequence": 184453,
+        "result": "success",
+        "session": "9862"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9sIU2cBTFzn_XoLwrlb",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.233Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1088",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192631,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:accounting",
+          "acct": "root"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNsIU2cBTFzn_XoLwrlb",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.234Z",
+      "event": {
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "1088",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192632,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddsIU2cBTFzn_XoLwrlb",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.235Z",
+      "user": {
+        "auid": "0",
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1088",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9866",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192634,
+        "result": "success"
+      },
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dtsIU2cBTFzn_XoLwrlb",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.327Z",
+      "user": {
+        "auid": "0",
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "1088"
+      },
+      "auditd": {
+        "session": "9866",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192635,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "d9sIU2cBTFzn_XoLwrlb",
+    "source": {
+      "@timestamp": "2018-11-27T02:39:01.327Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "9866",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_close"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192636,
+        "result": "success"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1088",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ndwMU2cBTFzn_XoLNAWN",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:47.067Z",
+      "source": {
+        "ip": "107.170.76.170"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.76.170",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 43284,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13197",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntwMU2cBTFzn_XoLNAWN",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:47.071Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13197",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "107.170.76.170"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.76.170",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43285,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9wMU2cBTFzn_XoLNAWN",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:47.107Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.76.170",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.76.170",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43286,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13197"
+      },
+      "source": {
+        "ip": "107.170.76.170"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NwMU2cBTFzn_XoLOwZZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:48.812Z",
+      "event": {
+        "category": "configuration",
+        "type": "netfilter_cfg",
+        "action": "loaded-firewall-rule-to",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "sgid": "0",
+        "name_map": {
+          "egid": "root",
+          "euid": "root",
+          "fsgid": "root",
+          "fsuid": "root",
+          "gid": "root",
+          "sgid": "root",
+          "suid": "root",
+          "uid": "root"
+        },
+        "gid": "0",
+        "suid": "0",
+        "fsuid": "0",
+        "egid": "0",
+        "uid": "0",
+        "auid": "unset",
+        "euid": "0",
+        "fsgid": "0"
+      },
+      "process": {
+        "exe": "/sbin/xtables-multi",
+        "pid": "13199",
+        "ppid": "1379",
+        "title": "/sbin/iptables -w -D sshguard -s 147.135.208.7 -j DROP",
+        "name": "iptables"
+      },
+      "auditd": {
+        "data": {
+          "table": "filter",
+          "tty": "(none)",
+          "family": "2",
+          "a1": "0",
+          "exit": "0",
+          "a3": "1666870",
+          "syscall": "setsockopt",
+          "a2": "40",
+          "arch": "x86_64",
+          "a0": "5",
+          "entries": "155"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "firewall",
+            "primary": "filter"
+          },
+          "how": "/sbin/xtables-multi"
+        },
+        "sequence": 43287,
+        "result": "success",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WdwMU2cBTFzn_XoLRgdH",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:51.613Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "84.19.176.196",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184460
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26436",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "84.19.176.196"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WtwMU2cBTFzn_XoLRgdH",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:51.614Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26436",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "84.19.176.196"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184461,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "84.19.176.196",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9wMU2cBTFzn_XoLRgdH",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:51.728Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "84.19.176.196"
+          }
+        },
+        "sequence": 184462,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "84.19.176.196"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26436",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "84.19.176.196"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdwMU2cBTFzn_XoLSQex",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:52.477Z",
+      "process": {
+        "pid": "20119",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "58.97.13.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "58.97.13.206"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142443,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtwMU2cBTFzn_XoLSQex",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:52.479Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "20119",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "58.97.13.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "58.97.13.206",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142444,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9wMU2cBTFzn_XoLSQex",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:52.702Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "58.97.13.206",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "58.97.13.206",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142445,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20119",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "58.97.13.206"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qdwMU2cBTFzn_XoLVwgF",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:55.899Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "45.55.239.241",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 142446
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20121",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.55.239.241"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtwMU2cBTFzn_XoLVwgF",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:55.899Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20121",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.55.239.241"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "45.55.239.241",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 142447
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9wMU2cBTFzn_XoLVwgF",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:55.930Z",
+      "source": {
+        "ip": "45.55.239.241"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "45.55.239.241"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "45.55.239.241",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142448,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20121"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdsLU2cBTFzn_XoLffYn",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:00.124Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.131.124.166",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184457,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26431",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.124.166"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JtsLU2cBTFzn_XoLffYn",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:00.125Z",
+      "process": {
+        "pid": "26431",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.124.166"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184458,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.131.124.166",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9sLU2cBTFzn_XoLffYn",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:00.158Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26431"
+      },
+      "source": {
+        "ip": "104.131.124.166"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184459,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "104.131.124.166",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "104.131.124.166",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNwMU2cBTFzn_XoLDAJ2",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:36.811Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "202.28.34.200"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142440,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CdwMU2cBTFzn_XoLDAJ2",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:36.812Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "202.28.34.200",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 142441
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtwMU2cBTFzn_XoLDAJ2",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:37.043Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "202.28.34.200",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142442,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "202.28.34.200",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtwMU2cBTFzn_XoLKwWd",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:44.787Z",
+      "source": {
+        "ip": "103.249.205.78"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186639,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "103.249.205.78"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32752"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Q9wMU2cBTFzn_XoLKwWd",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:44.788Z",
+      "source": {
+        "ip": "103.249.205.78"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "103.249.205.78",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186640
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32752",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RNwMU2cBTFzn_XoLKwWd",
+    "source": {
+      "@timestamp": "2018-11-27T02:42:45.017Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "103.249.205.78",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186641,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "103.249.205.78"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32752",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.249.205.78"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "btsKU2cBTFzn_XoL6ul0",
+    "source": {
+      "@timestamp": "2018-11-27T02:41:22.569Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1149"
+      },
+      "source": {
+        "ip": "149.56.15.98"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "149.56.15.98",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192643,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "b9sKU2cBTFzn_XoL6ul0",
+    "source": {
+      "@timestamp": "2018-11-27T02:41:22.571Z",
+      "source": {
+        "ip": "149.56.15.98"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192644,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "149.56.15.98",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1149",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNsKU2cBTFzn_XoL6ul0",
+    "source": {
+      "@timestamp": "2018-11-27T02:41:22.613Z",
+      "source": {
+        "ip": "149.56.15.98"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192645,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "149.56.15.98"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "149.56.15.98",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1149",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99sKU2cBTFzn_XoLJtjT",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:32.489Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32738"
+      },
+      "source": {
+        "ip": "37.59.183.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.59.183.21",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186636
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NsKU2cBTFzn_XoLJtjT",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:32.490Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32738",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.59.183.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186637,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "37.59.183.21"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dsKU2cBTFzn_XoLJtjT",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:32.600Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "37.59.183.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186638,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "37.59.183.21"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32738",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.59.183.21"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dsKU2cBTFzn_XoLCtYx",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:25.154Z",
+      "process": {
+        "pid": "31052",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.237.238"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.248.237.238"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44298,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tsKU2cBTFzn_XoLCtYx",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:25.158Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31052",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.237.238"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.248.237.238",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44299,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69sKU2cBTFzn_XoLCtYx",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:25.190Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31052"
+      },
+      "source": {
+        "ip": "104.248.237.238"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "104.248.237.238"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44300,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "104.248.237.238",
+          "terminal": "ssh"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TtsKU2cBTFzn_XoLcN9z",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:51.334Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13183",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "191.255.248.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "191.255.248.91"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43281
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "T9sKU2cBTFzn_XoLcN9z",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:51.334Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "191.255.248.91",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43282
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13183"
+      },
+      "source": {
+        "ip": "191.255.248.91"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UNsKU2cBTFzn_XoLcN9z",
+    "source": {
+      "@timestamp": "2018-11-27T02:40:51.490Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13183",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "191.255.248.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43283,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "191.255.248.91"
+        },
+        "summary": {
+          "object": {
+            "secondary": "191.255.248.91",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "O90YU2cBTFzn_XoLthfG",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:26.843Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "212.46.209.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192667
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1253"
+      },
+      "source": {
+        "ip": "212.46.209.158"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PN0YU2cBTFzn_XoLthfG",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:26.844Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "212.46.209.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192668,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1253",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "212.46.209.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Pd0YU2cBTFzn_XoLthfG",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:27.038Z",
+      "source": {
+        "ip": "212.46.209.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "212.46.209.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192669,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "212.46.209.158"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1253"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Wd0YU2cBTFzn_XoLuRey",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:27.592Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20207",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "212.89.171.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "212.89.171.146",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142463,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Wt0YU2cBTFzn_XoLuRey",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:27.593Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "212.89.171.146",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142464
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20207",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "212.89.171.146"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W90YU2cBTFzn_XoLuRey",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:27.731Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20207"
+      },
+      "source": {
+        "ip": "212.89.171.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142465,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "212.89.171.146"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "212.89.171.146",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UN0ZU2cBTFzn_XoLKSHH",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:56.285Z",
+      "auditd": {
+        "sequence": 184490,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "193.70.85.206",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26545",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.85.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ud0ZU2cBTFzn_XoLKSHH",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:56.286Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "193.70.85.206"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184491,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26545",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.85.206"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ut0ZU2cBTFzn_XoLKSHH",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:56.392Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26545",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.85.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184492,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "193.70.85.206",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "secondary": "193.70.85.206",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0t0ZU2cBTFzn_XoL6TKj",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:45.401Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26553",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.36.221.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.36.221.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184493,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "090ZU2cBTFzn_XoL6TKj",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:45.402Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.36.221.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 184494,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26553",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.36.221.229"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1N0ZU2cBTFzn_XoL6TKj",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:45.502Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26553",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.36.221.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184495,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "89.36.221.229"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "89.36.221.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "f90YU2cBTFzn_XoL-B3u",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:43.779Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26542",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.111.27"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.68.111.27",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184487,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gN0YU2cBTFzn_XoL-B3u",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:43.781Z",
+      "auditd": {
+        "sequence": 184488,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.68.111.27",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26542",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "138.68.111.27"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gd0YU2cBTFzn_XoL-B3u",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:43.889Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184489,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "138.68.111.27",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "138.68.111.27",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26542",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.111.27"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YN0ZU2cBTFzn_XoLMCE9",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:57.939Z",
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "5.39.77.167",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192670,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1261"
+      },
+      "source": {
+        "ip": "5.39.77.167"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Yd0ZU2cBTFzn_XoLMCE9",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:57.940Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "5.39.77.167",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 192671,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1261"
+      },
+      "source": {
+        "ip": "5.39.77.167"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Yt0ZU2cBTFzn_XoLMCE9",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:58.047Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192672,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "5.39.77.167",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "5.39.77.167",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1261",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "5.39.77.167"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yN0YU2cBTFzn_XoLnBVF",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:20.058Z",
+      "source": {
+        "ip": "189.16.195.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "189.16.195.18"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192664
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1251",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yd0YU2cBTFzn_XoLnBVF",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:20.060Z",
+      "process": {
+        "pid": "1251",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "189.16.195.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "189.16.195.18",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192665,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yt0YU2cBTFzn_XoLnBVF",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:20.223Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1251"
+      },
+      "source": {
+        "ip": "189.16.195.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192666,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "189.16.195.18",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "189.16.195.18",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ld0YU2cBTFzn_XoL6hym",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:40.122Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "157.100.133.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43303,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13281",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "157.100.133.21"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lt0YU2cBTFzn_XoL6hym",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:40.122Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13281",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "157.100.133.21"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "157.100.133.21",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43304,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l90YU2cBTFzn_XoL6hym",
+    "source": {
+      "@timestamp": "2018-11-27T02:56:40.242Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "157.100.133.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43305,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "157.100.133.21"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13281",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "157.100.133.21"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wt0ZU2cBTFzn_XoLqiw3",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:29.161Z",
+      "source": {
+        "ip": "37.59.62.23"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "37.59.62.23",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44318
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31535",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "w90ZU2cBTFzn_XoLqiw3",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:29.161Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31535",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.59.62.23"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.59.62.23",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44319
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xN0ZU2cBTFzn_XoLqiw3",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:29.269Z",
+      "source": {
+        "ip": "37.59.62.23"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "37.59.62.23",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 44320,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "37.59.62.23",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31535",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ld0ZU2cBTFzn_XoLxC9z",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:35.874Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/lib/systemd/systemd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "apt-daily",
+            "type": "service"
+          }
+        },
+        "sequence": 43306,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "unit": "apt-daily"
+        }
+      },
+      "event": {
+        "category": "system-services",
+        "type": "service_start",
+        "action": "started-service",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1",
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Lt0ZU2cBTFzn_XoLxC9z",
+    "source": {
+      "@timestamp": "2018-11-27T02:57:35.874Z",
+      "event": {
+        "category": "system-services",
+        "type": "service_stop",
+        "action": "stopped-service",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1",
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "apt-daily",
+            "type": "service"
+          },
+          "how": "/lib/systemd/systemd"
+        },
+        "sequence": 43307,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "unit": "apt-daily"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p893UmcBTFzn_XoLs0bb",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:34.801Z",
+      "process": {
+        "pid": "19147",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.35.110.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "200.35.110.58",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142246,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qM93UmcBTFzn_XoLs0bb",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:34.802Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "200.35.110.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142247,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19147",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.35.110.58"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qc93UmcBTFzn_XoLs0bb",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:34.906Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "200.35.110.58"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142248,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "200.35.110.58",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19147",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "200.35.110.58"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Lc97UmcBTFzn_XoLKpLT",
+    "source": {
+      "@timestamp": "2018-11-27T00:04:21.865Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31749"
+      },
+      "source": {
+        "ip": "164.132.112.233"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.112.233",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186182,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ls97UmcBTFzn_XoLKpLT",
+    "source": {
+      "@timestamp": "2018-11-27T00:04:21.866Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31749",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.112.233"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186183,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.112.233",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "L897UmcBTFzn_XoLKpLT",
+    "source": {
+      "@timestamp": "2018-11-27T00:04:21.973Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "164.132.112.233"
+          }
+        },
+        "sequence": 186184,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "164.132.112.233",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31749"
+      },
+      "source": {
+        "ip": "164.132.112.233"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "o894UmcBTFzn_XoLA00h",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:55.095Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.198.120.32",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192390,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31971",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.198.120.32"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pM94UmcBTFzn_XoLA00h",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:55.096Z",
+      "auditd": {
+        "sequence": 192391,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.198.120.32",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31971"
+      },
+      "source": {
+        "ip": "139.198.120.32"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pc94UmcBTFzn_XoLA00h",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:55.269Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "31971",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.198.120.32"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "139.198.120.32"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "139.198.120.32",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192392
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "eM95UmcBTFzn_XoLP2hD",
+    "source": {
+      "@timestamp": "2018-11-27T00:02:15.998Z",
+      "source": {
+        "ip": "106.12.29.232"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192393,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "106.12.29.232",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31979",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ec95UmcBTFzn_XoLP2hD",
+    "source": {
+      "@timestamp": "2018-11-27T00:02:15.999Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31979"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "106.12.29.232"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "106.12.29.232",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192394
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "es95UmcBTFzn_XoLP2hD",
+    "source": {
+      "@timestamp": "2018-11-27T00:02:16.292Z",
+      "source": {
+        "ip": "106.12.29.232"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "106.12.29.232"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "106.12.29.232",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192395
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31979",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PM99UmcBTFzn_XoLjscA",
+    "source": {
+      "@timestamp": "2018-11-27T00:06:58.326Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.37.154.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186188,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31766",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.154.254"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Pc99UmcBTFzn_XoLjscA",
+    "source": {
+      "@timestamp": "2018-11-27T00:06:58.327Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31766",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.154.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "54.37.154.254",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186189
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ps99UmcBTFzn_XoLjscA",
+    "source": {
+      "@timestamp": "2018-11-27T00:06:58.438Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "54.37.154.254"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "54.37.154.254"
+          }
+        },
+        "sequence": 186190
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31766",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.154.254"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cM95UmcBTFzn_XoLKGaD",
+    "source": {
+      "@timestamp": "2018-11-27T00:02:10.186Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31740",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.24.100.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186179,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.24.100.205",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cc95UmcBTFzn_XoLKGaD",
+    "source": {
+      "@timestamp": "2018-11-27T00:02:10.188Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31740",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.24.100.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.24.100.205",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186180,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cs95UmcBTFzn_XoLKGaD",
+    "source": {
+      "@timestamp": "2018-11-27T00:02:10.392Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31740",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.24.100.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "211.24.100.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186181,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "211.24.100.205"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hs93UmcBTFzn_XoLcEF7",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:17.552Z",
+      "source": {
+        "ip": "142.93.210.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "142.93.210.90"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192387,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31968",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h893UmcBTFzn_XoLcEF7",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:17.552Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31968"
+      },
+      "source": {
+        "ip": "142.93.210.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192388,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "142.93.210.90",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iM93UmcBTFzn_XoLcEF7",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:17.784Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31968"
+      },
+      "source": {
+        "ip": "142.93.210.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "142.93.210.90"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192389,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "142.93.210.90",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "k899UmcBTFzn_XoL6M7W",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:21.573Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "27895",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "174.50.26.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "174.50.26.154",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 44073,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lM99UmcBTFzn_XoL6M7W",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:21.577Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "174.50.26.154",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44074,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "27895",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "174.50.26.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lc99UmcBTFzn_XoL6M7W",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:21.673Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "27895"
+      },
+      "source": {
+        "ip": "174.50.26.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44075,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "174.50.26.154",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "174.50.26.154",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aM97UmcBTFzn_XoL4qJ8",
+    "source": {
+      "@timestamp": "2018-11-27T00:05:08.881Z",
+      "process": {
+        "pid": "31758",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.82.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186185
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ac97UmcBTFzn_XoL4qJ8",
+    "source": {
+      "@timestamp": "2018-11-27T00:05:08.882Z",
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186186,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.82.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31758",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "as97UmcBTFzn_XoL4qJ8",
+    "source": {
+      "@timestamp": "2018-11-27T00:05:08.989Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31758",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186187,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.38.82.60"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "51.38.82.60"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4M99UmcBTFzn_XoLtco1",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:08.363Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31768",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.101.26.63"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "46.101.26.63",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186191
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4c99UmcBTFzn_XoLtco1",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:08.364Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31768",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.101.26.63"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.101.26.63",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186192,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4s99UmcBTFzn_XoLtco1",
+    "source": {
+      "@timestamp": "2018-11-27T00:07:08.463Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31768",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.101.26.63"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186193,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "46.101.26.63"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "46.101.26.63"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_NCBUmcBTFzn_XoLzSMR",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:36.615Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "86.96.203.107",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186212
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31802",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.96.203.107"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dCBUmcBTFzn_XoLzSMR",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:36.616Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31802",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.96.203.107"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "86.96.203.107",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186213,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tCBUmcBTFzn_XoLzSMR",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:36.828Z",
+      "source": {
+        "ip": "86.96.203.107"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "86.96.203.107"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "86.96.203.107",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186214,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31802"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WdCBUmcBTFzn_XoLzyVY",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:37.195Z",
+      "auditd": {
+        "sequence": 43095,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.248.236.32"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12257",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.236.32"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WtCBUmcBTFzn_XoLzyVY",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:37.195Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "12257",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.236.32"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43096,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "104.248.236.32",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9CBUmcBTFzn_XoLzyVY",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:37.223Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43097,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "104.248.236.32",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.248.236.32",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12257",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.236.32"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZNCBUmcBTFzn_XoL0yWS",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:38.280Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "32078",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.26.184"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "91.121.26.184",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192402
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZdCBUmcBTFzn_XoL0yWS",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:38.280Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.121.26.184",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192403,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32078",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.26.184"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtCBUmcBTFzn_XoL0yWS",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:38.388Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32078",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "91.121.26.184"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192404,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "91.121.26.184",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "91.121.26.184",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HtCBUmcBTFzn_XoLJBa0",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:53.514Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19210",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "206.189.183.75"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "206.189.183.75"
+          }
+        },
+        "sequence": 142258,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "H9CBUmcBTFzn_XoLJBa0",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:53.515Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "206.189.183.75"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142259,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19210"
+      },
+      "source": {
+        "ip": "206.189.183.75"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INCBUmcBTFzn_XoLJBa0",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:53.546Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142260,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "206.189.183.75"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "206.189.183.75"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19210",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "206.189.183.75"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9CCUmcBTFzn_XoL5z0B",
+    "source": {
+      "@timestamp": "2018-11-27T00:12:48.790Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19223"
+      },
+      "source": {
+        "ip": "188.166.213.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.166.213.254",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142261,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNCCUmcBTFzn_XoL5z0B",
+    "source": {
+      "@timestamp": "2018-11-27T00:12:48.791Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19223",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.166.213.254"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142262,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.166.213.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adCCUmcBTFzn_XoL5z0B",
+    "source": {
+      "@timestamp": "2018-11-27T00:12:48.985Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19223",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.166.213.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142263,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "188.166.213.254"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "188.166.213.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytCAUmcBTFzn_XoLfAfq",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:10.560Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31792",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "123.136.161.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "123.136.161.146"
+          }
+        },
+        "sequence": 186206,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9CAUmcBTFzn_XoLfAfq",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:10.561Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "123.136.161.146",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186207,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31792",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "123.136.161.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNCAUmcBTFzn_XoLfAfq",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:10.789Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31792",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "123.136.161.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "123.136.161.146"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "123.136.161.146"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186208,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NCBUmcBTFzn_XoLRxhI",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:02.367Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31799",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.241.146.65"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186209,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "103.241.146.65",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dCBUmcBTFzn_XoLRxhI",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:02.368Z",
+      "source": {
+        "ip": "103.241.146.65"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "103.241.146.65",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186210
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31799",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tCBUmcBTFzn_XoLRxhI",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:02.619Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31799",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.241.146.65"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186211,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "103.241.146.65",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "103.241.146.65"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdCDUmcBTFzn_XoLZUd0",
+    "source": {
+      "@timestamp": "2018-11-27T00:13:21.161Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "104.248.159.44",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186218,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31813",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.159.44"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktCDUmcBTFzn_XoLZUd0",
+    "source": {
+      "@timestamp": "2018-11-27T00:13:21.162Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.248.159.44",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186219,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31813"
+      },
+      "source": {
+        "ip": "104.248.159.44"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "k9CDUmcBTFzn_XoLZUd0",
+    "source": {
+      "@timestamp": "2018-11-27T00:13:21.355Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "104.248.159.44",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.248.159.44",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186220,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31813",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.159.44"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdCCUmcBTFzn_XoLfDPd",
+    "source": {
+      "@timestamp": "2018-11-27T00:12:21.596Z",
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186215,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31805",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztCCUmcBTFzn_XoLfDPd",
+    "source": {
+      "@timestamp": "2018-11-27T00:12:21.598Z",
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186216,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31805"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z9CCUmcBTFzn_XoLfDPd",
+    "source": {
+      "@timestamp": "2018-11-27T00:12:21.740Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186217,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "46.148.18.163",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31805",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9CAUmcBTFzn_XoL2xDJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:34.814Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "177.206.128.131",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43092,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12250",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "177.206.128.131"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNCAUmcBTFzn_XoL2xDJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:34.814Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12250",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "177.206.128.131"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "177.206.128.131",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43093,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdCAUmcBTFzn_XoL2xDJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:10:35.006Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12250",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "177.206.128.131"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43094,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "177.206.128.131"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "177.206.128.131",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cdCCUmcBTFzn_XoLBilE",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:51.257Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "142.93.109.33"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "142.93.109.33",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43098,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12259",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctCCUmcBTFzn_XoLBilE",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:51.257Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12259",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.109.33"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "142.93.109.33",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43099,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9CCUmcBTFzn_XoLBilE",
+    "source": {
+      "@timestamp": "2018-11-27T00:11:51.365Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12259",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.109.33"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "142.93.109.33"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43100,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "142.93.109.33",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5NCHUmcBTFzn_XoLiqIH",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:52.669Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192414,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "161.132.195.76",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32116",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "161.132.195.76"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5dCHUmcBTFzn_XoLiqIH",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:52.670Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32116",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "161.132.195.76"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "161.132.195.76"
+          }
+        },
+        "sequence": 192415,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5tCHUmcBTFzn_XoLiqIH",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:52.776Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32116"
+      },
+      "source": {
+        "ip": "161.132.195.76"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "161.132.195.76",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192416,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "161.132.195.76",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9CHUmcBTFzn_XoLj6PQ",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:54.150Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31844"
+      },
+      "source": {
+        "ip": "202.175.83.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "202.175.83.165"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186236,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNCHUmcBTFzn_XoLj6PQ",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:54.151Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31844"
+      },
+      "source": {
+        "ip": "202.175.83.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186237,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "202.175.83.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdCHUmcBTFzn_XoLj6PQ",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:54.333Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31844"
+      },
+      "source": {
+        "ip": "202.175.83.165"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186238,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "202.175.83.165",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "202.175.83.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNCHUmcBTFzn_XoLkqTG",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:54.909Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32118",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "128.199.107.237"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.107.237",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192417,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdCHUmcBTFzn_XoLkqTG",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:54.910Z",
+      "source": {
+        "ip": "128.199.107.237"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.107.237",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192418,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32118",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NtCHUmcBTFzn_XoLkqTG",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:55.100Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "128.199.107.237"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "128.199.107.237",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.107.237",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192419
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32118",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "P9CHUmcBTFzn_XoLmKRB",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:56.311Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "197.149.137.86",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192420,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32120",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "197.149.137.86"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QNCHUmcBTFzn_XoLmKRB",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:56.312Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "197.149.137.86",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192421,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32120",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "197.149.137.86"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdCHUmcBTFzn_XoLmKRB",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:56.547Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "197.149.137.86",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "197.149.137.86"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192422
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32120"
+      },
+      "source": {
+        "ip": "197.149.137.86"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kNCIUmcBTFzn_XoL68Ge",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:23.188Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31854"
+      },
+      "source": {
+        "ip": "165.227.63.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "165.227.63.250",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186242,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdCIUmcBTFzn_XoL68Ge",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:23.189Z",
+      "process": {
+        "pid": "31854",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "165.227.63.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "165.227.63.250",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186243
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktCIUmcBTFzn_XoL68Ge",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:23.230Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31854",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "165.227.63.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "165.227.63.250",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "165.227.63.250",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186244,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7tCIUmcBTFzn_XoL_MPx",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:27.623Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24879"
+      },
+      "source": {
+        "ip": "185.137.92.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.137.92.168"
+          }
+        },
+        "sequence": 184264
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "79CIUmcBTFzn_XoL_MPx",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:27.624Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24879",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.137.92.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.137.92.168",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184265
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8NCIUmcBTFzn_XoL_MPx",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:27.733Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24879",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.137.92.168"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "185.137.92.168"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "185.137.92.168"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184266,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdCJUmcBTFzn_XoLMcci",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:40.983Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31857",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.58.119.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186245,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.58.119.156"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stCJUmcBTFzn_XoLMcci",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:40.984Z",
+      "source": {
+        "ip": "185.58.119.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.58.119.156"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186246,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31857",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "s9CJUmcBTFzn_XoLMcci",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:41.111Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31857",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.58.119.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186247,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "185.58.119.156",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "185.58.119.156",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RdCJUmcBTFzn_XoLOcgJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:43.008Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "201.134.231.33"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186248,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31859",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.134.231.33"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RtCJUmcBTFzn_XoLOcgJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:43.009Z",
+      "process": {
+        "pid": "31859",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.134.231.33"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "201.134.231.33",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186249,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R9CJUmcBTFzn_XoLOcgJ",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:43.074Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "201.134.231.33",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 186250,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "201.134.231.33",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31859",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.134.231.33"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtCGUmcBTFzn_XoL3pS1",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:08.809Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32108"
+      },
+      "source": {
+        "ip": "220.116.47.116"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "220.116.47.116",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192411,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9CGUmcBTFzn_XoL3pS1",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:08.810Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "220.116.47.116",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192412,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32108"
+      },
+      "source": {
+        "ip": "220.116.47.116"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNCGUmcBTFzn_XoL3pS1",
+    "source": {
+      "@timestamp": "2018-11-27T00:17:08.983Z",
+      "source": {
+        "ip": "220.116.47.116"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "220.116.47.116",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "220.116.47.116",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192413,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32108",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNCIUmcBTFzn_XoLa7Yh",
+    "source": {
+      "@timestamp": "2018-11-27T00:18:50.295Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24869"
+      },
+      "source": {
+        "ip": "222.117.50.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "222.117.50.66"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184258,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdCIUmcBTFzn_XoLa7Yh",
+    "source": {
+      "@timestamp": "2018-11-27T00:18:50.297Z",
+      "process": {
+        "pid": "24869",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.117.50.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "222.117.50.66",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184259
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtCIUmcBTFzn_XoLa7Yh",
+    "source": {
+      "@timestamp": "2018-11-27T00:18:50.462Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "222.117.50.66",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "222.117.50.66",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 184260,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24869",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.117.50.66"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNCIUmcBTFzn_XoLeri8",
+    "source": {
+      "@timestamp": "2018-11-27T00:18:54.288Z",
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186239,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31851",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdCIUmcBTFzn_XoLeri8",
+    "source": {
+      "@timestamp": "2018-11-27T00:18:54.289Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186240,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31851",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StCIUmcBTFzn_XoLeri8",
+    "source": {
+      "@timestamp": "2018-11-27T00:18:54.436Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31851"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "46.148.18.163",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186241
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9CJUmcBTFzn_XoLDcR_",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:31.861Z",
+      "source": {
+        "ip": "85.234.34.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "85.234.34.90",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 184267,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24881",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNCJUmcBTFzn_XoLDcR_",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:31.862Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "85.234.34.90",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184268,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24881"
+      },
+      "source": {
+        "ip": "85.234.34.90"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adCJUmcBTFzn_XoLDcR_",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:32.020Z",
+      "source": {
+        "ip": "85.234.34.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "85.234.34.90",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "85.234.34.90",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184269,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24881"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OtCIUmcBTFzn_XoL08CH",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:17.019Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24877",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "27.254.90.106"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "27.254.90.106",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184261
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "O9CIUmcBTFzn_XoL08CH",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:17.020Z",
+      "source": {
+        "ip": "27.254.90.106"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184262,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "27.254.90.106",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24877",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PNCIUmcBTFzn_XoL08CH",
+    "source": {
+      "@timestamp": "2018-11-27T00:19:17.244Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "27.254.90.106",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "27.254.90.106",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184263
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24877",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "27.254.90.106"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dCJUmcBTFzn_XoLv9T4",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:17.545Z",
+      "auditd": {
+        "sequence": 44088,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "87.191.133.16",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28146",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "87.191.133.16"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tCJUmcBTFzn_XoLv9T4",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:17.545Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28146"
+      },
+      "source": {
+        "ip": "87.191.133.16"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "87.191.133.16",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44089,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_9CJUmcBTFzn_XoLv9T4",
+    "source": {
+      "@timestamp": "2018-11-27T00:20:17.665Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "87.191.133.16",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "87.191.133.16",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44090,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28146",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "87.191.133.16"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtGOUmcBTFzn_XoLCjLw",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:58.886Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24919",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.55.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184276,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.128.55.52",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "x9GOUmcBTFzn_XoLCjLw",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:58.888Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "178.128.55.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184277,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "178.128.55.52",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24919",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yNGOUmcBTFzn_XoLCjLw",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:59.080Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24919",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.55.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "178.128.55.52",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.128.55.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184278
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtGOUmcBTFzn_XoLEzP0",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:01.159Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:accounting",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44103,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28242",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9GOUmcBTFzn_XoLEzP0",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:01.159Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28242",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 44104,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNGOUmcBTFzn_XoLEzP0",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:01.159Z",
+      "process": {
+        "pid": "28242",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 44106,
+        "result": "success",
+        "session": "1443",
+        "data": {
+          "op": "PAM:session_open",
+          "terminal": "cron",
+          "acct": "root"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GdGOUmcBTFzn_XoLEzP0",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:01.163Z",
+      "event": {
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "0",
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "28242"
+      },
+      "auditd": {
+        "sequence": 44107,
+        "result": "success",
+        "session": "1443",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GtGOUmcBTFzn_XoLEzP0",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:01.163Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "28242",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 44108,
+        "result": "success",
+        "session": "1443",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_close"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9GOUmcBTFzn_XoLLTXy",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:07.848Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24921"
+      },
+      "source": {
+        "ip": "78.217.134.141"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "78.217.134.141",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184279
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNGOUmcBTFzn_XoLLTXy",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:07.849Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24921"
+      },
+      "source": {
+        "ip": "78.217.134.141"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "78.217.134.141"
+          }
+        },
+        "sequence": 184280
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdGOUmcBTFzn_XoLLTXy",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:07.962Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24921",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "78.217.134.141"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "78.217.134.141",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "78.217.134.141",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184281,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NGOUmcBTFzn_XoLLjX5",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:08.111Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "151.80.144.39",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142273
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19291",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "151.80.144.39"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dGOUmcBTFzn_XoLLjX5",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:08.112Z",
+      "process": {
+        "pid": "19291",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "151.80.144.39"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142274,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "151.80.144.39",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0tGOUmcBTFzn_XoLLjX5",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:08.218Z",
+      "auditd": {
+        "sequence": 142275,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "151.80.144.39",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "151.80.144.39",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19291"
+      },
+      "source": {
+        "ip": "151.80.144.39"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xNGOUmcBTFzn_XoLYDl2",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:20.780Z",
+      "process": {
+        "pid": "24924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.208.143.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184282,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "104.208.143.92",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xdGOUmcBTFzn_XoLYDl2",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:20.781Z",
+      "process": {
+        "pid": "24924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.208.143.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184283,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.208.143.92"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtGOUmcBTFzn_XoLYDl2",
+    "source": {
+      "@timestamp": "2018-11-27T00:25:20.819Z",
+      "process": {
+        "pid": "24924",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.208.143.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "104.208.143.92",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.208.143.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184284,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "nNGPUmcBTFzn_XoLF0mX",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:07.661Z",
+      "source": {
+        "ip": "197.13.4.211"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "197.13.4.211",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 184285
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "24931",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ndGPUmcBTFzn_XoLF0mX",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:07.662Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "197.13.4.211"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184286,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24931",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "197.13.4.211"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntGPUmcBTFzn_XoLF0mX",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:07.796Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24931",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "197.13.4.211"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "197.13.4.211"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "197.13.4.211",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184287
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9GPUmcBTFzn_XoLi1R8",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:37.330Z",
+      "source": {
+        "ip": "128.199.216.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.216.13",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192431,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32510",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONGPUmcBTFzn_XoLi1R8",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:37.331Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32510",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.216.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.216.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192432
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdGPUmcBTFzn_XoLi1R8",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:37.524Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "32510",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.216.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192433,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "128.199.216.13",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.216.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNGNUmcBTFzn_XoLxiyC",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:41.365Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "147.135.208.7",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43116,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12336"
+      },
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idGNUmcBTFzn_XoLxiyC",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:41.365Z",
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43117,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "147.135.208.7",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12336",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "itGNUmcBTFzn_XoLxiyC",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:41.497Z",
+      "auditd": {
+        "sequence": 43118,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "147.135.208.7"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "147.135.208.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12336"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3NGPUmcBTFzn_XoLV05i",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:23.985Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.38.221",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44109,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "28278",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.38.221"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3dGPUmcBTFzn_XoLV05i",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:23.989Z",
+      "process": {
+        "pid": "28278",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.38.221"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "51.38.38.221",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44110,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3tGPUmcBTFzn_XoLV05i",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:24.093Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "51.38.38.221",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.38.38.221",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44111,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28278",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.38.221"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdGNUmcBTFzn_XoLoilI",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:32.089Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28228",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.138.233.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "202.138.233.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44100
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NtGNUmcBTFzn_XoLoilI",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:32.089Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28228",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "202.138.233.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "202.138.233.92"
+          }
+        },
+        "sequence": 44101
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9GNUmcBTFzn_XoLoilI",
+    "source": {
+      "@timestamp": "2018-11-27T00:24:32.345Z",
+      "process": {
+        "pid": "28228",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "202.138.233.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44102,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "202.138.233.92",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "202.138.233.92",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69GPUmcBTFzn_XoLM0ud",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:14.833Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1",
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "unit": "apt-daily"
+        },
+        "summary": {
+          "object": {
+            "primary": "apt-daily",
+            "type": "service"
+          },
+          "how": "/lib/systemd/systemd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192429
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "system-services",
+        "type": "service_start",
+        "action": "started-service",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7NGPUmcBTFzn_XoLM0ud",
+    "source": {
+      "@timestamp": "2018-11-27T00:26:14.834Z",
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "1",
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "apt-daily",
+            "type": "service"
+          },
+          "how": "/lib/systemd/systemd"
+        },
+        "sequence": 192430,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "unit": "apt-daily"
+        }
+      },
+      "event": {
+        "action": "stopped-service",
+        "module": "auditd",
+        "category": "system-services",
+        "type": "service_stop"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dGTUmcBTFzn_XoLE6A1",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:28.676Z",
+      "process": {
+        "pid": "28355",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "212.227.192.118"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44115,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "212.227.192.118",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tGTUmcBTFzn_XoLE6A1",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:28.680Z",
+      "process": {
+        "pid": "28355",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "212.227.192.118"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "212.227.192.118",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44116,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-9GTUmcBTFzn_XoLE6A1",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:28.788Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "212.227.192.118"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "212.227.192.118",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44117,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28355"
+      },
+      "source": {
+        "ip": "212.227.192.118"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_NGTUmcBTFzn_XoLIaG8",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:32.403Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32532",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.56.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.56.243",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192437
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dGTUmcBTFzn_XoLIaG8",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:32.404Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32532"
+      },
+      "source": {
+        "ip": "164.132.56.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "164.132.56.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192438,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tGTUmcBTFzn_XoLIaG8",
+    "source": {
+      "@timestamp": "2018-11-27T00:30:32.516Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32532",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "164.132.56.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "164.132.56.243",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192439,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "164.132.56.243"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9GVUmcBTFzn_XoLvdvo",
+    "source": {
+      "@timestamp": "2018-11-27T00:33:23.454Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184297,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "222.252.30.117",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24978",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.252.30.117"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNGVUmcBTFzn_XoLvdvo",
+    "source": {
+      "@timestamp": "2018-11-27T00:33:23.455Z",
+      "source": {
+        "ip": "222.252.30.117"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184298,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "222.252.30.117",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "24978",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "odGVUmcBTFzn_XoLvdvo",
+    "source": {
+      "@timestamp": "2018-11-27T00:33:23.682Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "24978",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.252.30.117"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "222.252.30.117",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 184299,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "222.252.30.117",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dGUUmcBTFzn_XoLfr-C",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:01.688Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "194.35.114.10",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184294,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "24969",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "194.35.114.10"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0tGUUmcBTFzn_XoLfr-C",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:01.689Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "194.35.114.10"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "194.35.114.10",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184295,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24969"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "09GUUmcBTFzn_XoLfr-C",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:01.975Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "194.35.114.10",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "194.35.114.10",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 184296,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24969"
+      },
+      "source": {
+        "ip": "194.35.114.10"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdGUUmcBTFzn_XoLVrxv",
+    "source": {
+      "@timestamp": "2018-11-27T00:31:51.428Z",
+      "source": {
+        "ip": "54.222.243.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.222.243.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184291,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24967"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtGUUmcBTFzn_XoLVrxv",
+    "source": {
+      "@timestamp": "2018-11-27T00:31:51.429Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "24967"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "54.222.243.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.222.243.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 184292
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9GUUmcBTFzn_XoLVrxv",
+    "source": {
+      "@timestamp": "2018-11-27T00:31:51.655Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "24967",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.222.243.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "54.222.243.60",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "54.222.243.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184293,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNGWUmcBTFzn_XoLZOnx",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:06.215Z",
+      "auditd": {
+        "sequence": 186263,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "187.188.146.35",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31932"
+      },
+      "source": {
+        "ip": "187.188.146.35"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idGWUmcBTFzn_XoLZOnx",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:06.216Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "187.188.146.35",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186264,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31932",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "187.188.146.35"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "itGWUmcBTFzn_XoLZOnx",
+    "source": {
+      "@timestamp": "2018-11-27T00:34:06.294Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "187.188.146.35"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "187.188.146.35",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186265,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31932",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "187.188.146.35"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5NGTUmcBTFzn_XoLoqzb",
+    "source": {
+      "@timestamp": "2018-11-27T00:31:05.454Z",
+      "source": {
+        "ip": "190.153.219.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43128,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "190.153.219.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12380",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5dGTUmcBTFzn_XoLoqzb",
+    "source": {
+      "@timestamp": "2018-11-27T00:31:05.454Z",
+      "process": {
+        "pid": "12380",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.153.219.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "190.153.219.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43129,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5tGTUmcBTFzn_XoLoqzb",
+    "source": {
+      "@timestamp": "2018-11-27T00:31:05.610Z",
+      "auditd": {
+        "sequence": 43130,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "190.153.219.50",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "190.153.219.50",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12380",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.153.219.50"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "f9GUUmcBTFzn_XoLl8LQ",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:08.159Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12388",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.75.29.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.75.29.64",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43131,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNGUUmcBTFzn_XoLl8LQ",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:08.163Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.75.29.64",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43132,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12388",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.75.29.64"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdGUUmcBTFzn_XoLl8LQ",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:08.283Z",
+      "source": {
+        "ip": "51.75.29.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "51.75.29.64"
+          }
+        },
+        "sequence": 43133,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "51.75.29.64",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12388",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9GUUmcBTFzn_XoLpsMN",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:11.807Z",
+      "source": {
+        "ip": "159.203.94.6"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "159.203.94.6"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43134,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12390",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNGUUmcBTFzn_XoLpsMN",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:11.807Z",
+      "process": {
+        "pid": "12390",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.94.6"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.203.94.6",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43135
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LdGUUmcBTFzn_XoLpsMN",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:11.839Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12390",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.94.6"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "159.203.94.6",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "159.203.94.6",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43136
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "49GUUmcBTFzn_XoL7sk-",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:30.290Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28397",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.255.35.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44118,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.255.35.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5NGUUmcBTFzn_XoL7sk-",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:30.290Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28397",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.255.35.58"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44119,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "51.255.35.58",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5dGUUmcBTFzn_XoL7sk-",
+    "source": {
+      "@timestamp": "2018-11-27T00:32:30.394Z",
+      "auditd": {
+        "sequence": 44120,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.255.35.58"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.255.35.58",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28397",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.255.35.58"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtKdUmcBTFzn_XoLzIys",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:11.490Z",
+      "process": {
+        "pid": "28582",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "51.75.23.199"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.75.23.199",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44127,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9KdUmcBTFzn_XoLzIys",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:11.494Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "51.75.23.199",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44128,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "28582",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.75.23.199"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNKdUmcBTFzn_XoLzIys",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:11.598Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28582"
+      },
+      "source": {
+        "ip": "51.75.23.199"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44129,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "51.75.23.199",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "51.75.23.199"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atKdUmcBTFzn_XoLzYxc",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:11.696Z",
+      "source": {
+        "ip": "180.76.100.10"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186281,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "180.76.100.10",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31982"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9KdUmcBTFzn_XoLzYxc",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:11.697Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31982",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "180.76.100.10"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186282,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "180.76.100.10",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNKdUmcBTFzn_XoLzYxc",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:11.935Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31982",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "180.76.100.10"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "180.76.100.10",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186283,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "180.76.100.10",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9KfUmcBTFzn_XoLkLSD",
+    "source": {
+      "@timestamp": "2018-11-27T00:44:07.193Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "115.146.127.134",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142297,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19404",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.134"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONKfUmcBTFzn_XoLkLSD",
+    "source": {
+      "@timestamp": "2018-11-27T00:44:07.194Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "115.146.127.134"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142298,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19404",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.134"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdKfUmcBTFzn_XoLkLSD",
+    "source": {
+      "@timestamp": "2018-11-27T00:44:07.394Z",
+      "process": {
+        "pid": "19404",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.134"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142299,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "115.146.127.134",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "115.146.127.134",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ftKgUmcBTFzn_XoLxc3Y",
+    "source": {
+      "@timestamp": "2018-11-27T00:45:26.381Z",
+      "auditd": {
+        "sequence": 184306,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "201.245.191.102",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25092"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "201.245.191.102"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "f9KgUmcBTFzn_XoLxc3Y",
+    "source": {
+      "@timestamp": "2018-11-27T00:45:26.382Z",
+      "source": {
+        "ip": "201.245.191.102"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "201.245.191.102",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184307,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25092",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNKgUmcBTFzn_XoLxc3Y",
+    "source": {
+      "@timestamp": "2018-11-27T00:45:26.503Z",
+      "process": {
+        "pid": "25092",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.245.191.102"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "201.245.191.102",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "201.245.191.102",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184308,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59KeUmcBTFzn_XoLO5ZL",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:39.841Z",
+      "process": {
+        "pid": "19396",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.97.173.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142294,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "209.97.173.192",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NKeUmcBTFzn_XoLO5ZL",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:39.843Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19396",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.97.173.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "209.97.173.192",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142295,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dKeUmcBTFzn_XoLO5ZL",
+    "source": {
+      "@timestamp": "2018-11-27T00:42:40.035Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19396",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.97.173.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142296,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "209.97.173.192"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "209.97.173.192",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xdKbUmcBTFzn_XoL6WOD",
+    "source": {
+      "@timestamp": "2018-11-27T00:40:07.833Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32633"
+      },
+      "source": {
+        "ip": "134.175.28.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192449,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "134.175.28.156",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtKbUmcBTFzn_XoL6WOD",
+    "source": {
+      "@timestamp": "2018-11-27T00:40:07.834Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32633",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "134.175.28.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "134.175.28.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192450,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "x9KbUmcBTFzn_XoL6WOD",
+    "source": {
+      "@timestamp": "2018-11-27T00:40:08.034Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "134.175.28.156",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "134.175.28.156",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192451
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32633",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "134.175.28.156"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntKbUmcBTFzn_XoL2WE6",
+    "source": {
+      "@timestamp": "2018-11-27T00:40:03.664Z",
+      "source": {
+        "ip": "79.134.4.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "79.134.4.138",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 186278
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31968",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9KbUmcBTFzn_XoL2WE6",
+    "source": {
+      "@timestamp": "2018-11-27T00:40:03.665Z",
+      "process": {
+        "pid": "31968",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "79.134.4.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "79.134.4.138",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186279,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNKbUmcBTFzn_XoL2WE6",
+    "source": {
+      "@timestamp": "2018-11-27T00:40:03.838Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "sequence": 186280,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "79.134.4.138",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "79.134.4.138",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31968"
+      },
+      "source": {
+        "ip": "79.134.4.138"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lNKdUmcBTFzn_XoLiIaH",
+    "source": {
+      "@timestamp": "2018-11-27T00:41:54.077Z",
+      "source": {
+        "ip": "203.66.168.81"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "203.66.168.81",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142291
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19393"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ldKdUmcBTFzn_XoLiIaH",
+    "source": {
+      "@timestamp": "2018-11-27T00:41:54.078Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142292,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "203.66.168.81",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19393",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "203.66.168.81"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltKdUmcBTFzn_XoLiIaH",
+    "source": {
+      "@timestamp": "2018-11-27T00:41:54.267Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19393"
+      },
+      "source": {
+        "ip": "203.66.168.81"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "203.66.168.81"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "203.66.168.81",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142293
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNKeUmcBTFzn_XoLtKCT",
+    "source": {
+      "@timestamp": "2018-11-27T00:43:10.887Z",
+      "source": {
+        "ip": "116.93.119.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "116.93.119.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43137,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12451",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdKeUmcBTFzn_XoLtKCT",
+    "source": {
+      "@timestamp": "2018-11-27T00:43:10.887Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12451",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "116.93.119.13"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "116.93.119.13",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43138
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztKeUmcBTFzn_XoLtKCT",
+    "source": {
+      "@timestamp": "2018-11-27T00:43:11.127Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12451"
+      },
+      "source": {
+        "ip": "116.93.119.13"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "116.93.119.13",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "116.93.119.13"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43139
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdKbUmcBTFzn_XoLs16u",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:54.048Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28538",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "41.185.28.133"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "41.185.28.133",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44124,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YtKbUmcBTFzn_XoLs16u",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:54.052Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "41.185.28.133",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44125,
+        "result": "fail"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28538",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "41.185.28.133"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Y9KbUmcBTFzn_XoLs16u",
+    "source": {
+      "@timestamp": "2018-11-27T00:39:54.292Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28538",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "41.185.28.133"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "41.185.28.133",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "41.185.28.133"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44126,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "otOnUmcBTFzn_XoLmmNb",
+    "source": {
+      "@timestamp": "2018-11-27T00:52:54.001Z",
+      "process": {
+        "pid": "25143",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184318,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "190.0.10.138"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "o9OnUmcBTFzn_XoLmmNb",
+    "source": {
+      "@timestamp": "2018-11-27T00:52:54.002Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25143",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "190.0.10.138",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184319,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pNOnUmcBTFzn_XoLmmNb",
+    "source": {
+      "@timestamp": "2018-11-27T00:52:54.109Z",
+      "source": {
+        "ip": "190.0.10.138"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184320,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "190.0.10.138",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "190.0.10.138",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25143"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59OrUmcBTFzn_XoL6cFF",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:36.347Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192455,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "202.28.34.200",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NOrUmcBTFzn_XoL6cFF",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:36.348Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32742"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192456,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "202.28.34.200",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dOrUmcBTFzn_XoL6cFF",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:36.577Z",
+      "process": {
+        "pid": "32742",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "202.28.34.200"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "202.28.34.200",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "202.28.34.200"
+          }
+        },
+        "sequence": 192457
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "P9OsUmcBTFzn_XoLBsX4",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:43.944Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12534",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.10.44.255"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "103.10.44.255",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43146,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QNOsUmcBTFzn_XoLBsX4",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:43.948Z",
+      "process": {
+        "pid": "12534",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.10.44.255"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43147,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "103.10.44.255"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdOsUmcBTFzn_XoLBsX4",
+    "source": {
+      "@timestamp": "2018-11-27T00:57:44.144Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12534",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.10.44.255"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "103.10.44.255",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "103.10.44.255",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43148,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNOpUmcBTFzn_XoLlY-1",
+    "source": {
+      "@timestamp": "2018-11-27T00:55:03.881Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "146.0.105.29",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186287
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32040",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "146.0.105.29"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdOpUmcBTFzn_XoLlY-1",
+    "source": {
+      "@timestamp": "2018-11-27T00:55:03.882Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "146.0.105.29",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186288,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32040",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "146.0.105.29"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtOpUmcBTFzn_XoLlY-1",
+    "source": {
+      "@timestamp": "2018-11-27T00:55:04.004Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "146.0.105.29",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186289,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "146.0.105.29"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32040",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "146.0.105.29"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtOpUmcBTFzn_XoL5pZA",
+    "source": {
+      "@timestamp": "2018-11-27T00:55:24.501Z",
+      "process": {
+        "pid": "12520",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.19.148.142"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "217.19.148.142",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43143,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9OpUmcBTFzn_XoL5pZA",
+    "source": {
+      "@timestamp": "2018-11-27T00:55:24.501Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12520"
+      },
+      "source": {
+        "ip": "217.19.148.142"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.19.148.142",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43144,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNOpUmcBTFzn_XoL5pZA",
+    "source": {
+      "@timestamp": "2018-11-27T00:55:24.637Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12520",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.19.148.142"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "217.19.148.142"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "217.19.148.142",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43145,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NOmUmcBTFzn_XoLfUpL",
+    "source": {
+      "@timestamp": "2018-11-27T00:51:41.026Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "59.120.243.8",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184315,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25134",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "59.120.243.8"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dOmUmcBTFzn_XoLfUpL",
+    "source": {
+      "@timestamp": "2018-11-27T00:51:41.027Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "59.120.243.8",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184316,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25134",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "59.120.243.8"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tOmUmcBTFzn_XoLfUpL",
+    "source": {
+      "@timestamp": "2018-11-27T00:51:41.202Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25134"
+      },
+      "source": {
+        "ip": "59.120.243.8"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "59.120.243.8",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "59.120.243.8",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184317,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9OpUmcBTFzn_XoLWIru",
+    "source": {
+      "@timestamp": "2018-11-27T00:54:48.324Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "32723",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "124.6.139.242"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "124.6.139.242",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 192452,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNOpUmcBTFzn_XoLWIru",
+    "source": {
+      "@timestamp": "2018-11-27T00:54:48.325Z",
+      "process": {
+        "pid": "32723",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "124.6.139.242"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "124.6.139.242",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192453,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "idOpUmcBTFzn_XoLWIru",
+    "source": {
+      "@timestamp": "2018-11-27T00:54:48.556Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32723",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "124.6.139.242"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "124.6.139.242"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "124.6.139.242",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192454,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YtOqUmcBTFzn_XoLnqU0",
+    "source": {
+      "@timestamp": "2018-11-27T00:56:11.591Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "28851",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "93.152.166.29"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44139,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "93.152.166.29",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Y9OqUmcBTFzn_XoLnqU0",
+    "source": {
+      "@timestamp": "2018-11-27T00:56:11.591Z",
+      "source": {
+        "ip": "93.152.166.29"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "93.152.166.29",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44140,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "28851"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZNOqUmcBTFzn_XoLnqU0",
+    "source": {
+      "@timestamp": "2018-11-27T00:56:11.743Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28851",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "93.152.166.29"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "93.152.166.29",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44141,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "93.152.166.29",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9OnUmcBTFzn_XoLxWfH",
+    "source": {
+      "@timestamp": "2018-11-27T00:53:05.113Z",
+      "process": {
+        "pid": "28796",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.117.50.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44136,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "222.117.50.66",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNOnUmcBTFzn_XoLxWfH",
+    "source": {
+      "@timestamp": "2018-11-27T00:53:05.113Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "28796",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.117.50.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "222.117.50.66",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44137
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdOnUmcBTFzn_XoLxWfH",
+    "source": {
+      "@timestamp": "2018-11-27T00:53:05.277Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "28796",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "222.117.50.66"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "222.117.50.66",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44138,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "222.117.50.66",
+          "op": "PAM:bad_ident"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tSyUmcBTFzn_XoLI0rV",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:24.552Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32096",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.133"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186305,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "115.146.127.133"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_9SyUmcBTFzn_XoLI0rV",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:24.554Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32096",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "115.146.127.133"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186306,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "115.146.127.133",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANSyUmcBTFzn_XoLI0vV",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:24.758Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32096"
+      },
+      "source": {
+        "ip": "115.146.127.133"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186307,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "115.146.127.133"
+        },
+        "summary": {
+          "object": {
+            "secondary": "115.146.127.133",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNSxUmcBTFzn_XoL-0d6",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:14.224Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32089",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186302,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "odSxUmcBTFzn_XoL-0d6",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:14.225Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32089"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186303,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "otSxUmcBTFzn_XoL-0d6",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:14.256Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32089"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186304,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNSyUmcBTFzn_XoL2FqQ",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:10.789Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186308
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32100",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdSyUmcBTFzn_XoL2FqQ",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:10.790Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32100",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186309,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JtSyUmcBTFzn_XoL2FqQ",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:10.821Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186310,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32100",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9tSxUmcBTFzn_XoLATF1",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:10.216Z",
+      "auditd": {
+        "sequence": 142318,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "81.174.25.52"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19519",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.25.52"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99SxUmcBTFzn_XoLATF1",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:10.217Z",
+      "process": {
+        "pid": "19519",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.25.52"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "81.174.25.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142319
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NSxUmcBTFzn_XoLATF1",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:10.360Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "81.174.25.52"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "81.174.25.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142320,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19519",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.25.52"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69SyUmcBTFzn_XoLSE3q",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:34.043Z",
+      "source": {
+        "ip": "110.170.166.101"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "110.170.166.101",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43149,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12572",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7NSyUmcBTFzn_XoLSE3q",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:34.043Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12572",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "110.170.166.101"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43150,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "110.170.166.101"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7dSyUmcBTFzn_XoLSE3q",
+    "source": {
+      "@timestamp": "2018-11-27T01:04:34.263Z",
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "110.170.166.101",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43151,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "110.170.166.101",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12572"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "110.170.166.101"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R9SzUmcBTFzn_XoLbGcD",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:48.570Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192461,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.155.249.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "316",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "178.155.249.205"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNSzUmcBTFzn_XoLbGcD",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:48.571Z",
+      "process": {
+        "pid": "316",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.155.249.205"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192462,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.155.249.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdSzUmcBTFzn_XoLbGcD",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:48.697Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "316",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.155.249.205"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "178.155.249.205"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.155.249.205",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192463
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wtSxUmcBTFzn_XoLPTZz",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:25.577Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32085",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186296,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "w9SxUmcBTFzn_XoLPTZz",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:25.578Z",
+      "process": {
+        "pid": "32085",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186297,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xNSxUmcBTFzn_XoLPTZz",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:25.609Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186298,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32085",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jdSxUmcBTFzn_XoLZToB",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:35.702Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32087",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.37.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.131.37.34",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186299,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jtSxUmcBTFzn_XoLZToB",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:35.707Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.131.37.34"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186300
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32087",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.37.34"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "j9SxUmcBTFzn_XoLZToB",
+    "source": {
+      "@timestamp": "2018-11-27T01:03:35.739Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "104.131.37.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "104.131.37.34",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.131.37.34",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186301,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32087",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ydSzUmcBTFzn_XoLemeL",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:52.289Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192464,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "195.68.29.234"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "323",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "195.68.29.234"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytSzUmcBTFzn_XoLemeL",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:52.290Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "195.68.29.234"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192465,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "323",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "195.68.29.234"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9SzUmcBTFzn_XoLemeL",
+    "source": {
+      "@timestamp": "2018-11-27T01:05:52.396Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "195.68.29.234"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "195.68.29.234"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192466,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "323"
+      },
+      "source": {
+        "ip": "195.68.29.234"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNS4UmcBTFzn_XoLe9YN",
+    "source": {
+      "@timestamp": "2018-11-27T01:11:20.098Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32151",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186337,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdS4UmcBTFzn_XoLe9YN",
+    "source": {
+      "@timestamp": "2018-11-27T01:11:20.099Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32151",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186338
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stS4UmcBTFzn_XoLe9YN",
+    "source": {
+      "@timestamp": "2018-11-27T01:11:20.130Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32151"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 186339,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MNS5UmcBTFzn_XoLKuU8",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:04.946Z",
+      "auditd": {
+        "sequence": 192488,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "192.208.184.216",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "428",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "192.208.184.216"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MdS5UmcBTFzn_XoLKuU8",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:04.947Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192489,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "192.208.184.216",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "428",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.208.184.216"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MtS5UmcBTFzn_XoLKuU8",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:04.962Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "428",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.208.184.216"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192490,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "192.208.184.216"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "192.208.184.216",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GtW7UmcBTFzn_XoLNhOL",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:19.169Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32173"
+      },
+      "source": {
+        "ip": "73.15.91.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "73.15.91.251",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186350
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9W7UmcBTFzn_XoLNhOL",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:19.170Z",
+      "source": {
+        "ip": "73.15.91.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186351,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "73.15.91.251"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32173",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNW7UmcBTFzn_XoLNhOL",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:19.234Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32173",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "73.15.91.251"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186352,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "73.15.91.251",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "73.15.91.251",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R9W6UmcBTFzn_XoL9Aya",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:02.288Z",
+      "process": {
+        "pid": "32171",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.144.84.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "201.144.84.82",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186347
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNW6UmcBTFzn_XoL9Aya",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:02.289Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "201.144.84.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186348,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32171",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.144.84.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdW6UmcBTFzn_XoL9Aya",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:02.352Z",
+      "source": {
+        "ip": "201.144.84.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "201.144.84.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186349,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "201.144.84.82",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32171",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19W7UmcBTFzn_XoLRBML",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:22.625Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32175",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186353
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NW7UmcBTFzn_XoLRBML",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:22.627Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186354,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32175",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dW7UmcBTFzn_XoLRBML",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:22.658Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32175"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186355,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltW6UmcBTFzn_XoLawEv",
+    "source": {
+      "@timestamp": "2018-11-27T01:13:27.109Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186344,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32168"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l9W6UmcBTFzn_XoLawEv",
+    "source": {
+      "@timestamp": "2018-11-27T01:13:27.110Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32168",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186345,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mNW6UmcBTFzn_XoLawEv",
+    "source": {
+      "@timestamp": "2018-11-27T01:13:27.142Z",
+      "process": {
+        "pid": "32168",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          }
+        },
+        "sequence": 186346,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdS5UmcBTFzn_XoLl-71",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:33.036Z",
+      "auditd": {
+        "sequence": 186341,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32161"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gtS5UmcBTFzn_XoLl-71",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:33.037Z",
+      "auditd": {
+        "sequence": 186342,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32161",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "g9S5UmcBTFzn_XoLl-71",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:33.179Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32161",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "46.148.18.163",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "46.148.18.163",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 186343,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LdW7UmcBTFzn_XoLDA9a",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:08.367Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "438"
+      },
+      "source": {
+        "ip": "193.70.38.229"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "193.70.38.229"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192491
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LtW7UmcBTFzn_XoLDA9a",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:08.368Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "438"
+      },
+      "source": {
+        "ip": "193.70.38.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192492,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "193.70.38.229",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "L9W7UmcBTFzn_XoLDA9a",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:08.480Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "193.70.38.229",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "193.70.38.229"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192493
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "438",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.38.229"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9S5UmcBTFzn_XoLcevO",
+    "source": {
+      "@timestamp": "2018-11-27T01:12:23.261Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186340
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32158",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdW9UmcBTFzn_XoLHz_j",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:24.437Z",
+      "auditd": {
+        "sequence": 44170,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.187.113.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "29260",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.113.229"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StW9UmcBTFzn_XoLHz_j",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:24.437Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29260",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.113.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44171,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.187.113.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9W9UmcBTFzn_XoLHz_j",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:24.541Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29260",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.113.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44172,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "37.187.113.229",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "37.187.113.229"
+          }
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9W9UmcBTFzn_XoLJj-I",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:26.142Z",
+      "process": {
+        "pid": "25331",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.249.205.78"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "103.249.205.78"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184334,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNW9UmcBTFzn_XoLJj-I",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:26.143Z",
+      "process": {
+        "pid": "25331",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.249.205.78"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184335,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "103.249.205.78",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdW9UmcBTFzn_XoLJj-I",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:26.372Z",
+      "source": {
+        "ip": "103.249.205.78"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "103.249.205.78",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "103.249.205.78",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184336,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25331"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "b9W8UmcBTFzn_XoLiTGg",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:45.974Z",
+      "auditd": {
+        "sequence": 186365,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNW8UmcBTFzn_XoLiTGg",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:45.975Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186366,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.18.163",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cdW8UmcBTFzn_XoLiTGg",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:46.119Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.18.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "46.148.18.163"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "46.148.18.163"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186367,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtW8UmcBTFzn_XoLkzMm",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:48.412Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32192"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186368,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9W8UmcBTFzn_XoLkzMm",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:48.413Z",
+      "process": {
+        "pid": "32192",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186369,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNW8UmcBTFzn_XoLkzMm",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:48.444Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186370,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32192",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "g9W7UmcBTFzn_XoL5iPr",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:04.321Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32185"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186359,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hNW7UmcBTFzn_XoL5iPr",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:04.322Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186360,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32185",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hdW7UmcBTFzn_XoL5iPr",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:04.353Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32185",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186361,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddW7UmcBTFzn_XoLfxpa",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:37.808Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.91.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186356,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32178",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.91.82"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dtW7UmcBTFzn_XoLfxpa",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:37.809Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32178"
+      },
+      "source": {
+        "ip": "128.199.91.82"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "128.199.91.82"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186357,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "d9W7UmcBTFzn_XoLfxpa",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:38.002Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "128.199.91.82",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.91.82",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186358,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32178"
+      },
+      "source": {
+        "ip": "128.199.91.82"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9W8UmcBTFzn_XoLdzAT",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:41.225Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186362,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.36.221.229",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32188",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.36.221.229"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNW8UmcBTFzn_XoLdzAT",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:41.226Z",
+      "source": {
+        "ip": "89.36.221.229"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186363,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "89.36.221.229"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32188",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdW8UmcBTFzn_XoLdzAT",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:41.329Z",
+      "source": {
+        "ip": "89.36.221.229"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "89.36.221.229",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "89.36.221.229",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186364,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32188",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5dW7UmcBTFzn_XoLcBda",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:33.960Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "131.100.219.3",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44161,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29218",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "131.100.219.3"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5tW7UmcBTFzn_XoLcBda",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:33.964Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29218",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "131.100.219.3"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "131.100.219.3"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44162,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "59W7UmcBTFzn_XoLcBda",
+    "source": {
+      "@timestamp": "2018-11-27T01:14:34.176Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29218",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "131.100.219.3"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "131.100.219.3"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "131.100.219.3",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44163,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9W8UmcBTFzn_XoL6Do7",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:10.192Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32194",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.66.86.4"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "81.66.86.4"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186371,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ENW8UmcBTFzn_XoL6Do7",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:10.194Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "81.66.86.4"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186372,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32194"
+      },
+      "source": {
+        "ip": "81.66.86.4"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdW8UmcBTFzn_XoL6Do7",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:10.308Z",
+      "source": {
+        "ip": "81.66.86.4"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "81.66.86.4",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186373,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "81.66.86.4"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32194",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cNW8UmcBTFzn_XoLvDaC",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:58.995Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "204.145.5.2",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44164,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29245",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "204.145.5.2"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cdW8UmcBTFzn_XoLvDaC",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:58.999Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "204.145.5.2",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44165,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "29245",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "204.145.5.2"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctW8UmcBTFzn_XoLvDaC",
+    "source": {
+      "@timestamp": "2018-11-27T01:15:59.199Z",
+      "process": {
+        "pid": "29245",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "204.145.5.2"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "204.145.5.2",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "204.145.5.2",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44166,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "f9W8UmcBTFzn_XoL_Dt-",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:15.376Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.15.40.125",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44167
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29255"
+      },
+      "source": {
+        "ip": "51.15.40.125"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gNW8UmcBTFzn_XoL_Dt-",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:15.376Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.15.40.125",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44168
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29255"
+      },
+      "source": {
+        "ip": "51.15.40.125"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdW8UmcBTFzn_XoL_Dt-",
+    "source": {
+      "@timestamp": "2018-11-27T01:16:15.488Z",
+      "auditd": {
+        "sequence": 44169,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.15.40.125"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.15.40.125",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29255"
+      },
+      "source": {
+        "ip": "51.15.40.125"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INXAUmcBTFzn_XoLvI6Q",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:21.158Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "138.68.50.250",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142333,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19612",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "138.68.50.250"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "IdXAUmcBTFzn_XoLvI6Q",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:21.159Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19612",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "138.68.50.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "138.68.50.250",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142334,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItXAUmcBTFzn_XoLvI6Q",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:21.200Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19612"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "138.68.50.250"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142335,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "138.68.50.250",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "138.68.50.250",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BdXAUmcBTFzn_XoLyZBk",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:24.441Z",
+      "event": {
+        "category": "system-services",
+        "type": "service_start",
+        "action": "started-service",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd",
+        "pid": "1"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "unit": "apt-daily"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "apt-daily",
+            "type": "service"
+          },
+          "how": "/lib/systemd/systemd"
+        },
+        "sequence": 184343,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtXAUmcBTFzn_XoLyZBk",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:24.441Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184344,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "unit": "apt-daily"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "apt-daily",
+            "type": "service"
+          },
+          "how": "/lib/systemd/systemd"
+        }
+      },
+      "event": {
+        "type": "service_stop",
+        "action": "stopped-service",
+        "module": "auditd",
+        "category": "system-services"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1",
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yNW_UmcBTFzn_XoL_n0W",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:32.396Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186392,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32225",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ydW_UmcBTFzn_XoL_n0W",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:32.398Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186393,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32225",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytW_UmcBTFzn_XoL_n0W",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:32.428Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32225"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186394
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PNXAUmcBTFzn_XoLAX59",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:33.267Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "83.222.240.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 192500
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "473",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "83.222.240.60"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PdXAUmcBTFzn_XoLAX59",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:33.268Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "473",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "83.222.240.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "83.222.240.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192501,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PtXAUmcBTFzn_XoLAX59",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:33.371Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "473"
+      },
+      "source": {
+        "ip": "83.222.240.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "83.222.240.60",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "83.222.240.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192502,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "L9XBUmcBTFzn_XoLuKRN",
+    "source": {
+      "@timestamp": "2018-11-27T01:21:25.603Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186398,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "153.254.115.57",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32236",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "153.254.115.57"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MNXBUmcBTFzn_XoLuKRN",
+    "source": {
+      "@timestamp": "2018-11-27T01:21:25.604Z",
+      "auditd": {
+        "sequence": 186399,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "153.254.115.57",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32236",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "153.254.115.57"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MdXBUmcBTFzn_XoLuKRN",
+    "source": {
+      "@timestamp": "2018-11-27T01:21:25.817Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32236"
+      },
+      "source": {
+        "ip": "153.254.115.57"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "153.254.115.57",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "153.254.115.57",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186400,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtXCUmcBTFzn_XoLq7my",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:27.912Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "118.163.107.56",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186404,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32246",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "118.163.107.56"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "x9XCUmcBTFzn_XoLq7my",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:27.914Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32246",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "118.163.107.56"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "118.163.107.56",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186405,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "yNXCUmcBTFzn_XoLq7my",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:28.078Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32246"
+      },
+      "source": {
+        "ip": "118.163.107.56"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "118.163.107.56",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "118.163.107.56",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186406
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8dXBUmcBTFzn_XoL0KVY",
+    "source": {
+      "@timestamp": "2018-11-27T01:21:31.757Z",
+      "process": {
+        "pid": "32238",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186401,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8tXBUmcBTFzn_XoL0KVY",
+    "source": {
+      "@timestamp": "2018-11-27T01:21:31.758Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186402,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32238"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "89XBUmcBTFzn_XoL0KVY",
+    "source": {
+      "@timestamp": "2018-11-27T01:21:31.789Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186403,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32238",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_dXAUmcBTFzn_XoL55GP",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:32.165Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32229",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186395,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_tXAUmcBTFzn_XoL55GP",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:32.166Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32229",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186396,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_9XAUmcBTFzn_XoL55GP",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:32.197Z",
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32229",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186397,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xNXCUmcBTFzn_XoLQq83",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:00.907Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12675",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "145.239.237.80"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "145.239.237.80"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43161
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xdXCUmcBTFzn_XoLQq83",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:00.907Z",
+      "source": {
+        "ip": "145.239.237.80"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "145.239.237.80",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43162,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12675",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "xtXCUmcBTFzn_XoLQq83",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:01.039Z",
+      "source": {
+        "ip": "145.239.237.80"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "145.239.237.80",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "145.239.237.80",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43163,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12675",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "o9XAUmcBTFzn_XoLKIGO",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:43.268Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "141.89.111.68",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192503,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "141.89.111.68"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pNXAUmcBTFzn_XoLKIGO",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:43.269Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "141.89.111.68"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "141.89.111.68",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192504
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pdXAUmcBTFzn_XoLKIGO",
+    "source": {
+      "@timestamp": "2018-11-27T01:19:43.395Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "141.89.111.68"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "141.89.111.68",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192505
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "141.89.111.68"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "O9XAUmcBTFzn_XoLzZAP",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:25.380Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "195.84.49.20",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44179,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29341",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "195.84.49.20"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PNXAUmcBTFzn_XoLzZAP",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:25.380Z",
+      "source": {
+        "ip": "195.84.49.20"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "195.84.49.20",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44180,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29341",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PdXAUmcBTFzn_XoLzZAP",
+    "source": {
+      "@timestamp": "2018-11-27T01:20:25.516Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "195.84.49.20"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44181,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "195.84.49.20"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "195.84.49.20",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29341"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNXCUmcBTFzn_XoLvLq2",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:32.268Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32248"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186407,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdXCUmcBTFzn_XoLvLq2",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:32.269Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186408,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32248",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StXCUmcBTFzn_XoLvLq2",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:32.300Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186409,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32248",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9XCUmcBTFzn_XoL-sCa",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:48.071Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "490",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "68.183.62.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "68.183.62.109",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 192506,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNXCUmcBTFzn_XoL-sCa",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:48.073Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "68.183.62.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 192507,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "490",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "68.183.62.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddXCUmcBTFzn_XoL-sCa",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:48.104Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "490"
+      },
+      "source": {
+        "ip": "68.183.62.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "68.183.62.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "68.183.62.109"
+          }
+        },
+        "sequence": 192508,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stXDUmcBTFzn_XoLwdCO",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:39.044Z",
+      "process": {
+        "pid": "502",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "80.127.254.119"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "sequence": 192511,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "80.127.254.119"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "s9XDUmcBTFzn_XoLwdCO",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:39.045Z",
+      "process": {
+        "pid": "502",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "80.127.254.119"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "sequence": 192512,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "80.127.254.119",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tNXDUmcBTFzn_XoLwdCO",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:39.260Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "502",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "80.127.254.119"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "80.127.254.119"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "80.127.254.119",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192513,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TtXDUmcBTFzn_XoLkcxS",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:26.696Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32251",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "93.104.213.19"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186410,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "93.104.213.19",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "T9XDUmcBTFzn_XoLkcxS",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:26.697Z",
+      "source": {
+        "ip": "93.104.213.19"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "93.104.213.19",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186411,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32251",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UNXDUmcBTFzn_XoLkcxS",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:26.812Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32251",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "93.104.213.19"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186412,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "93.104.213.19",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "93.104.213.19",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctXCUmcBTFzn_XoL3b2F",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:40.662Z",
+      "source": {
+        "ip": "185.238.72.255"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "sequence": 43164,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.238.72.255",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12678",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9XCUmcBTFzn_XoL3b2F",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:40.662Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12678",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.238.72.255"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.238.72.255",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43165,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNXCUmcBTFzn_XoL3b2F",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:40.794Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12678"
+      },
+      "source": {
+        "ip": "185.238.72.255"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "185.238.72.255",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "185.238.72.255",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43166,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNXDUmcBTFzn_XoLtc-O",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:35.972Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32253",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186413,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdXDUmcBTFzn_XoLtc-O",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:35.973Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32253",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186414,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StXDUmcBTFzn_XoLtc-O",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:36.003Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32253",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186415,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNXDUmcBTFzn_XoLps53",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:32.109Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "125.227.77.88"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "125.227.77.88"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "125.227.77.88",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184346
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25735",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNXDUmcBTFzn_XoLp84D",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:32.249Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "500",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.109.33"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "142.93.109.33",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "142.93.109.33",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192510,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdXDUmcBTFzn_XoLZcgh",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:15.383Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25733",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "125.227.77.88"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "125.227.77.88",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "125.227.77.88",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184345,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "v9XDUmcBTFzn_XoLIMO9",
+    "source": {
+      "@timestamp": "2018-11-27T01:22:57.875Z",
+      "process": {
+        "pid": "497",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "94.16.115.155"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "94.16.115.155"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "94.16.115.155",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192509,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ndXDUmcBTFzn_XoL69Tr",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:49.884Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "147.229.176.122"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.229.176.122",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43167,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12686"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntXDUmcBTFzn_XoL69Tr",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:49.884Z",
+      "source": {
+        "ip": "147.229.176.122"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.229.176.122",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43168
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12686"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9XDUmcBTFzn_XoL69Tr",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:50.008Z",
+      "process": {
+        "pid": "12686",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "147.229.176.122"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "147.229.176.122",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43169,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "147.229.176.122",
+          "terminal": "ssh"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNXDUmcBTFzn_XoL99V8",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:52.849Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25737"
+      },
+      "source": {
+        "ip": "125.227.77.88"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "125.227.77.88"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184347,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CdXDUmcBTFzn_XoL99V8",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:52.850Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25737"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "125.227.77.88"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "125.227.77.88",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184348
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtXDUmcBTFzn_XoL99V8",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:53.128Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "125.227.77.88",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "secondary": "125.227.77.88",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184349
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25737",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "125.227.77.88"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9dXFUmcBTFzn_XoLyvxi",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:52.376Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32272"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186422,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9tXFUmcBTFzn_XoLyvxi",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:52.377Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186423,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32272",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99XFUmcBTFzn_XoLyvxi",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:52.407Z",
+      "process": {
+        "pid": "32272",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186424,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNXFUmcBTFzn_XoLzv1N",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:53.380Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "524",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.236.181.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192520,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adXFUmcBTFzn_XoLzv1N",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:53.381Z",
+      "process": {
+        "pid": "524",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192521,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "104.236.181.158",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atXFUmcBTFzn_XoLzv1N",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:53.425Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "104.236.181.158"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "104.236.181.158"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192522,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "524",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9XDUmcBTFzn_XoL2tJr",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:45.409Z",
+      "process": {
+        "pid": "19632",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "46.101.192.45"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.101.192.45",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 142336,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNXDUmcBTFzn_XoL2tJr",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:45.410Z",
+      "source": {
+        "ip": "46.101.192.45"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "46.101.192.45"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142337,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19632",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdXDUmcBTFzn_XoL2tJr",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:45.519Z",
+      "auditd": {
+        "sequence": 142338,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "46.101.192.45",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.101.192.45",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19632"
+      },
+      "source": {
+        "ip": "46.101.192.45"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kNbGUmcBTFzn_XoLcgv7",
+    "source": {
+      "@timestamp": "2018-11-27T01:26:35.537Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25757",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "167.114.153.36"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184350,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "167.114.153.36",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdbGUmcBTFzn_XoLcgv7",
+    "source": {
+      "@timestamp": "2018-11-27T01:26:35.538Z",
+      "source": {
+        "ip": "167.114.153.36"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "167.114.153.36",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184351,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25757"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktbGUmcBTFzn_XoLcgv7",
+    "source": {
+      "@timestamp": "2018-11-27T01:26:35.581Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "167.114.153.36"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "167.114.153.36",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184352
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25757"
+      },
+      "source": {
+        "ip": "167.114.153.36"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNXEUmcBTFzn_XoLu-bL",
+    "source": {
+      "@timestamp": "2018-11-27T01:24:43.105Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32262",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186416,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdXEUmcBTFzn_XoLu-bL",
+    "source": {
+      "@timestamp": "2018-11-27T01:24:43.106Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186417,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32262"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YtXEUmcBTFzn_XoLu-bL",
+    "source": {
+      "@timestamp": "2018-11-27T01:24:43.136Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32262"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186418,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dXFUmcBTFzn_XoLNvCh",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:14.551Z",
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "34.197.73.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186419,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32269",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "34.197.73.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tXFUmcBTFzn_XoLNvCh",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:14.552Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32269",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "34.197.73.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "34.197.73.243"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186420,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69XFUmcBTFzn_XoLNvCh",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:14.587Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32269",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "34.197.73.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "34.197.73.243",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "34.197.73.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186421,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "WtXEUmcBTFzn_XoLA9aC",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:55.928Z",
+      "auditd": {
+        "sequence": 192514,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.21.65.57",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "504",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.21.65.57"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "W9XEUmcBTFzn_XoLA9aC",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:55.929Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "504"
+      },
+      "source": {
+        "ip": "211.21.65.57"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192515,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "211.21.65.57",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "XNXEUmcBTFzn_XoLA9aC",
+    "source": {
+      "@timestamp": "2018-11-27T01:23:56.099Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "211.21.65.57"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192516,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "211.21.65.57"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "504",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "211.21.65.57"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNXEUmcBTFzn_XoLbd__",
+    "source": {
+      "@timestamp": "2018-11-27T01:24:23.144Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "515",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.254.52.72"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.254.52.72",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192517,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdXEUmcBTFzn_XoLbd__",
+    "source": {
+      "@timestamp": "2018-11-27T01:24:23.145Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.254.52.72",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192518,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "515",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.254.52.72"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stXEUmcBTFzn_XoLbd__",
+    "source": {
+      "@timestamp": "2018-11-27T01:24:23.339Z",
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "54.254.52.72"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "54.254.52.72"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192519,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "515",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.254.52.72"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "PtXFUmcBTFzn_XoLg_d5",
+    "source": {
+      "@timestamp": "2018-11-27T01:25:34.159Z",
+      "source": {
+        "ip": "192.240.119.252"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "192.240.119.252",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "192.240.119.252"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44182,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "29443",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NbIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.309Z",
+      "file": {
+        "size": 0,
+        "group": "root",
+        "path": "/etc/sed8B6Ati",
+        "ctime": "2018-11-27T01:28:36.306Z",
+        "uid": 0,
+        "gid": 0,
+        "inode": "332",
+        "mode": "0000",
+        "owner": "root",
+        "mtime": "2018-11-27T01:28:36.306Z",
+        "type": "file"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "hash": {
+        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
+      },
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "created"
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dbIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.311Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": [
+          "updated"
+        ],
+        "module": "file_integrity"
+      },
+      "file": {
+        "ctime": "2018-11-27T01:28:36.306Z",
+        "mtime": "2018-11-27T01:28:36.306Z",
+        "owner": "root",
+        "path": "/etc/sed8B6Ati",
+        "size": 21,
+        "type": "file",
+        "uid": 0,
+        "gid": 0,
+        "inode": "332",
+        "mode": "0000",
+        "group": "root"
+      },
+      "hash": {
+        "sha1": "302493715263b503309437954b46d73fee714260"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tbIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.312Z",
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "updated"
+        ]
+      },
+      "file": {
+        "path": "/etc/sed8B6Ati"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "29bIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.314Z",
+      "event": {
+        "module": "file_integrity",
+        "action": [
+          "moved"
+        ]
+      },
+      "file": {
+        "path": "/etc/sed8B6Ati"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3NbIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.315Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "action": [
+          "created"
+        ],
+        "module": "file_integrity"
+      },
+      "file": {
+        "size": 420,
+        "type": "file",
+        "uid": 0,
+        "inode": "332",
+        "ctime": "2018-11-27T01:28:36.306Z",
+        "mode": "0644",
+        "path": "/etc/hosts",
+        "mtime": "2018-11-27T01:28:36.306Z",
+        "owner": "root",
+        "gid": 0,
+        "group": "root"
+      },
+      "hash": {
+        "sha1": "3ecab8f840eff15248fdb68f4cc7c3d0d9971476"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3dbIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.410Z",
+      "event": {
+        "category": "system-services",
+        "type": "service_stop",
+        "action": "stopped-service",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1",
+        "name": "systemd",
+        "exe": "/lib/systemd/systemd"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "unit": "rsyslog"
+        },
+        "summary": {
+          "object": {
+            "type": "service",
+            "primary": "rsyslog"
+          },
+          "how": "/lib/systemd/systemd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44186,
+        "result": "success"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3tbIUmcBTFzn_XoLSjPA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:36.470Z",
+      "process": {
+        "exe": "/lib/systemd/systemd",
+        "pid": "1",
+        "name": "systemd"
+      },
+      "auditd": {
+        "data": {
+          "unit": "rsyslog"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "service",
+            "primary": "rsyslog"
+          },
+          "how": "/lib/systemd/systemd"
+        },
+        "sequence": 44187,
+        "result": "success",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "service_start",
+        "action": "started-service",
+        "module": "auditd",
+        "category": "system-services"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MNbHUmcBTFzn_XoLFxpi",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:17.624Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25765",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "59.124.152.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "59.124.152.146",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184353,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MdbHUmcBTFzn_XoLFxpi",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:17.625Z",
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25765",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "59.124.152.146"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184354,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "59.124.152.146"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MtbHUmcBTFzn_XoLFxpi",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:17.794Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184355,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "59.124.152.146",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "59.124.152.146",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25765"
+      },
+      "source": {
+        "ip": "59.124.152.146"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9bHUmcBTFzn_XoLFxqn",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:17.693Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "167.99.171.14",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192523
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "532",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "167.99.171.14"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNbHUmcBTFzn_XoLFxqn",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:17.695Z",
+      "source": {
+        "ip": "167.99.171.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "167.99.171.14",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 192524,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "532"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdbHUmcBTFzn_XoLFxqn",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:17.735Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "532"
+      },
+      "source": {
+        "ip": "167.99.171.14"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192525,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "167.99.171.14",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "167.99.171.14",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3dbHUmcBTFzn_XoLPR0X",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:27.266Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19657",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.130.2"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.59.130.2",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142339
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3tbHUmcBTFzn_XoLPR0X",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:27.267Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19657",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "139.59.130.2"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "139.59.130.2",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142340,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "39bHUmcBTFzn_XoLPR0X",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:27.376Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "139.59.130.2",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "139.59.130.2",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142341
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19657",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "139.59.130.2"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mNbIUmcBTFzn_XoLFi9i",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:22.881Z",
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25773",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.139.20.56"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "37.139.20.56"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 184356,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mdbIUmcBTFzn_XoLFi9i",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:22.883Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.139.20.56",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184357
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25773",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "37.139.20.56"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mtbIUmcBTFzn_XoLFi9i",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:22.989Z",
+      "source": {
+        "ip": "37.139.20.56"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "37.139.20.56",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "37.139.20.56"
+          }
+        },
+        "sequence": 184358,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25773",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NbHUmcBTFzn_XoL7Stw",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:12.420Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32287",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186428,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dbHUmcBTFzn_XoL7Stw",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:12.422Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32287",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186429,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0tbHUmcBTFzn_XoL7Stw",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:12.453Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186430,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32287"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItbIUmcBTFzn_XoLqjzc",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:00.914Z",
+      "process": {
+        "pid": "545",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.97.173.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "209.97.173.192",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 192526
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9bIUmcBTFzn_XoLqjzc",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:00.915Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "545"
+      },
+      "source": {
+        "ip": "209.97.173.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "209.97.173.192"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 192527,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNbIUmcBTFzn_XoLqjzc",
+    "source": {
+      "@timestamp": "2018-11-27T01:29:01.108Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "545",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.97.173.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192528,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "209.97.173.192"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "209.97.173.192",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONbGUmcBTFzn_XoL2xQn",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:02.205Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32279",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186425,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdbGUmcBTFzn_XoL2xQn",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:02.206Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186426,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32279",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OtbGUmcBTFzn_XoL2xQn",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:02.238Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32279",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186427
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltbHUmcBTFzn_XoLWR9W",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:34.501Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29478"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "46.105.89.195"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "46.105.89.195"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44183,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l9bHUmcBTFzn_XoLWR9W",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:34.501Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "46.105.89.195",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44184
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "29478",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.105.89.195"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mNbHUmcBTFzn_XoLWR9W",
+    "source": {
+      "@timestamp": "2018-11-27T01:27:34.613Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "46.105.89.195",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.105.89.195",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44185,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "29478"
+      },
+      "source": {
+        "ip": "46.105.89.195"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtbIUmcBTFzn_XoLVjVA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:39.253Z",
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "sequence": 43170,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.255.34.233",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12716"
+      },
+      "source": {
+        "ip": "51.255.34.233"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Q9bIUmcBTFzn_XoLVjVA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:39.253Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12716"
+      },
+      "source": {
+        "ip": "51.255.34.233"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.255.34.233",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43171
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "RNbIUmcBTFzn_XoLVjVA",
+    "source": {
+      "@timestamp": "2018-11-27T01:28:39.361Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12716",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.255.34.233"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.255.34.233",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43172,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "51.255.34.233",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8tfRUmcBTFzn_XoL1ASG",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:01.401Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12782"
+      },
+      "source": {
+        "ip": "138.68.150.115"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "138.68.150.115",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "138.68.150.115",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43186,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9fRUmcBTFzn_XoL1gUs",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:01.825Z",
+      "process": {
+        "pid": "25839",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184368,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNfRUmcBTFzn_XoL1gUs",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:01.826Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184369,
+        "result": "success"
+      },
+      "event": {
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "25839"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdfRUmcBTFzn_XoL1gUs",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:01.828Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25839",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184371,
+        "result": "success",
+        "session": "9859",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TtfRUmcBTFzn_XoL1gUs",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:01.923Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "25839"
+      },
+      "auditd": {
+        "sequence": 184372,
+        "result": "success",
+        "session": "9859",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "T9fRUmcBTFzn_XoL1gUs",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:01.924Z",
+      "process": {
+        "pid": "25839",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184373,
+        "result": "success",
+        "session": "9859",
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UdfRUmcBTFzn_XoL1gXc",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:02.001Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "608"
+      },
+      "auditd": {
+        "sequence": 192547,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:accounting",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UtfRUmcBTFzn_XoL1gXc",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:02.001Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "608"
+      },
+      "auditd": {
+        "sequence": 192548,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "U9fRUmcBTFzn_XoL1gXc",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:02.003Z",
+      "auditd": {
+        "result": "success",
+        "session": "9863",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_open",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192550
+      },
+      "event": {
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "608"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNfRUmcBTFzn_XoL1gXc",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:02.100Z",
+      "process": {
+        "pid": "608",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9863",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192551
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VdfRUmcBTFzn_XoL1gXc",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:02.101Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "608",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192552,
+        "result": "success",
+        "session": "9863",
+        "data": {
+          "op": "PAM:session_close",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdbRUmcBTFzn_XoLPPiy",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:22.535Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19718"
+      },
+      "source": {
+        "ip": "207.154.201.218"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142346,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "207.154.201.218"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtbRUmcBTFzn_XoLPPiy",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:22.537Z",
+      "process": {
+        "pid": "19718",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "207.154.201.218"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142347,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "207.154.201.218",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9bRUmcBTFzn_XoLPPiy",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:22.645Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19718"
+      },
+      "source": {
+        "ip": "207.154.201.218"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142348,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "207.154.201.218"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "207.154.201.218",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GdfTUmcBTFzn_XoLdSoA",
+    "source": {
+      "@timestamp": "2018-11-27T01:40:48.022Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19732",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.226.187.115"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.226.187.115",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142349,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GtfTUmcBTFzn_XoLdSoA",
+    "source": {
+      "@timestamp": "2018-11-27T01:40:48.024Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142350,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.226.187.115",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19732",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "188.226.187.115"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9fTUmcBTFzn_XoLdSoA",
+    "source": {
+      "@timestamp": "2018-11-27T01:40:48.126Z",
+      "source": {
+        "ip": "188.226.187.115"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "188.226.187.115"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "188.226.187.115",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142351,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19732",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jdfTUmcBTFzn_XoLsi5i",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:03.736Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32370"
+      },
+      "source": {
+        "ip": "82.200.205.71"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "82.200.205.71",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 186473,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jtfTUmcBTFzn_XoLsi5i",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:03.737Z",
+      "source": {
+        "ip": "82.200.205.71"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "82.200.205.71"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186474,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32370",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "j9fTUmcBTFzn_XoLsi5i",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:03.993Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "82.200.205.71"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "82.200.205.71"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186475,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32370",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.200.205.71"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9bRUmcBTFzn_XoLcPxx",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:35.782Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186464
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32356",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNbRUmcBTFzn_XoLcPxx",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:35.783Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32356"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186465
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bdbRUmcBTFzn_XoLcPxx",
+    "source": {
+      "@timestamp": "2018-11-27T01:38:35.814Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32356",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186466,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dfSUmcBTFzn_XoLXhCA",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:36.720Z",
+      "auditd": {
+        "sequence": 43187,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "89.221.217.8",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12790",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.221.217.8"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tfSUmcBTFzn_XoLXhCA",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:36.724Z",
+      "source": {
+        "ip": "89.221.217.8"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43188,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "89.221.217.8",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12790",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "29fSUmcBTFzn_XoLXhCA",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:36.852Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "89.221.217.8",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "89.221.217.8",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43189,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12790",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "89.221.217.8"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adfSUmcBTFzn_XoLgRS2",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:45.740Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32360",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "sequence": 186467,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atfSUmcBTFzn_XoLgRS2",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:45.741Z",
+      "process": {
+        "pid": "32360",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186468,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9fSUmcBTFzn_XoLgRS2",
+    "source": {
+      "@timestamp": "2018-11-27T01:39:45.771Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186469,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32360",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdfTUmcBTFzn_XoLmy0i",
+    "source": {
+      "@timestamp": "2018-11-27T01:40:57.784Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32368",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186470,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtfTUmcBTFzn_XoLmy0i",
+    "source": {
+      "@timestamp": "2018-11-27T01:40:57.785Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186471
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32368",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9fTUmcBTFzn_XoLmy0i",
+    "source": {
+      "@timestamp": "2018-11-27T01:40:57.815Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186472,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32368"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNfUUmcBTFzn_XoLBTW-",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:25.073Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12798",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.37.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43190,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.131.37.34",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdfUUmcBTFzn_XoLBTW-",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:25.073Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12798",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.37.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "sequence": 43191,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.131.37.34",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtfUUmcBTFzn_XoLBTW-",
+    "source": {
+      "@timestamp": "2018-11-27T01:41:25.105Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12798"
+      },
+      "source": {
+        "ip": "104.131.37.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43192,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "104.131.37.34"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.131.37.34",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNfWUmcBTFzn_XoLkW2H",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:11.932Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "128.199.106.169"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.106.169",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186485,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32391",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdfWUmcBTFzn_XoLkW2H",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:11.934Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32391",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.106.169"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.106.169",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186486
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TtfWUmcBTFzn_XoLkW2H",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:12.126Z",
+      "process": {
+        "pid": "32391",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.106.169"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "128.199.106.169",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "128.199.106.169",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186487,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CtfWUmcBTFzn_XoLl27w",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:13.574Z",
+      "source": {
+        "ip": "45.122.222.253"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "45.122.222.253",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 142361
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19759",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "C9fWUmcBTFzn_XoLl27w",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:13.575Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19759",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.122.222.253"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142362,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "45.122.222.253"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DNfWUmcBTFzn_XoLl27w",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:13.839Z",
+      "source": {
+        "ip": "45.122.222.253"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "45.122.222.253",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "45.122.222.253"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142363,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19759",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "utfYUmcBTFzn_XoLQpK3",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:02.828Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19772"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "151.203.70.218"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "151.203.70.218",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142364,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "u9fYUmcBTFzn_XoLQpK3",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:02.829Z",
+      "source": {
+        "ip": "151.203.70.218"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142365,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "151.203.70.218"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19772"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vNfYUmcBTFzn_XoLQpK3",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:02.868Z",
+      "source": {
+        "ip": "151.203.70.218"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "151.203.70.218"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142366,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "151.203.70.218",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19772",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdfYUmcBTFzn_XoLRpPT",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:03.873Z",
+      "process": {
+        "pid": "12823",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.115.61.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43193,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "152.115.61.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "StfYUmcBTFzn_XoLRpPT",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:03.873Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "152.115.61.52",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43194,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12823",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "152.115.61.52"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9fYUmcBTFzn_XoLRpPT",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:04.009Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12823",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "152.115.61.52"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "152.115.61.52",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 43195,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "152.115.61.52",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adfYUmcBTFzn_XoLXJVb",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:09.392Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32410"
+      },
+      "source": {
+        "ip": "106.51.66.214"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186494,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "106.51.66.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atfYUmcBTFzn_XoLXJVb",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:09.394Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "106.51.66.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186495,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32410",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "106.51.66.214"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9fYUmcBTFzn_XoLXJVb",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:09.624Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32410"
+      },
+      "source": {
+        "ip": "106.51.66.214"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186496,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "106.51.66.214",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "106.51.66.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9fYUmcBTFzn_XoLZZX6",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:11.847Z",
+      "source": {
+        "ip": "92.86.47.26"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "92.86.47.26"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192553,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "700",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNfYUmcBTFzn_XoLZZX6",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:11.848Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "92.86.47.26",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192554
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "700",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "92.86.47.26"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zdfYUmcBTFzn_XoLZZX6",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:11.996Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "700",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "92.86.47.26"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192555,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "92.86.47.26",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "92.86.47.26",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNfWUmcBTFzn_XoLc2tJ",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:04.191Z",
+      "process": {
+        "pid": "19756",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "177.137.205.150"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "177.137.205.150",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142358
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JdfWUmcBTFzn_XoLc2tJ",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:04.192Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "177.137.205.150",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142359,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19756"
+      },
+      "source": {
+        "ip": "177.137.205.150"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JtfWUmcBTFzn_XoLc2tJ",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:04.375Z",
+      "process": {
+        "pid": "19756",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "177.137.205.150"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "177.137.205.150",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "177.137.205.150"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142360,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "atfYUmcBTFzn_XoLgpgd",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:19.059Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19774",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "140.143.190.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142367,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "140.143.190.243",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "a9fYUmcBTFzn_XoLgpgd",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:19.060Z",
+      "process": {
+        "pid": "19774",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "140.143.190.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142368,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "140.143.190.243",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "bNfYUmcBTFzn_XoLgpgd",
+    "source": {
+      "@timestamp": "2018-11-27T01:46:19.278Z",
+      "auditd": {
+        "sequence": 142369,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "140.143.190.243"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "140.143.190.243",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19774",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "140.143.190.243"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtfXUmcBTFzn_XoLaoE9",
+    "source": {
+      "@timestamp": "2018-11-27T01:45:07.411Z",
+      "auditd": {
+        "sequence": 184386,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.19.148.142",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25932",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.19.148.142"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A9fXUmcBTFzn_XoLaoE9",
+    "source": {
+      "@timestamp": "2018-11-27T01:45:07.412Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "25932",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.19.148.142"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.19.148.142",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184387
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BNfXUmcBTFzn_XoLaoE9",
+    "source": {
+      "@timestamp": "2018-11-27T01:45:07.545Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "25932",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.19.148.142"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "217.19.148.142"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "217.19.148.142",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184388,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "49fWUmcBTFzn_XoL_XYj",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:39.480Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186488
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32399",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5NfWUmcBTFzn_XoL_XYj",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:39.481Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32399",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186489,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5dfWUmcBTFzn_XoL_XYj",
+    "source": {
+      "@timestamp": "2018-11-27T01:44:39.512Z",
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 186490,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32399",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GtfVUmcBTFzn_XoL2l5j",
+    "source": {
+      "@timestamp": "2018-11-27T01:43:25.049Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32389",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186482
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9fVUmcBTFzn_XoL2l5j",
+    "source": {
+      "@timestamp": "2018-11-27T01:43:25.050Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32389"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186483,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNfVUmcBTFzn_XoL2l5j",
+    "source": {
+      "@timestamp": "2018-11-27T01:43:25.081Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32389",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186484,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANfYUmcBTFzn_XoLIJDK",
+    "source": {
+      "@timestamp": "2018-11-27T01:45:54.144Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32408"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186491,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdfYUmcBTFzn_XoLIJDK",
+    "source": {
+      "@timestamp": "2018-11-27T01:45:54.146Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32408",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          }
+        },
+        "sequence": 186492,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtfYUmcBTFzn_XoLIJDK",
+    "source": {
+      "@timestamp": "2018-11-27T01:45:54.176Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186493,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32408"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kNjeUmcBTFzn_XoLchqO",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:48.274Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "92.222.218.139",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184392,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "25980",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "92.222.218.139"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdjeUmcBTFzn_XoLchqO",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:48.275Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "25980"
+      },
+      "source": {
+        "ip": "92.222.218.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "92.222.218.139"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184393,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktjeUmcBTFzn_XoLchqO",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:48.381Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25980",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "92.222.218.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "92.222.218.139"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "92.222.218.139"
+          }
+        },
+        "sequence": 184394,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ANjeUmcBTFzn_XoLgBst",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:51.775Z",
+      "source": {
+        "ip": "174.138.17.18"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "174.138.17.18",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43202,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12866"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdjeUmcBTFzn_XoLgBst",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:51.775Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12866"
+      },
+      "source": {
+        "ip": "174.138.17.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "174.138.17.18",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43203,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtjeUmcBTFzn_XoLgBst",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:51.851Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12868"
+      },
+      "source": {
+        "ip": "54.38.47.28"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43204,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.38.47.28",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A9jeUmcBTFzn_XoLgBst",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:51.851Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12868",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.38.47.28"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43205,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "54.38.47.28",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BNjeUmcBTFzn_XoLgBst",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:51.963Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12868",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.38.47.28"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "54.38.47.28"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "54.38.47.28",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43206,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BdjeUmcBTFzn_XoLgBst",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:51.967Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12866",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "174.138.17.18"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "174.138.17.18",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "174.138.17.18",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43207
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "vtjdUmcBTFzn_XoLhQbg",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:47.702Z",
+      "process": {
+        "pid": "25972",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.151.178.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184389,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "201.151.178.139",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "v9jdUmcBTFzn_XoLhQbg",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:47.704Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "25972",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.151.178.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "201.151.178.139",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 184390
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wNjdUmcBTFzn_XoLhQbg",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:47.788Z",
+      "process": {
+        "pid": "25972",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "201.151.178.139"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "201.151.178.139",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184391,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "201.151.178.139",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9jdUmcBTFzn_XoLlgd5",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:51.949Z",
+      "process": {
+        "pid": "19818",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "121.124.124.73"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142389,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONjdUmcBTFzn_XoLlgd5",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:51.951Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19818",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "121.124.124.73",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 142390,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdjdUmcBTFzn_XoLlgd5",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:52.141Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19818",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "121.124.124.73"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "121.124.124.73"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142391
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdjfUmcBTFzn_XoLJSnD",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:34.169Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19831",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "79.137.64.132"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "79.137.64.132",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142392,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EtjfUmcBTFzn_XoLJSnD",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:34.170Z",
+      "source": {
+        "ip": "79.137.64.132"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "79.137.64.132"
+          }
+        },
+        "sequence": 142393,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19831",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E9jfUmcBTFzn_XoLJSnD",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:34.276Z",
+      "source": {
+        "ip": "79.137.64.132"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "79.137.64.132",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "79.137.64.132",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142394,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19831",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtjfUmcBTFzn_XoLJila",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:34.315Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "161.132.195.76",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43211
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12877",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "161.132.195.76"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9jfUmcBTFzn_XoLJila",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:34.315Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12877",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "161.132.195.76"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "161.132.195.76",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43212,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNjfUmcBTFzn_XoLJila",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:34.427Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12877",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "161.132.195.76"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "161.132.195.76",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "161.132.195.76",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43213,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Y9jdUmcBTFzn_XoLdARP",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:43.201Z",
+      "auditd": {
+        "sequence": 43196,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "83.222.240.60"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12856",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "83.222.240.60"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZNjdUmcBTFzn_XoLdARP",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:43.205Z",
+      "source": {
+        "ip": "83.222.240.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43197,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "83.222.240.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12856"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZdjdUmcBTFzn_XoLdARP",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:43.309Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43198,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "83.222.240.60"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "83.222.240.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12856",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "83.222.240.60"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INjdUmcBTFzn_XoLggVd",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:46.789Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "142.93.210.90",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 44207,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30014",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "142.93.210.90"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "IdjdUmcBTFzn_XoLggVd",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:46.789Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30014",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.210.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "142.93.210.90"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44208,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItjdUmcBTFzn_XoLggVd",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:47.021Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "142.93.210.90"
+          }
+        },
+        "sequence": 44209,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "142.93.210.90"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30014",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "142.93.210.90"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtjdUmcBTFzn_XoLYAMi",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:38.040Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19814",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "121.124.124.73",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "121.124.124.73",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142385,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtjdUmcBTFzn_XoLaAOj",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:40.216Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19816",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "121.124.124.73",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142386,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9jdUmcBTFzn_XoLaAOj",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:40.217Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "121.124.124.73",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142387,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19816",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNjdUmcBTFzn_XoLaAOj",
+    "source": {
+      "@timestamp": "2018-11-27T01:51:40.395Z",
+      "auditd": {
+        "sequence": 142388,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "121.124.124.73"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "121.124.124.73",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19816",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "121.124.124.73"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtjdUmcBTFzn_XoL0w1m",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:07.547Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32446",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186509,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "F9jdUmcBTFzn_XoL0w1m",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:07.548Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186510,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32446",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "GNjdUmcBTFzn_XoL0w1m",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:07.578Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32446"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186511,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hdjeUmcBTFzn_XoLyiGI",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:10.809Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "128.199.128.215"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43208,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12875",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.128.215"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "htjeUmcBTFzn_XoLyiGI",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:10.813Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12875",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.128.215"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.199.128.215",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43209,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9jeUmcBTFzn_XoLyiGI",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:11.005Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12875",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.128.215"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.128.215",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43210,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "128.199.128.215",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hdjeUmcBTFzn_XoL5SQF",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:17.595Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32449",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186512
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "htjeUmcBTFzn_XoL5SQF",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:17.596Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186513,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32449"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9jeUmcBTFzn_XoL5SQF",
+    "source": {
+      "@timestamp": "2018-11-27T01:53:17.627Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32449",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186514,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ytjdUmcBTFzn_XoL0gs9",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:07.159Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "153.19.40.20"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43199,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12863",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "153.19.40.20"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "y9jdUmcBTFzn_XoL0gs9",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:07.159Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12863"
+      },
+      "source": {
+        "ip": "153.19.40.20"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43200,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "153.19.40.20"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zNjdUmcBTFzn_XoL0gs9",
+    "source": {
+      "@timestamp": "2018-11-27T01:52:07.287Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "153.19.40.20"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "153.19.40.20"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43201,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12863",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "153.19.40.20"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNjkUmcBTFzn_XoLfZ-j",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:24.344Z",
+      "process": {
+        "pid": "783",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "91.134.241.32"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "91.134.241.32"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192562
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdjkUmcBTFzn_XoLfZ-j",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:24.345Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.134.241.32",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192563,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "783"
+      },
+      "source": {
+        "ip": "91.134.241.32"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtjkUmcBTFzn_XoLfZ-j",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:24.452Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "91.134.241.32"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "91.134.241.32",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "91.134.241.32",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192564,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "783",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdjkUmcBTFzn_XoLgZ_0",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:25.449Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32500"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186542,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtjkUmcBTFzn_XoLgZ_0",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:25.450Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32500",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186543,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Q9jkUmcBTFzn_XoLgZ_0",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:25.481Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186544,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32500",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jdjjUmcBTFzn_XoLToQx",
+    "source": {
+      "@timestamp": "2018-11-27T01:58:06.663Z",
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186539,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32492",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "jtjjUmcBTFzn_XoLToQx",
+    "source": {
+      "@timestamp": "2018-11-27T01:58:06.664Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32492",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186540,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "j9jjUmcBTFzn_XoLToQx",
+    "source": {
+      "@timestamp": "2018-11-27T01:58:06.694Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32492"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186541
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZdjiUmcBTFzn_XoLImvA",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:50.005Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186530
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32480",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtjiUmcBTFzn_XoLImvA",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:50.006Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186531,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32480",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9jiUmcBTFzn_XoLImvA",
+    "source": {
+      "@timestamp": "2018-11-27T01:56:50.037Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32480",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186532,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "etjlUmcBTFzn_XoLHawN",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:05.155Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "785"
+      },
+      "source": {
+        "ip": "212.159.18.107"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192565,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "212.159.18.107",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "e9jlUmcBTFzn_XoLHawN",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:05.156Z",
+      "process": {
+        "pid": "785",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "212.159.18.107"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "212.159.18.107",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192566,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "fNjlUmcBTFzn_XoLHawN",
+    "source": {
+      "@timestamp": "2018-11-27T02:00:05.265Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "212.159.18.107"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "212.159.18.107",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "212.159.18.107",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192567,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "785",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtjjUmcBTFzn_XoLIYEi",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:55.128Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32490",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.153.219.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186536,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "190.153.219.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9jjUmcBTFzn_XoLIYEi",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:55.129Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32490",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.153.219.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "190.153.219.50",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186537,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNjjUmcBTFzn_XoLIYEi",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:55.284Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "sequence": 186538,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "190.153.219.50",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "190.153.219.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32490",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "190.153.219.50"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItjiUmcBTFzn_XoLZXBu",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:07.073Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12897",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "151.80.144.39"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "151.80.144.39"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43214,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9jiUmcBTFzn_XoLZXBu",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:07.073Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12897",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "151.80.144.39"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "151.80.144.39",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43215
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNjiUmcBTFzn_XoLZXBu",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:07.181Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "151.80.144.39",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43216,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "151.80.144.39",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12897"
+      },
+      "source": {
+        "ip": "151.80.144.39"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1djjUmcBTFzn_XoLD39T",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:50.568Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "61.73.98.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186533,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32487",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "61.73.98.60"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1tjjUmcBTFzn_XoLD39T",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:50.570Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32487",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "61.73.98.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "61.73.98.60"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186534,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19jjUmcBTFzn_XoLD39T",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:50.730Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32487",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "61.73.98.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186535,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "61.73.98.60",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "61.73.98.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9jiUmcBTFzn_XoL9X2Y",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:43.982Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192559,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "193.70.39.84"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "769",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.39.84"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNjiUmcBTFzn_XoL9X2Y",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:43.983Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "769"
+      },
+      "source": {
+        "ip": "193.70.39.84"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "193.70.39.84",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192560,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddjiUmcBTFzn_XoL9X2Y",
+    "source": {
+      "@timestamp": "2018-11-27T01:57:44.094Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "769",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "193.70.39.84"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "193.70.39.84",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "193.70.39.84",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192561,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "lNjkUmcBTFzn_XoLRpqM",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:10.239Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "104.208.143.92",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44219,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30166",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.208.143.92"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ldjkUmcBTFzn_XoLRpqM",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:10.239Z",
+      "source": {
+        "ip": "104.208.143.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.208.143.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 44220,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30166",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltjkUmcBTFzn_XoLRpqM",
+    "source": {
+      "@timestamp": "2018-11-27T01:59:10.283Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30166"
+      },
+      "source": {
+        "ip": "104.208.143.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44221,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "104.208.143.92"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "104.208.143.92",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdnsUmcBTFzn_XoLslKD",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:22.166Z",
+      "process": {
+        "pid": "30352",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "110.36.221.182"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "110.36.221.182",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44231,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NtnsUmcBTFzn_XoLslKD",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:22.166Z",
+      "auditd": {
+        "sequence": 44232,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "110.36.221.182",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30352",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "110.36.221.182"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9nsUmcBTFzn_XoLslKD",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:22.414Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30352",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "110.36.221.182"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "110.36.221.182",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "110.36.221.182"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44233
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9tnsUmcBTFzn_XoLt1Lw",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:23.554Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30354"
+      },
+      "source": {
+        "ip": "61.73.98.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44234,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "61.73.98.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "99nsUmcBTFzn_XoLt1Lw",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:23.554Z",
+      "source": {
+        "ip": "61.73.98.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "61.73.98.60"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44235
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30354",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-NnsUmcBTFzn_XoLt1Lw",
+    "source": {
+      "@timestamp": "2018-11-27T02:08:23.714Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "61.73.98.60"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "61.73.98.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44236
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30354"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "61.73.98.60"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1dnpUmcBTFzn_XoLNAWm",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:33.307Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26060",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "151.80.136.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "151.80.136.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184405,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1tnpUmcBTFzn_XoLNAWm",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:33.309Z",
+      "source": {
+        "ip": "151.80.136.92"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184406,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "151.80.136.92",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26060",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19npUmcBTFzn_XoLNAWm",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:33.423Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "151.80.136.92",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "151.80.136.92"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184407,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26060",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "151.80.136.92"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3tnpUmcBTFzn_XoLOwYm",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:35.004Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "177.124.89.14",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "177.124.89.14",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 184408
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26062",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "177.124.89.14"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tnpUmcBTFzn_XoLZAmP",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:45.605Z",
+      "process": {
+        "pid": "32532",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186557
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69npUmcBTFzn_XoLZAmP",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:45.606Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186558
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32532"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7NnpUmcBTFzn_XoLZAmP",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:45.638Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32532",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          }
+        },
+        "sequence": 186559,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNnsUmcBTFzn_XoLVUul",
+    "source": {
+      "@timestamp": "2018-11-27T02:07:58.394Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "19916"
+      },
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142410,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "74.208.43.208",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdnsUmcBTFzn_XoLVUul",
+    "source": {
+      "@timestamp": "2018-11-27T02:07:58.395Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19916",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "74.208.43.208"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142411,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtnsUmcBTFzn_XoLVUul",
+    "source": {
+      "@timestamp": "2018-11-27T02:07:58.422Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "pid": "19916",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "74.208.43.208"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142412,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "74.208.43.208"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "74.208.43.208",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rtnqUmcBTFzn_XoLniSL",
+    "source": {
+      "@timestamp": "2018-11-27T02:06:05.967Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186560,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32540"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9nqUmcBTFzn_XoLniSL",
+    "source": {
+      "@timestamp": "2018-11-27T02:06:05.968Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186561,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32540",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNnqUmcBTFzn_XoLniSL",
+    "source": {
+      "@timestamp": "2018-11-27T02:06:05.999Z",
+      "process": {
+        "pid": "32540",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          }
+        },
+        "sequence": 186562,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtjoUmcBTFzn_XoLSvJx",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:33.383Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26052",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184402,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.236.181.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "K9joUmcBTFzn_XoLSvJx",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:33.384Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26052",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.236.181.158",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184403
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNjoUmcBTFzn_XoLSvJx",
+    "source": {
+      "@timestamp": "2018-11-27T02:03:33.426Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "104.236.181.158"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "104.236.181.158"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184404,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26052"
+      },
+      "source": {
+        "ip": "104.236.181.158"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "kdnrUmcBTFzn_XoL2j_v",
+    "source": {
+      "@timestamp": "2018-11-27T02:07:26.981Z",
+      "process": {
+        "pid": "32548",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186563,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ktnrUmcBTFzn_XoL2j_v",
+    "source": {
+      "@timestamp": "2018-11-27T02:07:26.982Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186564
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32548",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "k9nrUmcBTFzn_XoL2j_v",
+    "source": {
+      "@timestamp": "2018-11-27T02:07:27.012Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186565,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32548",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ntnpUmcBTFzn_XoLkg3n",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:57.466Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30281",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.156.152.134"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44225,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "89.156.152.134",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "n9npUmcBTFzn_XoLkg3n",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:57.466Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30281"
+      },
+      "source": {
+        "ip": "89.156.152.134"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.156.152.134",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44226,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "oNnpUmcBTFzn_XoLkg3n",
+    "source": {
+      "@timestamp": "2018-11-27T02:04:57.574Z",
+      "process": {
+        "pid": "30281",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.156.152.134"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44227,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "89.156.152.134",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "89.156.152.134"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VdnrUmcBTFzn_XoLLzF2",
+    "source": {
+      "@timestamp": "2018-11-27T02:06:43.078Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30322",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "210.71.197.80"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "210.71.197.80",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44228,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VtnrUmcBTFzn_XoLLzF2",
+    "source": {
+      "@timestamp": "2018-11-27T02:06:43.078Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30322",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "210.71.197.80"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44229,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "210.71.197.80",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "V9nrUmcBTFzn_XoLLzF2",
+    "source": {
+      "@timestamp": "2018-11-27T02:06:43.254Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "30322",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "210.71.197.80"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44230,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "210.71.197.80",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "210.71.197.80"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8tnwUmcBTFzn_XoLk6fE",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:36.443Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "secondary": "37.187.195.209",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 192577
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "916",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.195.209"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "89nwUmcBTFzn_XoLk6fE",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:36.443Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "37.187.195.209"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192578,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.187.195.209",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "916",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9NnwUmcBTFzn_XoLk6fE",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:36.550Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "37.187.195.209"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "37.187.195.209",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 192579
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "916",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.187.195.209"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9nwUmcBTFzn_XoLlqgH",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:37.021Z",
+      "source": {
+        "ip": "51.38.176.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184424,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.176.147",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26164"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ENnwUmcBTFzn_XoLlqgH",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:37.022Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.176.147",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184425,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26164",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.176.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdnwUmcBTFzn_XoLlqgH",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:37.127Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26164",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.38.176.147"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "51.38.176.147",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184426,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.38.176.147"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNnwUmcBTFzn_XoLl6g8",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:37.327Z",
+      "process": {
+        "pid": "12992",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.227.27"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "81.174.227.27",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43232,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HdnwUmcBTFzn_XoLl6g8",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:37.327Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "81.174.227.27",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43233,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12992",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.227.27"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HtnwUmcBTFzn_XoLl6g8",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:37.435Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43234,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "81.174.227.27",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "81.174.227.27"
+          }
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "12992",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.174.227.27"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DdnwUmcBTFzn_XoLRqHL",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:16.736Z",
+      "source": {
+        "ip": "159.65.225.184"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.65.225.184",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44250
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30449"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DtnwUmcBTFzn_XoLRqHL",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:16.736Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30449"
+      },
+      "source": {
+        "ip": "159.65.225.184"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44249,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.65.225.184",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9nwUmcBTFzn_XoLRqHL",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:16.764Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30449",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.65.225.184"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44251,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "159.65.225.184",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "159.65.225.184",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtnwUmcBTFzn_XoLUqId",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:19.633Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43226,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "185.91.116.197",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12988",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.91.116.197"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9nwUmcBTFzn_XoLUqId",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:19.633Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "185.91.116.197"
+          }
+        },
+        "sequence": 43227,
+        "result": "fail"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "12988",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "185.91.116.197"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNnwUmcBTFzn_XoLUqId",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:19.753Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "185.91.116.197",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "185.91.116.197"
+          }
+        },
+        "sequence": 43228,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12988"
+      },
+      "source": {
+        "ip": "185.91.116.197"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6NnwUmcBTFzn_XoLjqfh",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:35.140Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26162",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.252.209.190"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "192.252.209.190",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184421
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dnwUmcBTFzn_XoLjqfh",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:35.141Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26162",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "192.252.209.190"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "192.252.209.190",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184422,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tnwUmcBTFzn_XoLjqfh",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:35.173Z",
+      "process": {
+        "pid": "26162",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "192.252.209.190"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184423,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "192.252.209.190",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "192.252.209.190"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctnvUmcBTFzn_XoLp5MU",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:35.850Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "912",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "105.16.153.210"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "sequence": 192574,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "105.16.153.210",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9nvUmcBTFzn_XoLp5MU",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:35.851Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "105.16.153.210",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 192575,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "912"
+      },
+      "source": {
+        "ip": "105.16.153.210"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNnvUmcBTFzn_XoLp5MU",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:36.114Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "105.16.153.210",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192576,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "105.16.153.210",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "912"
+      },
+      "source": {
+        "ip": "105.16.153.210"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2dnvUmcBTFzn_XoLwpV9",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:42.866Z",
+      "process": {
+        "pid": "19940",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "167.99.212.179"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "167.99.212.179"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142419,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2tnvUmcBTFzn_XoLwpV9",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:42.867Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19940",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "167.99.212.179"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "167.99.212.179"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142420
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "29nvUmcBTFzn_XoLwpV9",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:42.971Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19940",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "167.99.212.179"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142421,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "167.99.212.179",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "167.99.212.179",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8tnvUmcBTFzn_XoLn5Ih",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:33.815Z",
+      "process": {
+        "pid": "32575",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186575,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "89nvUmcBTFzn_XoLn5Ih",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:33.816Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32575"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186576,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9NnvUmcBTFzn_XoLn5Ih",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:33.846Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32575",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186577,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "L9nvUmcBTFzn_XoLVo3n",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:15.325Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "67.166.24.55",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186572,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32573",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "67.166.24.55"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MNnvUmcBTFzn_XoLVo3n",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:15.326Z",
+      "source": {
+        "ip": "67.166.24.55"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186573,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "67.166.24.55",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32573",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MdnvUmcBTFzn_XoLVo3n",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:15.490Z",
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "67.166.24.55"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186574,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "67.166.24.55",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "67.166.24.55",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32573",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "N9nvUmcBTFzn_XoL2Zh8",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:48.750Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30433"
+      },
+      "source": {
+        "ip": "217.182.55.191"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.182.55.191",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 44246,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ONnvUmcBTFzn_XoL2Zh8",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:48.750Z",
+      "source": {
+        "ip": "217.182.55.191"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.182.55.191",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44247
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30433",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "OdnvUmcBTFzn_XoL2Zh8",
+    "source": {
+      "@timestamp": "2018-11-27T02:11:48.858Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30433",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.182.55.191"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44248,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "217.182.55.191",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "217.182.55.191"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QNnwUmcBTFzn_XoLaKRf",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:25.330Z",
+      "source": {
+        "ip": "94.16.115.155"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "94.16.115.155",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43229,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "12990",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QdnwUmcBTFzn_XoLaKRf",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:25.330Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "12990",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "94.16.115.155"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "94.16.115.155",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43230
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "QtnwUmcBTFzn_XoLaKRf",
+    "source": {
+      "@timestamp": "2018-11-27T02:12:25.442Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "12990"
+      },
+      "source": {
+        "ip": "94.16.115.155"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "94.16.115.155"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "94.16.115.155",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43231
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6dr0UmcBTFzn_XoLnQBb",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.040Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26196",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184433,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6tr0UmcBTFzn_XoLnQBb",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.040Z",
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26196",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184434,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:setcred",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "69r0UmcBTFzn_XoLnQBb",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.042Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "26196",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 184436,
+        "result": "success",
+        "session": "9861",
+        "data": {
+          "op": "PAM:session_open",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7Nr0UmcBTFzn_XoLnQBb",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.045Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "26196"
+      },
+      "auditd": {
+        "sequence": 184437,
+        "result": "success",
+        "session": "9861",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "7dr0UmcBTFzn_XoLnQBb",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.045Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "26196"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_close",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 184438,
+        "result": "success",
+        "session": "9861"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8dr0UmcBTFzn_XoLnQD4",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.194Z",
+      "process": {
+        "pid": "30546",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44259
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8tr0UmcBTFzn_XoLnQD4",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.194Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "30546",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 44258
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "89r0UmcBTFzn_XoLnQD4",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.194Z",
+      "event": {
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "30546"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "1445",
+        "data": {
+          "acct": "root",
+          "op": "PAM:session_open",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44261
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9Nr0UmcBTFzn_XoLnQD4",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.198Z",
+      "event": {
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30546",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "1445",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 44262
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "9dr0UmcBTFzn_XoLnQD4",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.198Z",
+      "process": {
+        "pid": "30546",
+        "exe": "/usr/sbin/cron"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "sequence": 44263,
+        "result": "success",
+        "session": "1445",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "CNr0UmcBTFzn_XoLngEH",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.212Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "19971"
+      },
+      "auditd": {
+        "sequence": 142422,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:accounting",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Cdr0UmcBTFzn_XoLngEH",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.213Z",
+      "process": {
+        "pid": "19971",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142423,
+        "result": "success",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "action": "acquired-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_acq"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ctr0UmcBTFzn_XoLngEH",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.214Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19971",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "3504",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 142425
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "C9r0UmcBTFzn_XoLngEH",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.217Z",
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "19971",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "3504",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 142426
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DNr0UmcBTFzn_XoLngEH",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.218Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "19971",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 142427,
+        "result": "success",
+        "session": "3504",
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:session_close"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ddr0UmcBTFzn_XoLngEO",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.220Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "data": {
+          "acct": "root",
+          "op": "PAM:accounting",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192589,
+        "result": "success",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "947",
+        "exe": "/usr/sbin/cron"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Dtr0UmcBTFzn_XoLngEO",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.220Z",
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "947",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192590,
+        "result": "success"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9r0UmcBTFzn_XoLngEO",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.222Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "947",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "9865",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192592,
+        "result": "success"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ENr0UmcBTFzn_XoLngEO",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.225Z",
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "9865",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 192593
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "process": {
+        "pid": "947",
+        "exe": "/usr/sbin/cron"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Edr0UmcBTFzn_XoLngEO",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.226Z",
+      "user": {
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "0"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "947",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 192594,
+        "result": "success",
+        "session": "9865",
+        "data": {
+          "op": "PAM:session_close",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Etr0UmcBTFzn_XoLngEt",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.245Z",
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "13026"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:accounting"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43247
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E9r0UmcBTFzn_XoLngEt",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.249Z",
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13026",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 43248,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "op": "PAM:setcred",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNr0UmcBTFzn_XoLngEt",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.249Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "13026"
+      },
+      "auditd": {
+        "sequence": 43250,
+        "result": "success",
+        "session": "1253",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:session_open"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Fdr0UmcBTFzn_XoLngEt",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.257Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "disposed-credentials",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "cred_disp"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13026",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "1253",
+        "data": {
+          "op": "PAM:setcred",
+          "acct": "root",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43251,
+        "result": "success"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ftr0UmcBTFzn_XoLngEt",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.257Z",
+      "auditd": {
+        "sequence": 43252,
+        "result": "success",
+        "session": "1253",
+        "data": {
+          "terminal": "cron",
+          "op": "PAM:session_close",
+          "acct": "root"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/cron",
+        "pid": "13026"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INr0UmcBTFzn_XoLoAHh",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.906Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_acct",
+        "action": "was-authorized",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32605",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "sequence": 186590,
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "terminal": "cron",
+          "op": "PAM:accounting"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Idr0UmcBTFzn_XoLoAHh",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.907Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_acq",
+        "action": "acquired-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32605",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "root",
+          "op": "PAM:setcred",
+          "terminal": "cron"
+        },
+        "summary": {
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186591,
+        "result": "success"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Itr0UmcBTFzn_XoLoAHh",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.908Z",
+      "process": {
+        "pid": "32605",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "session": "3512",
+        "data": {
+          "op": "PAM:session_open",
+          "terminal": "cron",
+          "acct": "root"
+        },
+        "summary": {
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "secondary": "root",
+            "primary": "root"
+          }
+        },
+        "sequence": 186593,
+        "result": "success"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_start",
+        "action": "started-session",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "I9r0UmcBTFzn_XoLoAHh",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.911Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "pid": "32605",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "cron",
+          "acct": "root",
+          "op": "PAM:setcred"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "cron"
+          },
+          "how": "/usr/sbin/cron",
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186594,
+        "result": "success",
+        "session": "3512"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "cred_disp",
+        "action": "disposed-credentials",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        },
+        "auid": "0"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "JNr0UmcBTFzn_XoLoAHh",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:01.912Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_end",
+        "action": "ended-session",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "0",
+        "name_map": {
+          "auid": "root",
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32605",
+        "exe": "/usr/sbin/cron"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "root",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "cron",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/cron"
+        },
+        "sequence": 186595,
+        "result": "success",
+        "session": "3512",
+        "data": {
+          "op": "PAM:session_close",
+          "terminal": "cron",
+          "acct": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9r1UmcBTFzn_XoLvBrE",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:14.617Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "122.160.137.37",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142428
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "19981",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "122.160.137.37"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNr1UmcBTFzn_XoLvBrE",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:14.619Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "122.160.137.37",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142429,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19981",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "122.160.137.37"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Hdr1UmcBTFzn_XoLvBrE",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:14.905Z",
+      "source": {
+        "ip": "122.160.137.37"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142430,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "122.160.137.37",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "122.160.137.37",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "19981",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Htr1UmcBTFzn_XoLvRof",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:14.709Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "process": {
+        "pid": "960",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.207.220.128"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192598,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "200.207.220.128",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "H9r1UmcBTFzn_XoLvRof",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:14.710Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "960",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "200.207.220.128"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "200.207.220.128"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192599,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "INr1UmcBTFzn_XoLvRof",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:14.895Z",
+      "auditd": {
+        "data": {
+          "hostname": "200.207.220.128",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "200.207.220.128"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192600,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "960",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "200.207.220.128"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MtnzUmcBTFzn_XoLcefM",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:44.351Z",
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.135.208.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43241
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13016"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9nzUmcBTFzn_XoLcefM",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:44.351Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13016",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.135.208.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43242,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNnzUmcBTFzn_XoLcefM",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:44.487Z",
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "147.135.208.7"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "147.135.208.7",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43243,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13016",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9nzUmcBTFzn_XoLdeex",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:45.351Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32602",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186587,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNnzUmcBTFzn_XoLdeex",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:45.352Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186588,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32602",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdnzUmcBTFzn_XoLdeex",
+    "source": {
+      "@timestamp": "2018-11-27T02:15:45.383Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186589
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32602",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "J9r1UmcBTFzn_XoLwBpB",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:15.507Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13035",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "109.75.216.201"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "109.75.216.201",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43253,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNr1UmcBTFzn_XoLwBpB",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:15.507Z",
+      "process": {
+        "pid": "13035",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "109.75.216.201"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "109.75.216.201",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43254,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Kdr1UmcBTFzn_XoLwBpB",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:15.647Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13035",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "109.75.216.201"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "109.75.216.201",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43255,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "109.75.216.201"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "htr1UmcBTFzn_XoLxhrF",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:17.176Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "165.227.5.206"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43256,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13037"
+      },
+      "source": {
+        "ip": "165.227.5.206"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "h9r1UmcBTFzn_XoLxhrF",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:17.176Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "165.227.5.206",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43257,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13037"
+      },
+      "source": {
+        "ip": "165.227.5.206"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "iNr1UmcBTFzn_XoLxhrF",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:17.220Z",
+      "auditd": {
+        "sequence": 43258,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "165.227.5.206",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "165.227.5.206",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13037",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "165.227.5.206"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4tr2UmcBTFzn_XoLCyDa",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:34.864Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186599,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32621",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "49r2UmcBTFzn_XoLCyDa",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:34.866Z",
+      "process": {
+        "pid": "32621",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186600,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5Nr2UmcBTFzn_XoLCyDa",
+    "source": {
+      "@timestamp": "2018-11-27T02:18:34.896Z",
+      "process": {
+        "pid": "32621",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186601,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "107.170.65.109",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A9r0UmcBTFzn_XoLvwRX",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:09.740Z",
+      "process": {
+        "pid": "32613",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186596,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BNr0UmcBTFzn_XoLvwRX",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:09.742Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186597
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32613",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Bdr0UmcBTFzn_XoLvwRX",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:09.772Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186598,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32613",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9n0UmcBTFzn_XoLLvfV",
+    "source": {
+      "@timestamp": "2018-11-27T02:16:32.747Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26188",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.79.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184430,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.131.79.34"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNn0UmcBTFzn_XoLLvfV",
+    "source": {
+      "@timestamp": "2018-11-27T02:16:32.748Z",
+      "process": {
+        "pid": "26188",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.79.34"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184431,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "104.131.79.34"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adn0UmcBTFzn_XoLLvfV",
+    "source": {
+      "@timestamp": "2018-11-27T02:16:32.779Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "104.131.79.34"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.131.79.34",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184432,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26188",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.131.79.34"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wdr1UmcBTFzn_XoLdBNI",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:56.062Z",
+      "source": {
+        "ip": "89.156.152.134"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "89.156.152.134",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192595,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "957",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wtr1UmcBTFzn_XoLdBNI",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:56.063Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192596,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "89.156.152.134",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "957",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.156.152.134"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "w9r1UmcBTFzn_XoLdBNI",
+    "source": {
+      "@timestamp": "2018-11-27T02:17:56.190Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "89.156.152.134"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "89.156.152.134",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192597,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "957",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "89.156.152.134"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UNnzUmcBTFzn_XoLwu4u",
+    "source": {
+      "@timestamp": "2018-11-27T02:16:04.928Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13018",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.168.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.168.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43244,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UdnzUmcBTFzn_XoLwu4u",
+    "source": {
+      "@timestamp": "2018-11-27T02:16:04.928Z",
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.168.254",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 43245,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13018"
+      },
+      "source": {
+        "ip": "178.33.168.254"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UtnzUmcBTFzn_XoLwu4u",
+    "source": {
+      "@timestamp": "2018-11-27T02:16:05.048Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13018",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.168.254"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "178.33.168.254",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "178.33.168.254",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43246,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DdsBU2cBTFzn_XoL2SOm",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:28.442Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "147.135.208.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43274,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13130",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DtsBU2cBTFzn_XoL2SOm",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:28.442Z",
+      "process": {
+        "pid": "13130",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "147.135.208.7"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43275,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "147.135.208.7"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9sBU2cBTFzn_XoL2SOm",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:28.574Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "147.135.208.7"
+        },
+        "summary": {
+          "object": {
+            "secondary": "147.135.208.7",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43276,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13130",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "147.135.208.7"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ENsBU2cBTFzn_XoL2SOm",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:28.994Z",
+      "user": {
+        "suid": "0",
+        "name_map": {
+          "fsuid": "root",
+          "gid": "root",
+          "sgid": "root",
+          "suid": "root",
+          "uid": "root",
+          "egid": "root",
+          "euid": "root",
+          "fsgid": "root"
+        },
+        "gid": "0",
+        "auid": "unset",
+        "fsgid": "0",
+        "fsuid": "0",
+        "uid": "0",
+        "egid": "0",
+        "sgid": "0",
+        "euid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "ppid": "1379",
+        "title": "/sbin/iptables -w -I sshguard -s 147.135.208.7 -j DROP",
+        "name": "iptables",
+        "exe": "/sbin/xtables-multi",
+        "pid": "13132"
+      },
+      "auditd": {
+        "result": "success",
+        "session": "unset",
+        "data": {
+          "syscall": "setsockopt",
+          "a0": "5",
+          "tty": "(none)",
+          "table": "filter",
+          "a2": "40",
+          "a3": "8ae870",
+          "a1": "0",
+          "family": "2",
+          "entries": "154",
+          "arch": "x86_64",
+          "exit": "0"
+        },
+        "summary": {
+          "object": {
+            "primary": "filter",
+            "type": "firewall"
+          },
+          "how": "/sbin/xtables-multi",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43277
+      },
+      "event": {
+        "category": "configuration",
+        "type": "netfilter_cfg",
+        "action": "loaded-firewall-rule-to",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Ztr_UmcBTFzn_XoLP-rA",
+    "source": {
+      "@timestamp": "2018-11-27T02:28:37.974Z",
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186620
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32675",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9r_UmcBTFzn_XoLP-rA",
+    "source": {
+      "@timestamp": "2018-11-27T02:28:37.975Z",
+      "auditd": {
+        "sequence": 186621,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32675",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "aNr_UmcBTFzn_XoLP-rA",
+    "source": {
+      "@timestamp": "2018-11-27T02:28:38.007Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "107.170.65.109"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186622,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32675"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-dsAU2cBTFzn_XoLlQYl",
+    "source": {
+      "@timestamp": "2018-11-27T02:30:05.371Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32684"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186623,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "107.170.65.109",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-tsAU2cBTFzn_XoLlQYl",
+    "source": {
+      "@timestamp": "2018-11-27T02:30:05.372Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32684"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 186624,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "-9sAU2cBTFzn_XoLlQYl",
+    "source": {
+      "@timestamp": "2018-11-27T02:30:05.403Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32684"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186625,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "M9sBU2cBTFzn_XoLwCBF",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:21.946Z",
+      "auditd": {
+        "sequence": 186626,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "118.25.133.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "32692"
+      },
+      "source": {
+        "ip": "118.25.133.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NNsBU2cBTFzn_XoLwCBF",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:21.947Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32692",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "118.25.133.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186627,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "118.25.133.243",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "NdsBU2cBTFzn_XoLwCBF",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:22.162Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32692",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "118.25.133.243"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "118.25.133.243",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "118.25.133.243"
+          }
+        },
+        "sequence": 186628,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "D9oAU2cBTFzn_XoLOP8t",
+    "source": {
+      "@timestamp": "2018-11-27T02:29:41.565Z",
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.121.176"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.0.121.176",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43271,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ENoAU2cBTFzn_XoLOP8t",
+    "source": {
+      "@timestamp": "2018-11-27T02:29:41.569Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.0.121.176",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43272,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.121.176"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdoAU2cBTFzn_XoLOP8t",
+    "source": {
+      "@timestamp": "2018-11-27T02:29:41.677Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13117",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.121.176"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "128.0.121.176"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "128.0.121.176",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43273
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dNsBU2cBTFzn_XoL7CTn",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:33.373Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32694",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186629,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ddsBU2cBTFzn_XoL7CTn",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:33.375Z",
+      "process": {
+        "pid": "32694",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186630,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "107.170.65.109"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "dtsBU2cBTFzn_XoL7CTn",
+    "source": {
+      "@timestamp": "2018-11-27T02:31:33.406Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32694",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "107.170.65.109"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186631,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "107.170.65.109",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "107.170.65.109",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "G9sCU2cBTFzn_XoLvzai",
+    "source": {
+      "@timestamp": "2018-11-27T02:32:27.319Z",
+      "auditd": {
+        "sequence": 192613,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "198.27.80.211",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "1045"
+      },
+      "source": {
+        "ip": "198.27.80.211"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HNsCU2cBTFzn_XoLvzai",
+    "source": {
+      "@timestamp": "2018-11-27T02:32:27.320Z",
+      "source": {
+        "ip": "198.27.80.211"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "198.27.80.211",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192614,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1045",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "HdsCU2cBTFzn_XoLvzai",
+    "source": {
+      "@timestamp": "2018-11-27T02:32:27.362Z",
+      "auditd": {
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "198.27.80.211"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "198.27.80.211",
+            "type": "user-session"
+          }
+        },
+        "sequence": 192615,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1045",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "198.27.80.211"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Sdr-UmcBTFzn_XoLMtPX",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:29.130Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13103",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.67.193"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "54.37.67.193"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43268
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Str-UmcBTFzn_XoLMtPX",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:29.130Z",
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13103"
+      },
+      "source": {
+        "ip": "54.37.67.193"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "54.37.67.193"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43269,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9r-UmcBTFzn_XoLMtPX",
+    "source": {
+      "@timestamp": "2018-11-27T02:27:29.242Z",
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13103",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "54.37.67.193"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "54.37.67.193",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "secondary": "54.37.67.193",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 43270,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9sAU2cBTFzn_XoLYwI6",
+    "source": {
+      "@timestamp": "2018-11-27T02:29:52.590Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "30802",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.118.65"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44276,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "secondary": "128.0.118.65",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNsAU2cBTFzn_XoLYwI6",
+    "source": {
+      "@timestamp": "2018-11-27T02:29:52.590Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "128.0.118.65",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44277,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "30802"
+      },
+      "source": {
+        "ip": "128.0.118.65"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rdsAU2cBTFzn_XoLYwI6",
+    "source": {
+      "@timestamp": "2018-11-27T02:29:52.694Z",
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "30802",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.118.65"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "128.0.118.65"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.0.118.65",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44278,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0twMU2cBTFzn_XoL7xUF",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:34.811Z",
+      "source": {
+        "ip": "167.99.54.4"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184466,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "167.99.54.4"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26446"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "09wMU2cBTFzn_XoL7xUF",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:34.812Z",
+      "source": {
+        "ip": "167.99.54.4"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "167.99.54.4"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184467,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26446"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1NwMU2cBTFzn_XoL7xUF",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:34.843Z",
+      "process": {
+        "pid": "26446",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "167.99.54.4"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "167.99.54.4",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "167.99.54.4",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184468,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3dwMU2cBTFzn_XoL9RW0",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:36.522Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26448",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.120.174.127"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184469,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "37.120.174.127",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "3twMU2cBTFzn_XoL9RW0",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:36.524Z",
+      "source": {
+        "ip": "37.120.174.127"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "37.120.174.127",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184470
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26448",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "39wMU2cBTFzn_XoL9RW0",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:36.635Z",
+      "auditd": {
+        "sequence": 184471,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "37.120.174.127",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "37.120.174.127",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26448",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "37.120.174.127"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1twNU2cBTFzn_XoL_CyZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:43.822Z",
+      "source": {
+        "ip": "104.248.123.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "104.248.123.206",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 142450,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20137",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19wNU2cBTFzn_XoL_CyZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:43.823Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20137"
+      },
+      "source": {
+        "ip": "104.248.123.206"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "104.248.123.206",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142451,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "2NwNU2cBTFzn_XoL_CyZ",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:43.854Z",
+      "process": {
+        "pid": "20137",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "104.248.123.206"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142452,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "104.248.123.206",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.248.123.206",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdwMU2cBTFzn_XoLxRBj",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:22.108Z",
+      "source": {
+        "ip": "35.189.59.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "35.189.59.154",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184463,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26443",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stwMU2cBTFzn_XoLxRBj",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:22.109Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26443",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "35.189.59.154"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "35.189.59.154",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184464,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "s9wMU2cBTFzn_XoLxRBj",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:22.284Z",
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "35.189.59.154",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "35.189.59.154"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184465,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26443",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "35.189.59.154"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "S9wNU2cBTFzn_XoLwCiw",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:28.486Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "209.240.59.106"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186642,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "209.240.59.106"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32760",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TNwNU2cBTFzn_XoLwCiw",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:28.487Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32760",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.240.59.106"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "209.240.59.106",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186643,
+        "result": "fail",
+        "session": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "TdwNU2cBTFzn_XoLwCiw",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:28.539Z",
+      "process": {
+        "pid": "32760",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "209.240.59.106"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "209.240.59.106",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186644,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "209.240.59.106",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FNwNU2cBTFzn_XoL4yrB",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:37.463Z",
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32763",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.254.123.131"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.254.123.131",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186645,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FdwNU2cBTFzn_XoL4yrB",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:37.464Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "51.254.123.131",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186646
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "32763",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.254.123.131"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FtwNU2cBTFzn_XoL4yrB",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:37.575Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32763",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.254.123.131"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "51.254.123.131"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.254.123.131",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186647
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ldwMU2cBTFzn_XoLmw6z",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:13.482Z",
+      "process": {
+        "pid": "1168",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "158.69.59.90"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "158.69.59.90"
+          }
+        },
+        "sequence": 192646,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ltwMU2cBTFzn_XoLmw6z",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:13.483Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "158.69.59.90"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "158.69.59.90"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192647
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1168",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "l9wMU2cBTFzn_XoLmw6z",
+    "source": {
+      "@timestamp": "2018-11-27T02:43:13.525Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "158.69.59.90",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "158.69.59.90",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192648
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1168",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "158.69.59.90"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZdwOU2cBTFzn_XoLGy-N",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:51.746Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "71.174.75.11",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 186648,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      },
+      "process": {
+        "pid": "32765",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "71.174.75.11"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ZtwOU2cBTFzn_XoLGy-N",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:51.747Z",
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "71.174.75.11",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 186649,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "32765",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "71.174.75.11"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Z9wOU2cBTFzn_XoLGy-N",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:51.787Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "32765",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "71.174.75.11"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "71.174.75.11",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "71.174.75.11",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186650,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "C9wPU2cBTFzn_XoLYUv1",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:15.305Z",
+      "process": {
+        "pid": "13218",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.89.180.93"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "auditd": {
+        "sequence": 43288,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.89.180.93",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DNwPU2cBTFzn_XoLYUv1",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:15.305Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13218"
+      },
+      "source": {
+        "ip": "159.89.180.93"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43289,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.89.180.93",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "DdwPU2cBTFzn_XoLYUv1",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:15.337Z",
+      "source": {
+        "ip": "159.89.180.93"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "159.89.180.93",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "159.89.180.93",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43290,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13218",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_twNU2cBTFzn_XoLjiIW",
+    "source": {
+      "@timestamp": "2018-11-27T02:44:15.532Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "217.141.88.34"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "217.141.88.34"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142449
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20129",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.141.88.34"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5NwRU2cBTFzn_XoLtH2C",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:47.512Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142454,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "51.15.251.165"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20159",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.15.251.165"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5dwRU2cBTFzn_XoLtH2C",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:47.513Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20159"
+      },
+      "source": {
+        "ip": "51.15.251.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "51.15.251.165",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 142455,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5twRU2cBTFzn_XoLtH2C",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:47.619Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20159",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "51.15.251.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "51.15.251.165",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.15.251.165",
+            "type": "user-session"
+          }
+        },
+        "sequence": 142456,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdwQU2cBTFzn_XoLA1gL",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:56.545Z",
+      "process": {
+        "pid": "26473",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "35.243.183.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "35.243.183.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184472,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "stwQU2cBTFzn_XoLA1gL",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:56.546Z",
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26473",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "35.243.183.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "35.243.183.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184473,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "s9wQU2cBTFzn_XoLA1gL",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:56.586Z",
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26473"
+      },
+      "source": {
+        "ip": "35.243.183.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "35.243.183.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 184474,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "35.243.183.165",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mdwQU2cBTFzn_XoLL132",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:08.044Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "219.65.51.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "219.65.51.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 192649,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "mtwQU2cBTFzn_XoLL132",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:08.045Z",
+      "process": {
+        "pid": "1190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "source": {
+        "ip": "219.65.51.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "219.65.51.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192650
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "m9wQU2cBTFzn_XoLL132",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:08.272Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1190",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "219.65.51.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "219.65.51.21",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192651,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "219.65.51.21"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EdwQU2cBTFzn_XoLXmE8",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:19.890Z",
+      "auditd": {
+        "sequence": 184475,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.128.119.59",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26475"
+      },
+      "source": {
+        "ip": "178.128.119.59"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "EtwQU2cBTFzn_XoLXmE8",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:19.892Z",
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.128.119.59",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        },
+        "sequence": 184476,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.119.59"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E9wQU2cBTFzn_XoLXmE8",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:20.084Z",
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26475",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.128.119.59"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184477,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "178.128.119.59",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "178.128.119.59",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LNwRU2cBTFzn_XoLM3Pb",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:14.577Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "319"
+      },
+      "source": {
+        "ip": "120.197.130.118"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "120.197.130.118",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186654,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LdwRU2cBTFzn_XoLM3Pb",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:14.578Z",
+      "auditd": {
+        "sequence": 186655,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "120.197.130.118",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "319"
+      },
+      "source": {
+        "ip": "120.197.130.118"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "LtwRU2cBTFzn_XoLM3Pb",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:14.782Z",
+      "process": {
+        "pid": "319",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "120.197.130.118"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "120.197.130.118",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 186656,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "120.197.130.118"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gtwRU2cBTFzn_XoLA25t",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:02.179Z",
+      "process": {
+        "pid": "26483",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.118.65"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "128.0.118.65"
+          }
+        },
+        "sequence": 184478,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "g9wRU2cBTFzn_XoLA25t",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:02.180Z",
+      "process": {
+        "pid": "26483",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "128.0.118.65"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 184479,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "128.0.118.65",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "hNwRU2cBTFzn_XoLA25t",
+    "source": {
+      "@timestamp": "2018-11-27T02:48:02.288Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "128.0.118.65"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "128.0.118.65",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 184480,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26483",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.0.118.65"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1dwQU2cBTFzn_XoLnGVv",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:35.813Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "312",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "169.61.96.71"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "169.61.96.71",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186651
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "1twQU2cBTFzn_XoLnGVv",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:35.815Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "169.61.96.71",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 186652,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "312",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "169.61.96.71"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "19wQU2cBTFzn_XoLnGVv",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:35.854Z",
+      "auditd": {
+        "data": {
+          "hostname": "169.61.96.71",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "169.61.96.71",
+            "type": "user-session"
+          }
+        },
+        "sequence": 186653,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "312",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "169.61.96.71"
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ItwQU2cBTFzn_XoL2Gtu",
+    "source": {
+      "@timestamp": "2018-11-27T02:47:51.172Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20151"
+      },
+      "source": {
+        "ip": "104.248.157.6"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "104.248.157.6",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "104.248.157.6",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142453,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "adwPU2cBTFzn_XoLb0w5",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:18.698Z",
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "5.196.69.191"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "5.196.69.191",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44301,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "5.196.69.191"
+        }
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31309",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNwTU2cBTFzn_XoL0qyL",
+    "source": {
+      "@timestamp": "2018-11-27T02:51:06.273Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.182.170.81",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184484
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26505",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-apache-01"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "source": {
+        "ip": "217.182.170.81"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VdwTU2cBTFzn_XoL0qyL",
+    "source": {
+      "@timestamp": "2018-11-27T02:51:06.274Z",
+      "source": {
+        "ip": "217.182.170.81"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "217.182.170.81",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184485,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "26505"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VtwTU2cBTFzn_XoL0qyL",
+    "source": {
+      "@timestamp": "2018-11-27T02:51:06.381Z",
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "26505",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.182.170.81"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "ssh",
+          "hostname": "217.182.170.81",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "217.182.170.81",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184486,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "R9wSU2cBTFzn_XoLfY-L",
+    "source": {
+      "@timestamp": "2018-11-27T02:49:38.977Z",
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "188.123.122.128"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 186657,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.123.122.128",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "322"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SNwSU2cBTFzn_XoLfY-L",
+    "source": {
+      "@timestamp": "2018-11-27T02:49:38.978Z",
+      "auditd": {
+        "sequence": 186658,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "188.123.122.128",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-redis-01"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "322"
+      },
+      "source": {
+        "ip": "188.123.122.128"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "SdwSU2cBTFzn_XoLfY-L",
+    "source": {
+      "@timestamp": "2018-11-27T02:49:39.106Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "322"
+      },
+      "source": {
+        "ip": "188.123.122.128"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "188.123.122.128"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 186659,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "188.123.122.128",
+          "terminal": "ssh"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MNwUU2cBTFzn_XoL4MOf",
+    "source": {
+      "@timestamp": "2018-11-27T02:52:15.413Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "source": {
+        "ip": "37.187.0.20"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "37.187.0.20",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142457,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20179",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MdwUU2cBTFzn_XoL4MOf",
+    "source": {
+      "@timestamp": "2018-11-27T02:52:15.414Z",
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "37.187.0.20"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142458,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(invalid user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "37.187.0.20"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20179",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "MtwUU2cBTFzn_XoL4MOf",
+    "source": {
+      "@timestamp": "2018-11-27T02:52:15.522Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "20179"
+      },
+      "source": {
+        "ip": "37.187.0.20"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142459,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "37.187.0.20",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "37.187.0.20",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AdwTU2cBTFzn_XoLjKds",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:48.323Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "26498",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "162.243.253.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184481,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "162.243.253.67",
+            "type": "user-session"
+          }
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AtwTU2cBTFzn_XoLjKds",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:48.324Z",
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "sequence": 184482,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "162.243.253.67",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "26498",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "162.243.253.67"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "A9wTU2cBTFzn_XoLjKds",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:48.355Z",
+      "source": {
+        "ip": "162.243.253.67"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "162.243.253.67",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "162.243.253.67",
+            "type": "user-session"
+          }
+        },
+        "sequence": 184483,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "process": {
+        "pid": "26498",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KNwSU2cBTFzn_XoL6pgK",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:06.744Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43291,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "52.189.217.7"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13243",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "52.189.217.7"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KdwSU2cBTFzn_XoL6pgK",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:06.748Z",
+      "process": {
+        "pid": "13243",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "52.189.217.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43292,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "52.189.217.7",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "KtwSU2cBTFzn_XoL6pgK",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:06.964Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13243",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "52.189.217.7"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "52.189.217.7"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "52.189.217.7"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43293
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "pdwUU2cBTFzn_XoLmrwL",
+    "source": {
+      "@timestamp": "2018-11-27T02:51:57.342Z",
+      "process": {
+        "pid": "13252",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.122.222.185"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "45.122.222.185"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43294,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ptwUU2cBTFzn_XoLmrwL",
+    "source": {
+      "@timestamp": "2018-11-27T02:51:57.342Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "45.122.222.185"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "45.122.222.185",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43295,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13252"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "p9wUU2cBTFzn_XoLmrwL",
+    "source": {
+      "@timestamp": "2018-11-27T02:51:57.590Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13252",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "45.122.222.185"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43296,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "45.122.222.185",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "45.122.222.185",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        }
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0dwSU2cBTFzn_XoLxpVy",
+    "source": {
+      "@timestamp": "2018-11-27T02:49:57.640Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "331"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "source": {
+        "ip": "62.93.166.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "62.93.166.91",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186660,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0twSU2cBTFzn_XoLxpVy",
+    "source": {
+      "@timestamp": "2018-11-27T02:49:57.641Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "331",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "62.93.166.91"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "62.93.166.91",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186661,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "09wSU2cBTFzn_XoLxpVy",
+    "source": {
+      "@timestamp": "2018-11-27T02:49:57.762Z",
+      "process": {
+        "pid": "331",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "62.93.166.91"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "hostname": "62.93.166.91",
+          "op": "PAM:bad_ident",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "62.93.166.91"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 186662,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-redis-01",
+        "hostname": "demo-stack-redis-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-redis-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "UtwVU2cBTFzn_XoLNcpH",
+    "source": {
+      "@timestamp": "2018-11-27T02:52:37.083Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "86.104.220.26",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44305
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31435"
+      },
+      "source": {
+        "ip": "86.104.220.26"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "U9wVU2cBTFzn_XoLNcpH",
+    "source": {
+      "@timestamp": "2018-11-27T02:52:37.083Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44306,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "86.104.220.26",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "process": {
+        "pid": "31435",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.104.220.26"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "VNwVU2cBTFzn_XoLNcpH",
+    "source": {
+      "@timestamp": "2018-11-27T02:52:37.223Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "86.104.220.26",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "86.104.220.26",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44307,
+        "result": "fail"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31435",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "86.104.220.26"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "qtwTU2cBTFzn_XoLRqAf",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:30.321Z",
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31389",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.62.61.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.62.61.192",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44302,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "q9wTU2cBTFzn_XoLRqAf",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:30.321Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "178.62.61.192"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44303,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "31389",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.62.61.192"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "rNwTU2cBTFzn_XoLRqAf",
+    "source": {
+      "@timestamp": "2018-11-27T02:50:30.421Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "31389"
+      },
+      "source": {
+        "ip": "178.62.61.192"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "178.62.61.192",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44304,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "178.62.61.192"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cdwXU2cBTFzn_XoLm_-X",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:14.346Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "144.217.42.212",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43300,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13273",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.42.212"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ctwXU2cBTFzn_XoLm_-X",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:14.346Z",
+      "process": {
+        "pid": "13273",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.42.212"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "144.217.42.212",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43301
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "c9wXU2cBTFzn_XoLm_-X",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:14.386Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13273",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "144.217.42.212"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "144.217.42.212"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "144.217.42.212",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43302,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "ztwXU2cBTFzn_XoLn_8Q",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:15.179Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "1238",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "78.193.8.166"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192661,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "78.193.8.166",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z9wXU2cBTFzn_XoLn_8Q",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:15.185Z",
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1238",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "78.193.8.166"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192662,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "78.193.8.166",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "0NwXU2cBTFzn_XoLn_8Q",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:15.302Z",
+      "source": {
+        "ip": "78.193.8.166"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "secondary": "78.193.8.166",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192663,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "78.193.8.166",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1238",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8dwWU2cBTFzn_XoLK980",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:40.043Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1225",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "165.227.184.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192652,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "165.227.184.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "8twWU2cBTFzn_XoLK980",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:40.044Z",
+      "process": {
+        "pid": "1225",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "165.227.184.21"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "165.227.184.21"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 192653
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "89wWU2cBTFzn_XoLK980",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:40.074Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "165.227.184.21"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "165.227.184.21",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192654,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1225",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "165.227.184.21"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BdwWU2cBTFzn_XoLL-A3",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:41.070Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1227",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "206.81.24.64"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192655,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "206.81.24.64"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "BtwWU2cBTFzn_XoLL-A3",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:41.071Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192656,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(invalid user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "206.81.24.64"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1227",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "206.81.24.64"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "B9wWU2cBTFzn_XoLL-A3",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:41.179Z",
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "206.81.24.64",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "object": {
+            "secondary": "206.81.24.64",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          }
+        },
+        "sequence": 192657
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "1227",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "206.81.24.64"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "s9wWU2cBTFzn_XoLnOnq",
+    "source": {
+      "@timestamp": "2018-11-27T02:54:09.152Z",
+      "auditd": {
+        "sequence": 142460,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "103.100.209.44",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "20193",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.100.209.44"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tNwWU2cBTFzn_XoLnOnq",
+    "source": {
+      "@timestamp": "2018-11-27T02:54:09.153Z",
+      "process": {
+        "pid": "20193",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.100.209.44"
+      },
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "103.100.209.44",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 142461,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "tdwWU2cBTFzn_XoLnOnq",
+    "source": {
+      "@timestamp": "2018-11-27T02:54:09.326Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "auditd": {
+        "sequence": 142462,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "103.100.209.44"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "103.100.209.44"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "20193",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "103.100.209.44"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wNwWU2cBTFzn_XoLUOIL",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:49.472Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "81.66.86.4",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 192658,
+        "result": "fail"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1229",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.66.86.4"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wdwWU2cBTFzn_XoLUOIL",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:49.473Z",
+      "auditd": {
+        "sequence": 192659,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "sshd",
+            "secondary": "81.66.86.4"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1229",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.66.86.4"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "wtwWU2cBTFzn_XoLUOIL",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:49.586Z",
+      "process": {
+        "pid": "1229",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "81.66.86.4"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192660,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "81.66.86.4"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "81.66.86.4",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "r9wWU2cBTFzn_XoLJ98E",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:38.966Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "terminal": "sshd",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "122.15.119.41",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43297
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13265",
+        "exe": "/usr/sbin/sshd"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "source": {
+        "ip": "122.15.119.41"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sNwWU2cBTFzn_XoLJ98E",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:38.966Z",
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "122.15.119.41",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43298,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13265"
+      },
+      "source": {
+        "ip": "122.15.119.41"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdwWU2cBTFzn_XoLJ98E",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:39.222Z",
+      "process": {
+        "pid": "13265",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "122.15.119.41"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "122.15.119.41",
+            "type": "user-session",
+            "primary": "ssh"
+          }
+        },
+        "sequence": 43299,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "122.15.119.41",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4dwVU2cBTFzn_XoLtdX6",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:10.025Z",
+      "process": {
+        "pid": "31449",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.168.217"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "159.203.168.217",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44308,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4twVU2cBTFzn_XoLtdX6",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:10.029Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "159.203.168.217",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        },
+        "sequence": 44309,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        }
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31449",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "source": {
+        "ip": "159.203.168.217"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "49wVU2cBTFzn_XoLtdX6",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:10.057Z",
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31449",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "159.203.168.217"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44310,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "op": "PAM:bad_ident",
+          "hostname": "159.203.168.217"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "159.203.168.217",
+            "type": "user-session"
+          }
+        }
+      },
+      "beat": {
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-es-01"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YNwVU2cBTFzn_XoLyNec",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:14.798Z",
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31453",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.45.156"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.45.156",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44311,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YdwVU2cBTFzn_XoLyNec",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:14.798Z",
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "178.33.45.156",
+            "type": "user-session"
+          }
+        },
+        "sequence": 44312
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31453",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.45.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "YtwVU2cBTFzn_XoLyNec",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:14.906Z",
+      "process": {
+        "pid": "31453",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "178.33.45.156"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 44313,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "178.33.45.156",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "secondary": "178.33.45.156",
+            "type": "user-session",
+            "primary": "ssh"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zd0YU2cBTFzn_XoLHgkA",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:47.730Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "46.148.192.41",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44315,
+        "result": "fail"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31503",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.192.41"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "zt0YU2cBTFzn_XoLHgkA",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:47.730Z",
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31503",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.192.41"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "46.148.192.41",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44316,
+        "result": "fail"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "z90YU2cBTFzn_XoLHgkA",
+    "source": {
+      "@timestamp": "2018-11-27T02:55:47.874Z",
+      "auditd": {
+        "sequence": 44317,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "hostname": "46.148.192.41",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "46.148.192.41",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "31503",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "46.148.192.41"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "gdwVU2cBTFzn_XoL5dmB",
+    "source": {
+      "@timestamp": "2018-11-27T02:53:22.174Z",
+      "source": {
+        "ip": "149.202.54.124"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "149.202.54.124",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "149.202.54.124",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 44314,
+        "result": "fail"
+      },
+      "beat": {
+        "name": "demo-stack-es-01",
+        "hostname": "demo-stack-es-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-es-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "31457",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "E90aU2cBTFzn_XoLNjl5",
+    "source": {
+      "@timestamp": "2018-11-27T02:58:05.071Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          },
+          "object": {
+            "secondary": "217.8.49.195",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 192673,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1272",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.8.49.195"
+      },
+      "beat": {
+        "version": "7.0.0-alpha1",
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "FN0aU2cBTFzn_XoLNjl5",
+    "source": {
+      "@timestamp": "2018-11-27T02:58:05.072Z",
+      "process": {
+        "pid": "1272",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.8.49.195"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192674,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "secondary": "217.8.49.195",
+            "type": "user-session",
+            "primary": "sshd"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Fd0aU2cBTFzn_XoLNjl5",
+    "source": {
+      "@timestamp": "2018-11-27T02:58:05.216Z",
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "217.8.49.195",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "type": "user-session",
+            "primary": "ssh",
+            "secondary": "217.8.49.195"
+          }
+        },
+        "sequence": 192675,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1272",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "217.8.49.195"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5d0aU2cBTFzn_XoLw0Ro",
+    "source": {
+      "@timestamp": "2018-11-27T02:58:41.148Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13636"
+      },
+      "source": {
+        "ip": "197.53.106.203"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(unknown user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "secondary": "197.53.106.203",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43308,
+        "result": "fail",
+        "session": "unset"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5t0aU2cBTFzn_XoLw0Ro",
+    "source": {
+      "@timestamp": "2018-11-27T02:58:41.148Z",
+      "process": {
+        "pid": "13636",
+        "exe": "/usr/sbin/sshd"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "source": {
+        "ip": "197.53.106.203"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43309,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "197.53.106.203",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "590aU2cBTFzn_XoLw0Ro",
+    "source": {
+      "@timestamp": "2018-11-27T02:58:41.768Z",
+      "source": {
+        "ip": "197.53.106.203"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "hostname": "197.53.106.203",
+          "terminal": "ssh"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "197.53.106.203",
+            "type": "user-session"
+          }
+        },
+        "sequence": 43310
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "process": {
+        "pid": "13636",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "cN0bU2cBTFzn_XoLDkvX",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:00.461Z",
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "1275",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "71.112.175.120"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 192676,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "71.112.175.120"
+        },
+        "summary": {
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "71.112.175.120",
+            "type": "user-session"
+          }
+        }
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "4t0bU2cBTFzn_XoLaVLG",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:23.735Z",
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "198.100.156.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43311,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13643",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "198.100.156.214"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "490bU2cBTFzn_XoLaVLG",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:23.735Z",
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "terminal": "sshd",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "198.100.156.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43312,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13643"
+      },
+      "source": {
+        "ip": "198.100.156.214"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "5N0bU2cBTFzn_XoLaVLG",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:23.779Z",
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "terminal": "ssh",
+          "hostname": "198.100.156.214",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "secondary": "root",
+            "primary": "unset"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "198.100.156.214",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43313,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13643",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "198.100.156.214"
+      },
+      "network": {
+        "direction": "incoming"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xd0bU2cBTFzn_XoLclNQ",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:25.924Z",
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "auid": "unset",
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0"
+      },
+      "process": {
+        "pid": "13645",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.110.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "data": {
+          "terminal": "sshd",
+          "acct": "(unknown user)",
+          "op": "login"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "91.121.110.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          }
+        },
+        "sequence": 43314,
+        "result": "fail",
+        "session": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xt0bU2cBTFzn_XoLclNQ",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:25.924Z",
+      "source": {
+        "ip": "91.121.110.50"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43315,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "terminal": "sshd",
+          "op": "login",
+          "acct": "(invalid user)"
+        },
+        "summary": {
+          "object": {
+            "secondary": "91.121.110.50",
+            "type": "user-session",
+            "primary": "sshd"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "(invalid user)"
+          }
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13645"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "X90bU2cBTFzn_XoLclNQ",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:26.032Z",
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_err"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "13645",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "91.121.110.50"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43316,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "PAM:bad_ident",
+          "terminal": "ssh",
+          "hostname": "91.121.110.50"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "91.121.110.50",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_t0bU2cBTFzn_XoLelQ5",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:27.948Z",
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 43317,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.82.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(unknown user)",
+            "primary": "unset"
+          }
+        }
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "process": {
+        "pid": "13647",
+        "exe": "/usr/sbin/sshd"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "_90bU2cBTFzn_XoLelQ5",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:27.948Z",
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13647"
+      },
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "summary": {
+          "object": {
+            "primary": "sshd",
+            "secondary": "51.38.82.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "secondary": "(invalid user)",
+            "primary": "unset"
+          }
+        },
+        "sequence": 43318,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(invalid user)",
+          "terminal": "sshd"
+        }
+      },
+      "event": {
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login",
+        "type": "user_login"
+      },
+      "user": {
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "AN0bU2cBTFzn_XoLelU5",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:28.060Z",
+      "auditd": {
+        "data": {
+          "hostname": "51.38.82.60",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.38.82.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43319,
+        "result": "fail",
+        "session": "unset"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13647"
+      },
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Xa2ipWkBCQofM5eXEgsv",
+    "source": {
+      "@timestamp": "2018-11-27T02:59:28.060Z",
+      "auditd": {
+        "data": {
+          "hostname": "51.38.82.60",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          },
+          "object": {
+            "primary": "ssh",
+            "secondary": "51.38.82.60",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 43319,
+        "result": "fail",
+        "session": "unset"
+      },
+      "destination" : {
+        "ip" : "0.0.0.0",
+        "port" : "22"
+      },
+      "event": {
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user" : {
+        "group" : {
+          "name" : "root",
+          "id" : "0"
+        },
+        "id" : "0",
+        "name" : "root"
+      },
+      "process": {
+        "exe": "/usr/sbin/sshd",
+        "pid": "13647"
+      },
+      "source": {
+        "ip": "51.38.82.60"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-mysql-01",
+        "hostname": "demo-stack-mysql-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-mysql-01"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/data.json b/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/data.json
new file mode 100644
index 00000000000000..470e38e62ba51a
--- /dev/null
+++ b/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/data.json
@@ -0,0 +1,194 @@
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "Rs93UmcBTFzn_XoLWT6M",
+    "source": {
+      "@timestamp": "2018-11-27T00:00:11.544Z",
+      "process": {
+        "pid": "31964",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "128.199.87.213"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-nginx-01",
+        "hostname": "demo-stack-nginx-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-nginx-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "hostname": "128.199.87.213",
+          "terminal": "ssh",
+          "op": "PAM:bad_ident"
+        },
+        "summary": {
+          "object": {
+            "primary": "ssh",
+            "secondary": "128.199.87.213",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd",
+          "actor": {
+            "primary": "unset",
+            "secondary": "root"
+          }
+        },
+        "sequence": 192383,
+        "result": "fail"
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_err",
+        "action": "error",
+        "module": "auditd"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "auid": "unset",
+        "uid": "0"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "6Nr4UmcBTFzn_XoL4l6d",
+    "source": {
+      "@timestamp": "2018-11-27T02:21:40.914Z",
+      "host": {
+        "name": "demo-stack-haproxy-01"
+      },
+      "user": {
+        "auid": "unset",
+        "uid": "0",
+        "name_map": {
+          "uid": "root"
+        }
+      },
+      "process": {
+        "pid": "20001",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "82.62.233.163"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "auditd": {
+        "sequence": 142431,
+        "result": "fail",
+        "session": "unset",
+        "data": {
+          "acct": "(unknown user)",
+          "op": "login",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "82.62.233.163",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        }
+      },
+      "event": {
+        "category": "user-login",
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd"
+      },
+      "beat": {
+        "name": "demo-stack-haproxy-01",
+        "hostname": "demo-stack-haproxy-01",
+        "version": "7.0.0-alpha1"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "type": "doc",
+    "id": "sdwQU2cBTFzn_XoLA1gL",
+    "source": {
+      "@timestamp": "2018-11-27T02:46:56.545Z",
+      "process": {
+        "pid": "26473",
+        "exe": "/usr/sbin/sshd"
+      },
+      "source": {
+        "ip": "35.243.183.165"
+      },
+      "network": {
+        "direction": "incoming"
+      },
+      "beat": {
+        "name": "demo-stack-apache-01",
+        "hostname": "demo-stack-apache-01",
+        "version": "7.0.0-alpha1"
+      },
+      "host": {
+        "name": "demo-stack-apache-01"
+      },
+      "auditd": {
+        "session": "unset",
+        "data": {
+          "op": "login",
+          "acct": "(unknown user)",
+          "terminal": "sshd"
+        },
+        "summary": {
+          "actor": {
+            "primary": "unset",
+            "secondary": "(unknown user)"
+          },
+          "object": {
+            "primary": "sshd",
+            "secondary": "35.243.183.165",
+            "type": "user-session"
+          },
+          "how": "/usr/sbin/sshd"
+        },
+        "sequence": 184472,
+        "result": "fail"
+      },
+      "event": {
+        "type": "user_login",
+        "action": "logged-in",
+        "module": "auditd",
+        "category": "user-login"
+      },
+      "user": {
+        "name_map": {
+          "uid": "root"
+        },
+        "uid": "0",
+        "auid": "unset"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/mappings.json b/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/mappings.json
new file mode 100644
index 00000000000000..96aec998fcdcd3
--- /dev/null
+++ b/x-pack/test/functional/es_archives/auditbeat/kpi_hosts/mappings.json
@@ -0,0 +1,1903 @@
+{
+  "type": "index",
+  "value": {
+    "index": "auditbeat-7.0.0-alpha1-2018.11.27",
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "refresh_interval": "5s",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "beat.name",
+            "beat.hostname",
+            "beat.timezone",
+            "beat.version",
+            "tags",
+            "error.message",
+            "error.type",
+            "meta.cloud.provider",
+            "meta.cloud.instance_id",
+            "meta.cloud.instance_name",
+            "meta.cloud.machine_type",
+            "meta.cloud.availability_zone",
+            "meta.cloud.project_id",
+            "meta.cloud.region",
+            "docker.container.id",
+            "docker.container.image",
+            "docker.container.name",
+            "host.name",
+            "host.id",
+            "host.architecture",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.family",
+            "host.mac",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "event.module",
+            "event.action",
+            "file.path",
+            "raw",
+            "file.target_path",
+            "file.type",
+            "file.device",
+            "file.inode",
+            "file.uid",
+            "file.owner",
+            "file.gid",
+            "file.group",
+            "file.mode",
+            "file.origin",
+            "raw",
+            "file.selinux.user",
+            "file.selinux.role",
+            "file.selinux.domain",
+            "file.selinux.level",
+            "event.category",
+            "event.type",
+            "user.auid",
+            "user.uid",
+            "user.euid",
+            "user.fsuid",
+            "user.suid",
+            "user.gid",
+            "user.egid",
+            "user.sgid",
+            "user.fsgid",
+            "user.name_map.auid",
+            "user.name_map.uid",
+            "user.name_map.euid",
+            "user.name_map.fsuid",
+            "user.name_map.suid",
+            "user.name_map.gid",
+            "user.name_map.egid",
+            "user.name_map.sgid",
+            "user.name_map.fsgid",
+            "user.selinux.user",
+            "user.selinux.role",
+            "user.selinux.domain",
+            "user.selinux.level",
+            "user.selinux.category",
+            "process.pid",
+            "process.ppid",
+            "process.name",
+            "process.title",
+            "process.exe",
+            "process.cwd",
+            "process.args",
+            "source.port",
+            "source.hostname",
+            "source.path",
+            "destination.port",
+            "destination.hostname",
+            "destination.path",
+            "network.direction",
+            "auditd.session",
+            "auditd.result",
+            "auditd.summary.actor.primary",
+            "auditd.summary.actor.secondary",
+            "auditd.summary.object.type",
+            "auditd.summary.object.primary",
+            "auditd.summary.object.secondary",
+            "auditd.summary.how",
+            "auditd.paths.inode",
+            "auditd.paths.dev",
+            "auditd.paths.obj_user",
+            "auditd.paths.obj_role",
+            "auditd.paths.obj_domain",
+            "auditd.paths.obj_level",
+            "auditd.paths.objtype",
+            "auditd.paths.ouid",
+            "auditd.paths.rdev",
+            "auditd.paths.nametype",
+            "auditd.paths.ogid",
+            "auditd.paths.item",
+            "auditd.paths.mode",
+            "auditd.paths.name",
+            "auditd.data.action",
+            "auditd.data.minor",
+            "auditd.data.acct",
+            "auditd.data.addr",
+            "auditd.data.cipher",
+            "auditd.data.id",
+            "auditd.data.entries",
+            "auditd.data.kind",
+            "auditd.data.ksize",
+            "auditd.data.spid",
+            "auditd.data.arch",
+            "auditd.data.argc",
+            "auditd.data.major",
+            "auditd.data.unit",
+            "auditd.data.table",
+            "auditd.data.terminal",
+            "auditd.data.grantors",
+            "auditd.data.direction",
+            "auditd.data.op",
+            "auditd.data.tty",
+            "auditd.data.syscall",
+            "auditd.data.data",
+            "auditd.data.family",
+            "auditd.data.mac",
+            "auditd.data.pfs",
+            "auditd.data.items",
+            "auditd.data.a0",
+            "auditd.data.a1",
+            "auditd.data.a2",
+            "auditd.data.a3",
+            "auditd.data.hostname",
+            "auditd.data.lport",
+            "auditd.data.rport",
+            "auditd.data.exit",
+            "auditd.data.fp",
+            "auditd.data.laddr",
+            "auditd.data.sport",
+            "auditd.data.capability",
+            "auditd.data.nargs",
+            "auditd.data.new-enabled",
+            "auditd.data.audit_backlog_limit",
+            "auditd.data.dir",
+            "auditd.data.cap_pe",
+            "auditd.data.model",
+            "auditd.data.new_pp",
+            "auditd.data.old-enabled",
+            "auditd.data.oauid",
+            "auditd.data.old",
+            "auditd.data.banners",
+            "auditd.data.feature",
+            "auditd.data.vm-ctx",
+            "auditd.data.opid",
+            "auditd.data.seperms",
+            "auditd.data.seresult",
+            "auditd.data.new-rng",
+            "auditd.data.old-net",
+            "auditd.data.sigev_signo",
+            "auditd.data.ino",
+            "auditd.data.old_enforcing",
+            "auditd.data.old-vcpu",
+            "auditd.data.range",
+            "auditd.data.res",
+            "auditd.data.added",
+            "auditd.data.fam",
+            "auditd.data.nlnk-pid",
+            "auditd.data.subj",
+            "auditd.data.a[0-3]",
+            "auditd.data.cgroup",
+            "auditd.data.kernel",
+            "auditd.data.ocomm",
+            "auditd.data.new-net",
+            "auditd.data.permissive",
+            "auditd.data.class",
+            "auditd.data.compat",
+            "auditd.data.fi",
+            "auditd.data.changed",
+            "auditd.data.msg",
+            "auditd.data.dport",
+            "auditd.data.new-seuser",
+            "auditd.data.invalid_context",
+            "auditd.data.dmac",
+            "auditd.data.ipx-net",
+            "auditd.data.iuid",
+            "auditd.data.macproto",
+            "auditd.data.obj",
+            "auditd.data.ipid",
+            "auditd.data.new-fs",
+            "auditd.data.vm-pid",
+            "auditd.data.cap_pi",
+            "auditd.data.old-auid",
+            "auditd.data.oses",
+            "auditd.data.fd",
+            "auditd.data.igid",
+            "auditd.data.new-disk",
+            "auditd.data.parent",
+            "auditd.data.len",
+            "auditd.data.oflag",
+            "auditd.data.uuid",
+            "auditd.data.code",
+            "auditd.data.nlnk-grp",
+            "auditd.data.cap_fp",
+            "auditd.data.new-mem",
+            "auditd.data.seperm",
+            "auditd.data.enforcing",
+            "auditd.data.new-chardev",
+            "auditd.data.old-rng",
+            "auditd.data.outif",
+            "auditd.data.cmd",
+            "auditd.data.hook",
+            "auditd.data.new-level",
+            "auditd.data.sauid",
+            "auditd.data.sig",
+            "auditd.data.audit_backlog_wait_time",
+            "auditd.data.printer",
+            "auditd.data.old-mem",
+            "auditd.data.perm",
+            "auditd.data.old_pi",
+            "auditd.data.state",
+            "auditd.data.format",
+            "auditd.data.new_gid",
+            "auditd.data.tcontext",
+            "auditd.data.maj",
+            "auditd.data.watch",
+            "auditd.data.device",
+            "auditd.data.grp",
+            "auditd.data.bool",
+            "auditd.data.icmp_type",
+            "auditd.data.new_lock",
+            "auditd.data.old_prom",
+            "auditd.data.acl",
+            "auditd.data.ip",
+            "auditd.data.new_pi",
+            "auditd.data.default-context",
+            "auditd.data.inode_gid",
+            "auditd.data.new-log_passwd",
+            "auditd.data.new_pe",
+            "auditd.data.selected-context",
+            "auditd.data.cap_fver",
+            "auditd.data.file",
+            "auditd.data.net",
+            "auditd.data.virt",
+            "auditd.data.cap_pp",
+            "auditd.data.old-range",
+            "auditd.data.resrc",
+            "auditd.data.new-range",
+            "auditd.data.obj_gid",
+            "auditd.data.proto",
+            "auditd.data.old-disk",
+            "auditd.data.audit_failure",
+            "auditd.data.inif",
+            "auditd.data.vm",
+            "auditd.data.flags",
+            "auditd.data.nlnk-fam",
+            "auditd.data.old-fs",
+            "auditd.data.old-ses",
+            "auditd.data.seqno",
+            "auditd.data.fver",
+            "auditd.data.qbytes",
+            "auditd.data.seuser",
+            "auditd.data.cap_fe",
+            "auditd.data.new-vcpu",
+            "auditd.data.old-level",
+            "auditd.data.old_pp",
+            "auditd.data.daddr",
+            "auditd.data.old-role",
+            "auditd.data.ioctlcmd",
+            "auditd.data.smac",
+            "auditd.data.apparmor",
+            "auditd.data.fe",
+            "auditd.data.perm_mask",
+            "auditd.data.ses",
+            "auditd.data.cap_fi",
+            "auditd.data.obj_uid",
+            "auditd.data.reason",
+            "auditd.data.list",
+            "auditd.data.old_lock",
+            "auditd.data.bus",
+            "auditd.data.old_pe",
+            "auditd.data.new-role",
+            "auditd.data.prom",
+            "auditd.data.uri",
+            "auditd.data.audit_enabled",
+            "auditd.data.old-log_passwd",
+            "auditd.data.old-seuser",
+            "auditd.data.per",
+            "auditd.data.scontext",
+            "auditd.data.tclass",
+            "auditd.data.ver",
+            "auditd.data.new",
+            "auditd.data.val",
+            "auditd.data.img-ctx",
+            "auditd.data.old-chardev",
+            "auditd.data.old_val",
+            "auditd.data.success",
+            "auditd.data.inode_uid",
+            "auditd.data.removed",
+            "auditd.data.socket.port",
+            "auditd.data.socket.saddr",
+            "auditd.data.socket.addr",
+            "auditd.data.socket.family",
+            "auditd.data.socket.path",
+            "auditd.messages",
+            "auditd.warnings",
+            "geoip.continent_name",
+            "geoip.city_name",
+            "geoip.region_name",
+            "geoip.country_iso_code",
+            "hash.blake2b_256",
+            "hash.blake2b_384",
+            "hash.blake2b_512",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha224",
+            "hash.sha256",
+            "hash.sha384",
+            "hash.sha3_224",
+            "hash.sha3_256",
+            "hash.sha3_384",
+            "hash.sha3_512",
+            "hash.sha512",
+            "hash.sha512_224",
+            "hash.sha512_256",
+            "hash.xxh64",
+            "fields.*"
+          ]
+        },
+        "number_of_replicas": "0"
+      }
+    },
+    "mappings": {
+      "_meta": {
+        "version": "7.0.0-alpha1"
+      },
+      "dynamic_templates": [
+        {
+          "fields": {
+            "path_match": "fields.*",
+            "match_mapping_type": "string",
+            "mapping": {
+              "type": "keyword"
+            }
+          }
+        },
+        {
+          "docker.container.labels": {
+            "path_match": "docker.container.labels.*",
+            "match_mapping_type": "string",
+            "mapping": {
+              "type": "keyword"
+            }
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "match_mapping_type": "string",
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      ],
+      "date_detection": false,
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "auditd": {
+          "properties": {
+            "data": {
+              "properties": {
+                "a0": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "a1": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "a2": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "a3": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "a[0-3]": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "acct": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "acl": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "action": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "added": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "addr": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "apparmor": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "arch": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "argc": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "audit_backlog_limit": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "audit_backlog_wait_time": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "audit_enabled": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "audit_failure": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "banners": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "bool": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "bus": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_fe": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_fi": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_fp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_fver": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_pe": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_pi": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cap_pp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "capability": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cgroup": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "changed": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cipher": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "class": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "cmd": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "code": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "compat": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "daddr": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "data": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "default-context": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "device": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "dir": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "direction": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "dmac": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "dport": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "enforcing": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "entries": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "exit": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fam": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "family": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fd": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fe": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "feature": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fi": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "file": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "flags": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "format": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fver": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "grantors": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "grp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "hook": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "hostname": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "icmp_type": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "id": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "igid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "img-ctx": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "inif": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ino": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "inode_gid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "inode_uid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "invalid_context": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ioctlcmd": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ip": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ipid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ipx-net": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "items": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "iuid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "kernel": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "kind": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ksize": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "laddr": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "len": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "list": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "lport": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "mac": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "macproto": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "maj": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "major": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "minor": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "model": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "msg": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "nargs": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "net": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-chardev": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-disk": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-enabled": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-fs": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-level": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-log_passwd": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-mem": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-net": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-range": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-rng": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-role": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-seuser": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new-vcpu": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new_gid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new_lock": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new_pe": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new_pi": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "new_pp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "nlnk-fam": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "nlnk-grp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "nlnk-pid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "oauid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj_gid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj_uid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ocomm": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "oflag": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-auid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-chardev": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-disk": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-enabled": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-fs": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-level": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-log_passwd": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-mem": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-net": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-range": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-rng": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-role": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-ses": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-seuser": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old-vcpu": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_enforcing": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_lock": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_pe": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_pi": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_pp": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_prom": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "old_val": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "op": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "opid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "oses": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "outif": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "parent": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "per": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "perm": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "perm_mask": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "permissive": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "pfs": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "printer": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "prom": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "proto": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "qbytes": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "range": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "reason": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "removed": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "res": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "resrc": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "rport": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "sauid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "scontext": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "selected-context": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "seperm": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "seperms": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "seqno": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "seresult": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ses": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "seuser": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "sig": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "sigev_signo": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "smac": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "socket": {
+                  "properties": {
+                    "addr": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "family": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "path": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "port": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "saddr": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    }
+                  }
+                },
+                "spid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "sport": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "state": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "subj": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "success": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "syscall": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "table": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "tclass": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "tcontext": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "terminal": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "tty": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "unit": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "uri": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "uuid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "val": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ver": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "virt": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "vm": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "vm-ctx": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "vm-pid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "watch": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "messages": {
+              "type": "text",
+              "norms": false
+            },
+            "paths": {
+              "properties": {
+                "dev": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "inode": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "item": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "mode": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "name": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "nametype": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj_domain": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj_level": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj_role": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "obj_user": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "objtype": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ogid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "ouid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "rdev": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "result": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "session": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "summary": {
+              "properties": {
+                "actor": {
+                  "properties": {
+                    "primary": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "secondary": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    }
+                  }
+                },
+                "how": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "object": {
+                  "properties": {
+                    "primary": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "secondary": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    },
+                    "type": {
+                      "type": "keyword",
+                      "ignore_above": 1024
+                    }
+                  }
+                }
+              }
+            },
+            "warnings": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "beat": {
+          "properties": {
+            "hostname": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "name": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "timezone": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "version": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "hostname": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "path": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "port": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "id": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "image": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "labels": {
+                  "type": "object"
+                },
+                "name": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "type": "long"
+            },
+            "message": {
+              "type": "text",
+              "norms": false
+            },
+            "type": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "category": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "module": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "type": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "gid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "group": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "inode": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "mode": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "origin": {
+              "type": "text",
+              "norms": false,
+              "fields": {
+                "raw": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "owner": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "path": {
+              "type": "text",
+              "norms": false,
+              "fields": {
+                "raw": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "selinux": {
+              "properties": {
+                "domain": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "level": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "role": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "user": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "setgid": {
+              "type": "boolean"
+            },
+            "setuid": {
+              "type": "boolean"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "type": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "uid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "geoip": {
+          "properties": {
+            "city_name": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "continent_name": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "country_iso_code": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "region_name": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "blake2b_256": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "blake2b_384": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "blake2b_512": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "md5": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha1": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha224": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha256": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha384": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha3_224": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha3_256": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha3_384": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha3_512": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha512": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha512_224": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "sha512_256": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "xxh64": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "id": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "name": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "platform": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "version": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "name": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "namespace": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "uid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            }
+          }
+        },
+        "meta": {
+          "properties": {
+            "cloud": {
+              "properties": {
+                "availability_zone": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "instance_id": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "instance_name": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "machine_type": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "project_id": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "provider": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "region": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "direction": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "cwd": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "exe": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "name": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "pid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "ppid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "title": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "hostname": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "path": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "port": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        },
+        "tags": {
+          "type": "keyword",
+          "ignore_above": 1024
+        },
+        "user": {
+          "properties": {
+            "auid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "egid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "euid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "fsgid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "fsuid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "gid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "name_map": {
+              "properties": {
+                "auid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "egid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "euid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fsgid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "fsuid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "gid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "sgid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "suid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "uid": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "selinux": {
+              "properties": {
+                "category": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "domain": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "level": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "role": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                },
+                "user": {
+                  "type": "keyword",
+                  "ignore_above": 1024
+                }
+              }
+            },
+            "sgid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "suid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            },
+            "uid": {
+              "type": "keyword",
+              "ignore_above": 1024
+            }
+          }
+        }
+      }
+    },
+    "aliases": {}
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/filebeat/kpi_hosts/data.json b/x-pack/test/functional/es_archives/filebeat/kpi_hosts/data.json
new file mode 100644
index 00000000000000..847158e901338a
--- /dev/null
+++ b/x-pack/test/functional/es_archives/filebeat/kpi_hosts/data.json
@@ -0,0 +1,133 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "Lw4l02gBqd-n62Sw_lxm",
+    "index": "filebeat-7.0.0-iot-2019.06",
+    "source": {
+      "@timestamp": "2019-02-09T16:45:06.331Z",
+      "@version": "1",
+      "agent": {
+        "ephemeral_id": "97412477-f94f-4f25-a21f-4103798683db",
+        "hostname": "raspberrypi",
+        "id": "4d3ea604-27e5-4ec7-ab64-44f82285d776",
+        "type": "filebeat",
+        "version": "7.0.0"
+      },
+      "destination": {
+        "domain": "s3-iad-2.cf.dash.row.aiv-cdn.net",
+        "ip": "10.100.7.196",
+        "port": 57854
+      },
+      "ecs": {
+        "version": "1.0.0-beta2"
+      },
+      "event": {
+        "dataset": "suricata.eve",
+        "end": "2019-02-09T16:45:06.331Z",
+        "kind": "event",
+        "module": "suricata",
+        "type": "fileinfo"
+      },
+      "file": {
+        "path": "/dm/2$XTMWANo0Q2RZKlH-95UoAahZrOg~/8cdf/ad98/e000/4b0d-8f72-8faf9aa1a35a/c3d5b471-4e36-45e0-8ca7-d789366f3b31_audio_13.mp4",
+        "size": 48277
+      },
+      "fileset": {
+        "name": "eve"
+      },
+      "flow": {
+        "locality": "public"
+      },
+      "host": {
+        "architecture": "armv7l",
+        "containerized": false,
+        "hostname": "raspberrypi",
+        "id": "b19a781f683541a7a25ee345133aa399",
+        "name": "raspberrypi",
+        "os": {
+          "codename": "stretch",
+          "family": "",
+          "kernel": "4.14.50-v7+",
+          "name": "Raspbian GNU/Linux",
+          "platform": "raspbian",
+          "version": "9 (stretch)"
+        }
+      },
+      "http": {
+        "request": {
+          "method": "get"
+        },
+        "response": {
+          "body": {
+            "bytes": 48277
+          },
+          "status_code": 206
+        }
+      },
+      "input": {
+        "type": "log"
+      },
+      "labels": {
+        "pipeline": "filebeat-7.0.0-suricata-eve-pipeline"
+      },
+      "log": {
+        "file": {
+          "path": "/var/log/suricata/eve.json"
+        },
+        "offset": 1734115622
+      },
+      "network": {
+        "name": "iot",
+        "protocol": "http",
+        "transport": "tcp"
+      },
+      "service": {
+        "type": "suricata"
+      },
+      "source": {
+        "as": {
+          "num": 16509,
+          "org": "Amazon.com, Inc."
+        },
+        "domain": "server-54-239-220-184.ewr50.r.cloudfront.net",
+        "geo": {
+          "city_name": "Seattle",
+          "continent_name": "North America",
+          "country_iso_code": "US",
+          "location": {
+            "lat": 47.6103,
+            "lon": -122.3341
+          },
+          "region_iso_code": "US-WA",
+          "region_name": "Washington"
+        },
+        "ip": "54.239.220.184",
+        "port": 80
+      },
+      "suricata": {
+        "eve": {
+          "fileinfo": {
+            "state": "CLOSED",
+            "stored": false,
+            "tx_id": 102
+          },
+          "flow_id": 311011499414922,
+          "http": {
+            "http_content_type": "video/mp4",
+            "protocol": "HTTP/1.1"
+          },
+          "in_iface": "eth0"
+        }
+      },
+      "tags": [
+        "suricata"
+      ],
+      "url": {
+        "domain": "s3-iad-2.cf.dash.row.aiv-cdn.net",
+        "original": "/dm/2$XTMWANo0Q2RZKlH-95UoAahZrOg~/8cdf/ad98/e000/4b0d-8f72-8faf9aa1a35a/c3d5b471-4e36-45e0-8ca7-d789366f3b31_audio_13.mp4",
+        "path": "/dm/2$XTMWANo0Q2RZKlH-95UoAahZrOg~/8cdf/ad98/e000/4b0d-8f72-8faf9aa1a35a/c3d5b471-4e36-45e0-8ca7-d789366f3b31_audio_13.mp4"
+      }
+    },
+    "type": "_doc"
+  }
+}
diff --git a/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json b/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json
new file mode 100644
index 00000000000000..1059fa49582f89
--- /dev/null
+++ b/x-pack/test/functional/es_archives/filebeat/kpi_hosts/mappings.json
@@ -0,0 +1,5940 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "filebeat-7.0.0-iot-2019.06",
+    "mappings": {
+      "_meta": {
+        "beat": "filebeat",
+        "version": "7.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kibana.log.meta": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "kibana.log.meta.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "@version": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "apache": {
+          "properties": {
+            "access": {
+              "properties": {
+                "ssl": {
+                  "properties": {
+                    "cipher": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protocol": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apache2": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "type": "object"
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "log": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "type": "ip"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "type": "ip"
+                },
+                "lport": {
+                  "type": "long"
+                },
+                "new_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "type": "long"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "certificate": {
+          "properties": {
+            "common_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "cisco": {
+          "properties": {
+            "access_list": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "severity": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "num": {
+                  "type": "long"
+                },
+                "org": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain_top1m_rank": {
+              "type": "long"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "locality": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "elasticsearch": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "indices": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "layer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "origin": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "realm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "request": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "url": {
+                  "properties": {
+                    "params": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "realm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "roles": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "cluster": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "component": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "deprecation": {
+              "type": "object"
+            },
+            "gc": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "jvm_runtime_sec": {
+                  "type": "float"
+                },
+                "old_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "phase": {
+                  "properties": {
+                    "class_unload_time_sec": {
+                      "type": "float"
+                    },
+                    "cpu_time": {
+                      "properties": {
+                        "real_sec": {
+                          "type": "float"
+                        },
+                        "sys_sec": {
+                          "type": "float"
+                        },
+                        "user_sec": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "duration_sec": {
+                      "type": "float"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "parallel_rescan_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_string_table_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_symbol_table_time_sec": {
+                      "type": "float"
+                    },
+                    "weak_refs_processing_time_sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "stopping_threads_time_sec": {
+                  "type": "float"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "threads_total_stop_time_sec": {
+                  "type": "float"
+                },
+                "young_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "index": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "node": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "server": {
+              "properties": {
+                "gc": {
+                  "properties": {
+                    "collection_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "observation_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "overhead_seq": {
+                      "type": "long"
+                    },
+                    "young": {
+                      "properties": {
+                        "one": {
+                          "type": "long"
+                        },
+                        "two": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "stacktrace": {
+                  "ignore_above": 1024,
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "shard": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "extra_source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "routing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "search_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source_query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stats": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_hits": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_shards": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fileset": {
+          "properties": {
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "flow": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "locality": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "haproxy": {
+          "properties": {
+            "backend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "backend_queue": {
+              "type": "long"
+            },
+            "bind_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes_read": {
+              "type": "long"
+            },
+            "client": {
+              "type": "object"
+            },
+            "connection_wait_time_ms": {
+              "type": "long"
+            },
+            "connections": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                },
+                "backend": {
+                  "type": "long"
+                },
+                "frontend": {
+                  "type": "long"
+                },
+                "retries": {
+                  "type": "long"
+                },
+                "server": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "type": "object"
+            },
+            "error_message": {
+              "norms": false,
+              "type": "text"
+            },
+            "frontend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geoip": {
+              "type": "object"
+            },
+            "http": {
+              "properties": {
+                "request": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_request_line": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "time_wait_ms": {
+                      "type": "long"
+                    },
+                    "time_wait_without_data_ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "response": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_queue": {
+              "type": "long"
+            },
+            "source": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tcp": {
+              "properties": {
+                "connection_waiting_time_ms": {
+                  "type": "long"
+                }
+              }
+            },
+            "termination_state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "time_backend_connect": {
+              "type": "long"
+            },
+            "time_queue": {
+              "type": "long"
+            },
+            "total_waiting_time_ms": {
+              "type": "long"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hostname": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icinga": {
+          "properties": {
+            "debug": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "main": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "startup": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "icmp": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "iis": {
+          "properties": {
+            "access": {
+              "properties": {
+                "cookie": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "site_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sub_status": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "type": "object"
+                },
+                "win32_status": {
+                  "type": "long"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "queue_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "input": {
+          "properties": {
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "iptables": {
+          "properties": {
+            "ether_type": {
+              "type": "long"
+            },
+            "flow_label": {
+              "type": "long"
+            },
+            "fragment_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment_offset": {
+              "type": "long"
+            },
+            "icmp": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "long"
+                },
+                "parameter": {
+                  "type": "long"
+                },
+                "redirect": {
+                  "type": "ip"
+                },
+                "seq": {
+                  "type": "long"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "type": "long"
+            },
+            "incomplete_bytes": {
+              "type": "long"
+            },
+            "input_device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "length": {
+              "type": "long"
+            },
+            "output_device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "precedence_bits": {
+              "type": "short"
+            },
+            "tcp": {
+              "properties": {
+                "ack": {
+                  "type": "long"
+                },
+                "flags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reserved_bits": {
+                  "type": "short"
+                },
+                "seq": {
+                  "type": "long"
+                },
+                "window": {
+                  "type": "long"
+                }
+              }
+            },
+            "tos": {
+              "type": "long"
+            },
+            "ttl": {
+              "type": "long"
+            },
+            "ubiquiti": {
+              "properties": {
+                "input_zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "output_zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rule_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rule_set": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "udp": {
+              "properties": {
+                "length": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kafka": {
+          "properties": {
+            "log": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trace": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "message": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "log": {
+              "properties": {
+                "meta": {
+                  "type": "object"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pipeline": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "file": {
+              "properties": {
+                "path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "offset": {
+              "type": "long"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "source": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "logstash": {
+          "properties": {
+            "log": {
+              "properties": {
+                "log_event": {
+                  "type": "object"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "event": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params_object": {
+                  "type": "object"
+                },
+                "plugin_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took_in_millis": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "mongodb": {
+          "properties": {
+            "log": {
+              "properties": {
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "error": {
+              "type": "object"
+            },
+            "slowlog": {
+              "properties": {
+                "bytes_sent": {
+                  "type": "long"
+                },
+                "current_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "filesort": {
+                  "type": "boolean"
+                },
+                "filesort_on_disk": {
+                  "type": "boolean"
+                },
+                "full_join": {
+                  "type": "boolean"
+                },
+                "full_scan": {
+                  "type": "boolean"
+                },
+                "innodb": {
+                  "properties": {
+                    "io_r_bytes": {
+                      "type": "long"
+                    },
+                    "io_r_ops": {
+                      "type": "long"
+                    },
+                    "io_r_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "pages_distinct": {
+                      "type": "long"
+                    },
+                    "queue_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "rec_lock_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "trx_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "killed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "last_errno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lock_time": {
+                  "properties": {
+                    "sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "log_slow_rate_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "log_slow_rate_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "merge_passes": {
+                  "type": "long"
+                },
+                "priority_queue": {
+                  "type": "boolean"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query_cache_hit": {
+                  "type": "boolean"
+                },
+                "rows_affected": {
+                  "type": "long"
+                },
+                "rows_examined": {
+                  "type": "long"
+                },
+                "rows_sent": {
+                  "type": "long"
+                },
+                "schema": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tmp_disk_tables": {
+                  "type": "long"
+                },
+                "tmp_table": {
+                  "type": "boolean"
+                },
+                "tmp_table_on_disk": {
+                  "type": "boolean"
+                },
+                "tmp_table_sizes": {
+                  "type": "long"
+                },
+                "tmp_tables": {
+                  "type": "long"
+                }
+              }
+            },
+            "thread_id": {
+              "type": "long"
+            }
+          }
+        },
+        "netflow": {
+          "properties": {
+            "absolute_error": {
+              "type": "double"
+            },
+            "address_pool_high_threshold": {
+              "type": "long"
+            },
+            "address_pool_low_threshold": {
+              "type": "long"
+            },
+            "address_port_mapping_high_threshold": {
+              "type": "long"
+            },
+            "address_port_mapping_low_threshold": {
+              "type": "long"
+            },
+            "address_port_mapping_per_user_high_threshold": {
+              "type": "long"
+            },
+            "anonymization_flags": {
+              "type": "long"
+            },
+            "anonymization_technique": {
+              "type": "long"
+            },
+            "application_category_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_group_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_id": {
+              "type": "short"
+            },
+            "application_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_sub_category_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bgp_destination_as_number": {
+              "type": "long"
+            },
+            "bgp_next_adjacent_as_number": {
+              "type": "long"
+            },
+            "bgp_next_hop_ipv4_address": {
+              "type": "ip"
+            },
+            "bgp_next_hop_ipv6_address": {
+              "type": "ip"
+            },
+            "bgp_prev_adjacent_as_number": {
+              "type": "long"
+            },
+            "bgp_source_as_number": {
+              "type": "long"
+            },
+            "bgp_validity_state": {
+              "type": "short"
+            },
+            "biflow_direction": {
+              "type": "short"
+            },
+            "class_id": {
+              "type": "short"
+            },
+            "class_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification_engine_id": {
+              "type": "short"
+            },
+            "collection_time_milliseconds": {
+              "type": "date"
+            },
+            "collector_certificate": {
+              "type": "short"
+            },
+            "collector_ipv4_address": {
+              "type": "ip"
+            },
+            "collector_ipv6_address": {
+              "type": "ip"
+            },
+            "collector_transport_port": {
+              "type": "long"
+            },
+            "common_properties_id": {
+              "type": "long"
+            },
+            "confidence_level": {
+              "type": "double"
+            },
+            "connection_sum_duration_seconds": {
+              "type": "long"
+            },
+            "connection_transaction_id": {
+              "type": "long"
+            },
+            "data_link_frame_section": {
+              "type": "short"
+            },
+            "data_link_frame_size": {
+              "type": "long"
+            },
+            "data_link_frame_type": {
+              "type": "long"
+            },
+            "data_records_reliability": {
+              "type": "boolean"
+            },
+            "delta_flow_count": {
+              "type": "long"
+            },
+            "destination_ipv4_address": {
+              "type": "ip"
+            },
+            "destination_ipv4_prefix": {
+              "type": "ip"
+            },
+            "destination_ipv4_prefix_length": {
+              "type": "short"
+            },
+            "destination_ipv6_address": {
+              "type": "ip"
+            },
+            "destination_ipv6_prefix": {
+              "type": "ip"
+            },
+            "destination_ipv6_prefix_length": {
+              "type": "short"
+            },
+            "destination_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "destination_transport_port": {
+              "type": "long"
+            },
+            "digest_hash_value": {
+              "type": "long"
+            },
+            "distinct_count_of_destinatio_nipa_ddress": {
+              "type": "long"
+            },
+            "distinct_count_of_destination_ipv4_address": {
+              "type": "long"
+            },
+            "distinct_count_of_destination_ipv6_address": {
+              "type": "long"
+            },
+            "distinct_count_of_sourc_eipa_ddress": {
+              "type": "long"
+            },
+            "distinct_count_of_source_ipv4_address": {
+              "type": "long"
+            },
+            "distinct_count_of_source_ipv6_address": {
+              "type": "long"
+            },
+            "dot1q_customer_dei": {
+              "type": "boolean"
+            },
+            "dot1q_customer_destination_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "dot1q_customer_priority": {
+              "type": "short"
+            },
+            "dot1q_customer_source_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "dot1q_customer_vlan_id": {
+              "type": "long"
+            },
+            "dot1q_dei": {
+              "type": "boolean"
+            },
+            "dot1q_priority": {
+              "type": "short"
+            },
+            "dot1q_service_instance_id": {
+              "type": "long"
+            },
+            "dot1q_service_instance_priority": {
+              "type": "short"
+            },
+            "dot1q_service_instance_tag": {
+              "type": "short"
+            },
+            "dot1q_vlan_id": {
+              "type": "long"
+            },
+            "dropped_layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "dropped_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "dropped_octet_delta_count": {
+              "type": "long"
+            },
+            "dropped_octet_total_count": {
+              "type": "long"
+            },
+            "dropped_packet_delta_count": {
+              "type": "long"
+            },
+            "dropped_packet_total_count": {
+              "type": "long"
+            },
+            "dst_traffic_index": {
+              "type": "long"
+            },
+            "egress_broadcast_packet_total_count": {
+              "type": "long"
+            },
+            "egress_interface": {
+              "type": "long"
+            },
+            "egress_interface_type": {
+              "type": "long"
+            },
+            "egress_physical_interface": {
+              "type": "long"
+            },
+            "egress_unicast_packet_total_count": {
+              "type": "long"
+            },
+            "egress_vrfid": {
+              "type": "long"
+            },
+            "encrypted_technology": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "engine_id": {
+              "type": "short"
+            },
+            "engine_type": {
+              "type": "short"
+            },
+            "ethernet_header_length": {
+              "type": "short"
+            },
+            "ethernet_payload_length": {
+              "type": "long"
+            },
+            "ethernet_total_length": {
+              "type": "long"
+            },
+            "ethernet_type": {
+              "type": "long"
+            },
+            "export_interface": {
+              "type": "long"
+            },
+            "export_protocol_version": {
+              "type": "short"
+            },
+            "export_sctp_stream_id": {
+              "type": "long"
+            },
+            "export_transport_protocol": {
+              "type": "short"
+            },
+            "exported_flow_record_total_count": {
+              "type": "long"
+            },
+            "exported_message_total_count": {
+              "type": "long"
+            },
+            "exported_octet_total_count": {
+              "type": "long"
+            },
+            "exporter": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source_id": {
+                  "type": "long"
+                },
+                "timestamp": {
+                  "type": "date"
+                },
+                "uptime_millis": {
+                  "type": "long"
+                },
+                "version": {
+                  "type": "long"
+                }
+              }
+            },
+            "exporter_certificate": {
+              "type": "short"
+            },
+            "exporter_ipv4_address": {
+              "type": "ip"
+            },
+            "exporter_ipv6_address": {
+              "type": "ip"
+            },
+            "exporter_transport_port": {
+              "type": "long"
+            },
+            "exporting_process_id": {
+              "type": "long"
+            },
+            "external_address_realm": {
+              "type": "short"
+            },
+            "firewall_event": {
+              "type": "short"
+            },
+            "flags_and_sampler_id": {
+              "type": "long"
+            },
+            "flow_active_timeout": {
+              "type": "long"
+            },
+            "flow_direction": {
+              "type": "short"
+            },
+            "flow_duration_microseconds": {
+              "type": "long"
+            },
+            "flow_duration_milliseconds": {
+              "type": "long"
+            },
+            "flow_end_delta_microseconds": {
+              "type": "long"
+            },
+            "flow_end_microseconds": {
+              "type": "date"
+            },
+            "flow_end_milliseconds": {
+              "type": "date"
+            },
+            "flow_end_nanoseconds": {
+              "type": "date"
+            },
+            "flow_end_reason": {
+              "type": "short"
+            },
+            "flow_end_seconds": {
+              "type": "date"
+            },
+            "flow_end_sys_up_time": {
+              "type": "long"
+            },
+            "flow_id": {
+              "type": "long"
+            },
+            "flow_idle_timeout": {
+              "type": "long"
+            },
+            "flow_key_indicator": {
+              "type": "long"
+            },
+            "flow_label_ipv6": {
+              "type": "long"
+            },
+            "flow_sampling_time_interval": {
+              "type": "long"
+            },
+            "flow_sampling_time_spacing": {
+              "type": "long"
+            },
+            "flow_selected_flow_delta_count": {
+              "type": "long"
+            },
+            "flow_selected_octet_delta_count": {
+              "type": "long"
+            },
+            "flow_selected_packet_delta_count": {
+              "type": "long"
+            },
+            "flow_selector_algorithm": {
+              "type": "long"
+            },
+            "flow_start_delta_microseconds": {
+              "type": "long"
+            },
+            "flow_start_microseconds": {
+              "type": "date"
+            },
+            "flow_start_milliseconds": {
+              "type": "date"
+            },
+            "flow_start_nanoseconds": {
+              "type": "date"
+            },
+            "flow_start_seconds": {
+              "type": "date"
+            },
+            "flow_start_sys_up_time": {
+              "type": "long"
+            },
+            "forwarding_status": {
+              "type": "short"
+            },
+            "fragment_flags": {
+              "type": "short"
+            },
+            "fragment_identification": {
+              "type": "long"
+            },
+            "fragment_offset": {
+              "type": "long"
+            },
+            "global_address_mapping_high_threshold": {
+              "type": "long"
+            },
+            "gre_key": {
+              "type": "long"
+            },
+            "hash_digest_output": {
+              "type": "boolean"
+            },
+            "hash_flow_domain": {
+              "type": "long"
+            },
+            "hash_initialiser_value": {
+              "type": "long"
+            },
+            "hash_ipp_ayload_offset": {
+              "type": "long"
+            },
+            "hash_ipp_ayload_size": {
+              "type": "long"
+            },
+            "hash_output_range_max": {
+              "type": "long"
+            },
+            "hash_output_range_min": {
+              "type": "long"
+            },
+            "hash_selected_range_max": {
+              "type": "long"
+            },
+            "hash_selected_range_min": {
+              "type": "long"
+            },
+            "http_content_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_message_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_reason_phrase": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_request_host": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_request_method": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_request_target": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_status_code": {
+              "type": "long"
+            },
+            "http_user_agent": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "icmp_code_ipv4": {
+              "type": "short"
+            },
+            "icmp_code_ipv6": {
+              "type": "short"
+            },
+            "icmp_type_code_ipv4": {
+              "type": "long"
+            },
+            "icmp_type_code_ipv6": {
+              "type": "long"
+            },
+            "icmp_type_ipv4": {
+              "type": "short"
+            },
+            "icmp_type_ipv6": {
+              "type": "short"
+            },
+            "igmp_type": {
+              "type": "short"
+            },
+            "ignored_data_record_total_count": {
+              "type": "long"
+            },
+            "ignored_layer2_frame_total_count": {
+              "type": "long"
+            },
+            "ignored_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "ignored_octet_total_count": {
+              "type": "long"
+            },
+            "ignored_packet_total_count": {
+              "type": "long"
+            },
+            "information_element_data_type": {
+              "type": "short"
+            },
+            "information_element_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "information_element_id": {
+              "type": "long"
+            },
+            "information_element_index": {
+              "type": "long"
+            },
+            "information_element_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "information_element_range_begin": {
+              "type": "long"
+            },
+            "information_element_range_end": {
+              "type": "long"
+            },
+            "information_element_semantics": {
+              "type": "short"
+            },
+            "information_element_units": {
+              "type": "long"
+            },
+            "ingress_broadcast_packet_total_count": {
+              "type": "long"
+            },
+            "ingress_interface": {
+              "type": "long"
+            },
+            "ingress_interface_type": {
+              "type": "long"
+            },
+            "ingress_multicast_packet_total_count": {
+              "type": "long"
+            },
+            "ingress_physical_interface": {
+              "type": "long"
+            },
+            "ingress_unicast_packet_total_count": {
+              "type": "long"
+            },
+            "ingress_vrfid": {
+              "type": "long"
+            },
+            "initiator_octets": {
+              "type": "long"
+            },
+            "initiator_packets": {
+              "type": "long"
+            },
+            "interface_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "interface_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "intermediate_process_id": {
+              "type": "long"
+            },
+            "internal_address_realm": {
+              "type": "short"
+            },
+            "ip_class_of_service": {
+              "type": "short"
+            },
+            "ip_diff_serv_code_point": {
+              "type": "short"
+            },
+            "ip_header_length": {
+              "type": "short"
+            },
+            "ip_header_packet_section": {
+              "type": "short"
+            },
+            "ip_next_hop_ipv4_address": {
+              "type": "ip"
+            },
+            "ip_next_hop_ipv6_address": {
+              "type": "ip"
+            },
+            "ip_payload_length": {
+              "type": "long"
+            },
+            "ip_payload_packet_section": {
+              "type": "short"
+            },
+            "ip_precedence": {
+              "type": "short"
+            },
+            "ip_sec_spi": {
+              "type": "long"
+            },
+            "ip_total_length": {
+              "type": "long"
+            },
+            "ip_ttl": {
+              "type": "short"
+            },
+            "ip_version": {
+              "type": "short"
+            },
+            "ipv4_ihl": {
+              "type": "short"
+            },
+            "ipv4_options": {
+              "type": "long"
+            },
+            "ipv4_router_sc": {
+              "type": "ip"
+            },
+            "ipv6_extension_headers": {
+              "type": "long"
+            },
+            "is_multicast": {
+              "type": "short"
+            },
+            "layer2_frame_delta_count": {
+              "type": "long"
+            },
+            "layer2_frame_total_count": {
+              "type": "long"
+            },
+            "layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "layer2_octet_delta_sum_of_squares": {
+              "type": "long"
+            },
+            "layer2_octet_total_count": {
+              "type": "long"
+            },
+            "layer2_octet_total_sum_of_squares": {
+              "type": "long"
+            },
+            "layer2_segment_id": {
+              "type": "long"
+            },
+            "layer2packet_section_data": {
+              "type": "short"
+            },
+            "layer2packet_section_offset": {
+              "type": "long"
+            },
+            "layer2packet_section_size": {
+              "type": "long"
+            },
+            "line_card_id": {
+              "type": "long"
+            },
+            "lower_cli_imit": {
+              "type": "double"
+            },
+            "max_bieb_ntries": {
+              "type": "long"
+            },
+            "max_entries_per_user": {
+              "type": "long"
+            },
+            "max_export_seconds": {
+              "type": "date"
+            },
+            "max_flow_end_microseconds": {
+              "type": "date"
+            },
+            "max_flow_end_milliseconds": {
+              "type": "date"
+            },
+            "max_flow_end_nanoseconds": {
+              "type": "date"
+            },
+            "max_flow_end_seconds": {
+              "type": "date"
+            },
+            "max_fragments_pending_reassembly": {
+              "type": "long"
+            },
+            "max_session_entries": {
+              "type": "long"
+            },
+            "max_subscribers": {
+              "type": "long"
+            },
+            "maximum_ip_total_length": {
+              "type": "long"
+            },
+            "maximum_layer2_total_length": {
+              "type": "long"
+            },
+            "maximum_ttl": {
+              "type": "short"
+            },
+            "message_md5_checksum": {
+              "type": "short"
+            },
+            "message_scope": {
+              "type": "short"
+            },
+            "metering_process_id": {
+              "type": "long"
+            },
+            "metro_evc_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "metro_evc_type": {
+              "type": "short"
+            },
+            "mib_capture_time_semantics": {
+              "type": "short"
+            },
+            "mib_context_engine_id": {
+              "type": "short"
+            },
+            "mib_context_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_index_indicator": {
+              "type": "long"
+            },
+            "mib_module_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_identifier": {
+              "type": "short"
+            },
+            "mib_object_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_syntax": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_value_bits": {
+              "type": "short"
+            },
+            "mib_object_value_counter": {
+              "type": "long"
+            },
+            "mib_object_value_gauge": {
+              "type": "long"
+            },
+            "mib_object_value_integer": {
+              "type": "long"
+            },
+            "mib_object_value_octet_string": {
+              "type": "short"
+            },
+            "mib_object_value_oid": {
+              "type": "short"
+            },
+            "mib_object_value_time_ticks": {
+              "type": "long"
+            },
+            "mib_object_value_unsigned": {
+              "type": "long"
+            },
+            "mib_object_valuei_pa_ddress": {
+              "type": "ip"
+            },
+            "mib_sub_identifier": {
+              "type": "long"
+            },
+            "min_export_seconds": {
+              "type": "date"
+            },
+            "min_flow_start_microseconds": {
+              "type": "date"
+            },
+            "min_flow_start_milliseconds": {
+              "type": "date"
+            },
+            "min_flow_start_nanoseconds": {
+              "type": "date"
+            },
+            "min_flow_start_seconds": {
+              "type": "date"
+            },
+            "minimum_ip_total_length": {
+              "type": "long"
+            },
+            "minimum_layer2_total_length": {
+              "type": "long"
+            },
+            "minimum_ttl": {
+              "type": "short"
+            },
+            "mobile_imsi": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mobile_msisdn": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "monitoring_interval_end_milli_seconds": {
+              "type": "date"
+            },
+            "monitoring_interval_start_milli_seconds": {
+              "type": "date"
+            },
+            "mpls_label_stack_depth": {
+              "type": "long"
+            },
+            "mpls_label_stack_length": {
+              "type": "long"
+            },
+            "mpls_label_stack_section": {
+              "type": "short"
+            },
+            "mpls_label_stack_section10": {
+              "type": "short"
+            },
+            "mpls_label_stack_section2": {
+              "type": "short"
+            },
+            "mpls_label_stack_section3": {
+              "type": "short"
+            },
+            "mpls_label_stack_section4": {
+              "type": "short"
+            },
+            "mpls_label_stack_section5": {
+              "type": "short"
+            },
+            "mpls_label_stack_section6": {
+              "type": "short"
+            },
+            "mpls_label_stack_section7": {
+              "type": "short"
+            },
+            "mpls_label_stack_section8": {
+              "type": "short"
+            },
+            "mpls_label_stack_section9": {
+              "type": "short"
+            },
+            "mpls_payload_length": {
+              "type": "long"
+            },
+            "mpls_payload_packet_section": {
+              "type": "short"
+            },
+            "mpls_top_label_exp": {
+              "type": "short"
+            },
+            "mpls_top_label_ipv4_address": {
+              "type": "ip"
+            },
+            "mpls_top_label_ipv6_address": {
+              "type": "ip"
+            },
+            "mpls_top_label_prefix_length": {
+              "type": "short"
+            },
+            "mpls_top_label_stack_section": {
+              "type": "short"
+            },
+            "mpls_top_label_ttl": {
+              "type": "short"
+            },
+            "mpls_top_label_type": {
+              "type": "short"
+            },
+            "mpls_vpn_route_distinguisher": {
+              "type": "short"
+            },
+            "multicast_replication_factor": {
+              "type": "long"
+            },
+            "nat_event": {
+              "type": "short"
+            },
+            "nat_instance_id": {
+              "type": "long"
+            },
+            "nat_originating_address_realm": {
+              "type": "short"
+            },
+            "nat_pool_id": {
+              "type": "long"
+            },
+            "nat_pool_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat_quota_exceeded_event": {
+              "type": "long"
+            },
+            "nat_threshold_event": {
+              "type": "long"
+            },
+            "nat_type": {
+              "type": "short"
+            },
+            "new_connection_delta_count": {
+              "type": "long"
+            },
+            "next_header_ipv6": {
+              "type": "short"
+            },
+            "not_sent_flow_total_count": {
+              "type": "long"
+            },
+            "not_sent_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "not_sent_octet_total_count": {
+              "type": "long"
+            },
+            "not_sent_packet_total_count": {
+              "type": "long"
+            },
+            "observation_domain_id": {
+              "type": "long"
+            },
+            "observation_domain_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "observation_point_id": {
+              "type": "long"
+            },
+            "observation_point_type": {
+              "type": "short"
+            },
+            "observation_time_microseconds": {
+              "type": "date"
+            },
+            "observation_time_milliseconds": {
+              "type": "date"
+            },
+            "observation_time_nanoseconds": {
+              "type": "date"
+            },
+            "observation_time_seconds": {
+              "type": "date"
+            },
+            "observed_flow_total_count": {
+              "type": "long"
+            },
+            "octet_delta_count": {
+              "type": "long"
+            },
+            "octet_delta_sum_of_squares": {
+              "type": "long"
+            },
+            "octet_total_count": {
+              "type": "long"
+            },
+            "octet_total_sum_of_squares": {
+              "type": "long"
+            },
+            "opaque_octets": {
+              "type": "short"
+            },
+            "original_exporter_ipv4_address": {
+              "type": "ip"
+            },
+            "original_exporter_ipv6_address": {
+              "type": "ip"
+            },
+            "original_flows_completed": {
+              "type": "long"
+            },
+            "original_flows_initiated": {
+              "type": "long"
+            },
+            "original_flows_present": {
+              "type": "long"
+            },
+            "original_observation_domain_id": {
+              "type": "long"
+            },
+            "p2p_technology": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packet_delta_count": {
+              "type": "long"
+            },
+            "packet_total_count": {
+              "type": "long"
+            },
+            "padding_octets": {
+              "type": "short"
+            },
+            "payload_length_ipv6": {
+              "type": "long"
+            },
+            "port_id": {
+              "type": "long"
+            },
+            "port_range_end": {
+              "type": "long"
+            },
+            "port_range_num_ports": {
+              "type": "long"
+            },
+            "port_range_start": {
+              "type": "long"
+            },
+            "port_range_step_size": {
+              "type": "long"
+            },
+            "post_destination_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "post_dot1q_customer_vlan_id": {
+              "type": "long"
+            },
+            "post_dot1q_vlan_id": {
+              "type": "long"
+            },
+            "post_ip_class_of_service": {
+              "type": "short"
+            },
+            "post_ip_diff_serv_code_point": {
+              "type": "short"
+            },
+            "post_ip_precedence": {
+              "type": "short"
+            },
+            "post_layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "post_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "post_mcast_layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "post_mcast_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "post_mcast_octet_delta_count": {
+              "type": "long"
+            },
+            "post_mcast_octet_total_count": {
+              "type": "long"
+            },
+            "post_mcast_packet_delta_count": {
+              "type": "long"
+            },
+            "post_mcast_packet_total_count": {
+              "type": "long"
+            },
+            "post_mpls_top_label_exp": {
+              "type": "short"
+            },
+            "post_nadt_estination_ipv4_address": {
+              "type": "ip"
+            },
+            "post_nadt_estination_ipv6_address": {
+              "type": "ip"
+            },
+            "post_napdt_estination_transport_port": {
+              "type": "long"
+            },
+            "post_napst_ource_transport_port": {
+              "type": "long"
+            },
+            "post_nast_ource_ipv4_address": {
+              "type": "ip"
+            },
+            "post_nast_ource_ipv6_address": {
+              "type": "ip"
+            },
+            "post_octet_delta_count": {
+              "type": "long"
+            },
+            "post_octet_total_count": {
+              "type": "long"
+            },
+            "post_packet_delta_count": {
+              "type": "long"
+            },
+            "post_packet_total_count": {
+              "type": "long"
+            },
+            "post_source_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "post_vlan_id": {
+              "type": "long"
+            },
+            "private_enterprise_number": {
+              "type": "long"
+            },
+            "protocol_identifier": {
+              "type": "short"
+            },
+            "pseudo_wire_control_word": {
+              "type": "long"
+            },
+            "pseudo_wire_destination_ipv4_address": {
+              "type": "ip"
+            },
+            "pseudo_wire_id": {
+              "type": "long"
+            },
+            "pseudo_wire_type": {
+              "type": "long"
+            },
+            "relative_error": {
+              "type": "double"
+            },
+            "responder_octets": {
+              "type": "long"
+            },
+            "responder_packets": {
+              "type": "long"
+            },
+            "rfc3550_jitter_microseconds": {
+              "type": "long"
+            },
+            "rfc3550_jitter_milliseconds": {
+              "type": "long"
+            },
+            "rfc3550_jitter_nanoseconds": {
+              "type": "long"
+            },
+            "rtp_sequence_number": {
+              "type": "long"
+            },
+            "sampler_id": {
+              "type": "short"
+            },
+            "sampler_mode": {
+              "type": "short"
+            },
+            "sampler_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampler_random_interval": {
+              "type": "long"
+            },
+            "sampling_algorithm": {
+              "type": "short"
+            },
+            "sampling_flow_interval": {
+              "type": "long"
+            },
+            "sampling_flow_spacing": {
+              "type": "long"
+            },
+            "sampling_interval": {
+              "type": "long"
+            },
+            "sampling_packet_interval": {
+              "type": "long"
+            },
+            "sampling_packet_space": {
+              "type": "long"
+            },
+            "sampling_population": {
+              "type": "long"
+            },
+            "sampling_probability": {
+              "type": "double"
+            },
+            "sampling_size": {
+              "type": "long"
+            },
+            "sampling_time_interval": {
+              "type": "long"
+            },
+            "sampling_time_space": {
+              "type": "long"
+            },
+            "section_exported_octets": {
+              "type": "long"
+            },
+            "section_offset": {
+              "type": "long"
+            },
+            "selection_sequence_id": {
+              "type": "long"
+            },
+            "selector_algorithm": {
+              "type": "long"
+            },
+            "selector_id": {
+              "type": "long"
+            },
+            "selector_id_total_pkts_observed": {
+              "type": "long"
+            },
+            "selector_id_total_pkts_selected": {
+              "type": "long"
+            },
+            "selector_itd_otal_flows_observed": {
+              "type": "long"
+            },
+            "selector_itd_otal_flows_selected": {
+              "type": "long"
+            },
+            "selector_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "session_scope": {
+              "type": "short"
+            },
+            "source_ipv4_address": {
+              "type": "ip"
+            },
+            "source_ipv4_prefix": {
+              "type": "ip"
+            },
+            "source_ipv4_prefix_length": {
+              "type": "short"
+            },
+            "source_ipv6_address": {
+              "type": "ip"
+            },
+            "source_ipv6_prefix": {
+              "type": "ip"
+            },
+            "source_ipv6_prefix_length": {
+              "type": "short"
+            },
+            "source_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "source_transport_port": {
+              "type": "long"
+            },
+            "source_transport_ports_limit": {
+              "type": "long"
+            },
+            "src_traffic_index": {
+              "type": "long"
+            },
+            "sta_ipv4_address": {
+              "type": "ip"
+            },
+            "sta_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "system_init_time_milliseconds": {
+              "type": "date"
+            },
+            "tcp_ack_total_count": {
+              "type": "long"
+            },
+            "tcp_acknowledgement_number": {
+              "type": "long"
+            },
+            "tcp_control_bits": {
+              "type": "long"
+            },
+            "tcp_destination_port": {
+              "type": "long"
+            },
+            "tcp_fin_total_count": {
+              "type": "long"
+            },
+            "tcp_header_length": {
+              "type": "short"
+            },
+            "tcp_options": {
+              "type": "long"
+            },
+            "tcp_psh_total_count": {
+              "type": "long"
+            },
+            "tcp_rst_total_count": {
+              "type": "long"
+            },
+            "tcp_sequence_number": {
+              "type": "long"
+            },
+            "tcp_source_port": {
+              "type": "long"
+            },
+            "tcp_syn_total_count": {
+              "type": "long"
+            },
+            "tcp_urg_total_count": {
+              "type": "long"
+            },
+            "tcp_urgent_pointer": {
+              "type": "long"
+            },
+            "tcp_window_scale": {
+              "type": "long"
+            },
+            "tcp_window_size": {
+              "type": "long"
+            },
+            "template_id": {
+              "type": "long"
+            },
+            "total_length_ipv4": {
+              "type": "long"
+            },
+            "transport_octet_delta_count": {
+              "type": "long"
+            },
+            "transport_packet_delta_count": {
+              "type": "long"
+            },
+            "tunnel_technology": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "udp_destination_port": {
+              "type": "long"
+            },
+            "udp_message_length": {
+              "type": "long"
+            },
+            "udp_source_port": {
+              "type": "long"
+            },
+            "upper_cli_imit": {
+              "type": "double"
+            },
+            "user_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value_distribution_method": {
+              "type": "short"
+            },
+            "virtual_station_interface_id": {
+              "type": "short"
+            },
+            "virtual_station_interface_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "virtual_station_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "virtual_station_uuid": {
+              "type": "short"
+            },
+            "vlan_id": {
+              "type": "long"
+            },
+            "vpn_identifier": {
+              "type": "short"
+            },
+            "vr_fname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "wlan_channel_id": {
+              "type": "short"
+            },
+            "wlan_ssid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "wtp_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nginx": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "connection_id": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "osquery": {
+          "properties": {
+            "result": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "calendar_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "host_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unix_time": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "postgresql": {
+          "properties": {
+            "log": {
+              "properties": {
+                "core_id": {
+                  "type": "long"
+                },
+                "database": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "program": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "redis": {
+          "properties": {
+            "log": {
+              "properties": {
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "duration": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "id": {
+                  "type": "long"
+                },
+                "key": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            }
+          }
+        },
+        "santa": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "decision": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "disk": {
+              "properties": {
+                "bsdname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mount": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "volume": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reason": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "num": {
+                  "type": "long"
+                },
+                "org": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain_top1m_rank": {
+              "type": "long"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "locality": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "stream": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "suricata": {
+          "properties": {
+            "eve": {
+              "properties": {
+                "alert": {
+                  "properties": {
+                    "action": {
+                      "path": "event.outcome",
+                      "type": "alias"
+                    },
+                    "category": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "gid": {
+                      "type": "long"
+                    },
+                    "rev": {
+                      "type": "long"
+                    },
+                    "severity": {
+                      "path": "event.severity",
+                      "type": "alias"
+                    },
+                    "signature": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_id": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "app_proto": {
+                  "path": "network.protocol",
+                  "type": "alias"
+                },
+                "app_proto_expected": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "app_proto_orig": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "app_proto_tc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "app_proto_ts": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dest_ip": {
+                  "path": "destination.ip",
+                  "type": "alias"
+                },
+                "dest_port": {
+                  "path": "destination.port",
+                  "type": "alias"
+                },
+                "dns": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "rcode": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rdata": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rrname": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rrtype": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ttl": {
+                      "type": "long"
+                    },
+                    "tx_id": {
+                      "type": "long"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "email": {
+                  "properties": {
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "event_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fileinfo": {
+                  "properties": {
+                    "filename": {
+                      "path": "file.path",
+                      "type": "alias"
+                    },
+                    "gaps": {
+                      "type": "boolean"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "size": {
+                      "path": "file.size",
+                      "type": "alias"
+                    },
+                    "state": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stored": {
+                      "type": "boolean"
+                    },
+                    "tx_id": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "flags": {
+                  "type": "object"
+                },
+                "flow": {
+                  "properties": {
+                    "age": {
+                      "type": "long"
+                    },
+                    "alerted": {
+                      "type": "boolean"
+                    },
+                    "bytes_toclient": {
+                      "path": "destination.bytes",
+                      "type": "alias"
+                    },
+                    "bytes_toserver": {
+                      "path": "source.bytes",
+                      "type": "alias"
+                    },
+                    "end": {
+                      "type": "date"
+                    },
+                    "pkts_toclient": {
+                      "path": "destination.packets",
+                      "type": "alias"
+                    },
+                    "pkts_toserver": {
+                      "path": "source.packets",
+                      "type": "alias"
+                    },
+                    "reason": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "start": {
+                      "path": "event.start",
+                      "type": "alias"
+                    },
+                    "state": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "flow_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "http": {
+                  "properties": {
+                    "hostname": {
+                      "path": "url.domain",
+                      "type": "alias"
+                    },
+                    "http_content_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "http_method": {
+                      "path": "http.request.method",
+                      "type": "alias"
+                    },
+                    "http_refer": {
+                      "path": "http.request.referrer",
+                      "type": "alias"
+                    },
+                    "http_user_agent": {
+                      "path": "user_agent.original",
+                      "type": "alias"
+                    },
+                    "length": {
+                      "path": "http.response.body.bytes",
+                      "type": "alias"
+                    },
+                    "protocol": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "redirect": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "status": {
+                      "path": "http.response.status_code",
+                      "type": "alias"
+                    },
+                    "url": {
+                      "path": "url.original",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "icmp_code": {
+                  "type": "long"
+                },
+                "icmp_type": {
+                  "type": "long"
+                },
+                "in_iface": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pcap_cnt": {
+                  "type": "long"
+                },
+                "proto": {
+                  "path": "network.transport",
+                  "type": "alias"
+                },
+                "smtp": {
+                  "properties": {
+                    "helo": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "mail_from": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rcpt_to": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "src_ip": {
+                  "path": "source.ip",
+                  "type": "alias"
+                },
+                "src_port": {
+                  "path": "source.port",
+                  "type": "alias"
+                },
+                "ssh": {
+                  "properties": {
+                    "client": {
+                      "properties": {
+                        "proto_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "software_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "server": {
+                      "properties": {
+                        "proto_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "software_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "stats": {
+                  "properties": {
+                    "app_layer": {
+                      "properties": {
+                        "flow": {
+                          "properties": {
+                            "dcerpc_tcp": {
+                              "type": "long"
+                            },
+                            "dcerpc_udp": {
+                              "type": "long"
+                            },
+                            "dns_tcp": {
+                              "type": "long"
+                            },
+                            "dns_udp": {
+                              "type": "long"
+                            },
+                            "failed_tcp": {
+                              "type": "long"
+                            },
+                            "failed_udp": {
+                              "type": "long"
+                            },
+                            "ftp": {
+                              "type": "long"
+                            },
+                            "http": {
+                              "type": "long"
+                            },
+                            "imap": {
+                              "type": "long"
+                            },
+                            "msn": {
+                              "type": "long"
+                            },
+                            "smb": {
+                              "type": "long"
+                            },
+                            "smtp": {
+                              "type": "long"
+                            },
+                            "ssh": {
+                              "type": "long"
+                            },
+                            "tls": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "tx": {
+                          "properties": {
+                            "dcerpc_tcp": {
+                              "type": "long"
+                            },
+                            "dcerpc_udp": {
+                              "type": "long"
+                            },
+                            "dns_tcp": {
+                              "type": "long"
+                            },
+                            "dns_udp": {
+                              "type": "long"
+                            },
+                            "ftp": {
+                              "type": "long"
+                            },
+                            "http": {
+                              "type": "long"
+                            },
+                            "smb": {
+                              "type": "long"
+                            },
+                            "smtp": {
+                              "type": "long"
+                            },
+                            "ssh": {
+                              "type": "long"
+                            },
+                            "tls": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "capture": {
+                      "properties": {
+                        "kernel_drops": {
+                          "type": "long"
+                        },
+                        "kernel_ifdrops": {
+                          "type": "long"
+                        },
+                        "kernel_packets": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "decoder": {
+                      "properties": {
+                        "avg_pkt_size": {
+                          "type": "long"
+                        },
+                        "bytes": {
+                          "type": "long"
+                        },
+                        "dce": {
+                          "properties": {
+                            "pkt_too_small": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "erspan": {
+                          "type": "long"
+                        },
+                        "ethernet": {
+                          "type": "long"
+                        },
+                        "gre": {
+                          "type": "long"
+                        },
+                        "icmpv4": {
+                          "type": "long"
+                        },
+                        "icmpv6": {
+                          "type": "long"
+                        },
+                        "ieee8021ah": {
+                          "type": "long"
+                        },
+                        "invalid": {
+                          "type": "long"
+                        },
+                        "ipraw": {
+                          "properties": {
+                            "invalid_ip_version": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "ipv4": {
+                          "type": "long"
+                        },
+                        "ipv4_in_ipv6": {
+                          "type": "long"
+                        },
+                        "ipv6": {
+                          "type": "long"
+                        },
+                        "ipv6_in_ipv6": {
+                          "type": "long"
+                        },
+                        "ltnull": {
+                          "properties": {
+                            "pkt_too_small": {
+                              "type": "long"
+                            },
+                            "unsupported_type": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "max_pkt_size": {
+                          "type": "long"
+                        },
+                        "mpls": {
+                          "type": "long"
+                        },
+                        "null": {
+                          "type": "long"
+                        },
+                        "pkts": {
+                          "type": "long"
+                        },
+                        "ppp": {
+                          "type": "long"
+                        },
+                        "pppoe": {
+                          "type": "long"
+                        },
+                        "raw": {
+                          "type": "long"
+                        },
+                        "sctp": {
+                          "type": "long"
+                        },
+                        "sll": {
+                          "type": "long"
+                        },
+                        "tcp": {
+                          "type": "long"
+                        },
+                        "teredo": {
+                          "type": "long"
+                        },
+                        "udp": {
+                          "type": "long"
+                        },
+                        "vlan": {
+                          "type": "long"
+                        },
+                        "vlan_qinq": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "defrag": {
+                      "properties": {
+                        "ipv4": {
+                          "properties": {
+                            "fragments": {
+                              "type": "long"
+                            },
+                            "reassembled": {
+                              "type": "long"
+                            },
+                            "timeouts": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "ipv6": {
+                          "properties": {
+                            "fragments": {
+                              "type": "long"
+                            },
+                            "reassembled": {
+                              "type": "long"
+                            },
+                            "timeouts": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "max_frag_hits": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "detect": {
+                      "properties": {
+                        "alert": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "dns": {
+                      "properties": {
+                        "memcap_global": {
+                          "type": "long"
+                        },
+                        "memcap_state": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "file_store": {
+                      "properties": {
+                        "open_files": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "flow": {
+                      "properties": {
+                        "emerg_mode_entered": {
+                          "type": "long"
+                        },
+                        "emerg_mode_over": {
+                          "type": "long"
+                        },
+                        "icmpv4": {
+                          "type": "long"
+                        },
+                        "icmpv6": {
+                          "type": "long"
+                        },
+                        "memcap": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        },
+                        "spare": {
+                          "type": "long"
+                        },
+                        "tcp": {
+                          "type": "long"
+                        },
+                        "tcp_reuse": {
+                          "type": "long"
+                        },
+                        "udp": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "flow_mgr": {
+                      "properties": {
+                        "bypassed_pruned": {
+                          "type": "long"
+                        },
+                        "closed_pruned": {
+                          "type": "long"
+                        },
+                        "est_pruned": {
+                          "type": "long"
+                        },
+                        "flows_checked": {
+                          "type": "long"
+                        },
+                        "flows_notimeout": {
+                          "type": "long"
+                        },
+                        "flows_removed": {
+                          "type": "long"
+                        },
+                        "flows_timeout": {
+                          "type": "long"
+                        },
+                        "flows_timeout_inuse": {
+                          "type": "long"
+                        },
+                        "new_pruned": {
+                          "type": "long"
+                        },
+                        "rows_busy": {
+                          "type": "long"
+                        },
+                        "rows_checked": {
+                          "type": "long"
+                        },
+                        "rows_empty": {
+                          "type": "long"
+                        },
+                        "rows_maxlen": {
+                          "type": "long"
+                        },
+                        "rows_skipped": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "http": {
+                      "properties": {
+                        "memcap": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "tcp": {
+                      "properties": {
+                        "insert_data_normal_fail": {
+                          "type": "long"
+                        },
+                        "insert_data_overlap_fail": {
+                          "type": "long"
+                        },
+                        "insert_list_fail": {
+                          "type": "long"
+                        },
+                        "invalid_checksum": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        },
+                        "no_flow": {
+                          "type": "long"
+                        },
+                        "overlap": {
+                          "type": "long"
+                        },
+                        "overlap_diff_data": {
+                          "type": "long"
+                        },
+                        "pseudo": {
+                          "type": "long"
+                        },
+                        "pseudo_failed": {
+                          "type": "long"
+                        },
+                        "reassembly_gap": {
+                          "type": "long"
+                        },
+                        "reassembly_memuse": {
+                          "type": "long"
+                        },
+                        "rst": {
+                          "type": "long"
+                        },
+                        "segment_memcap_drop": {
+                          "type": "long"
+                        },
+                        "sessions": {
+                          "type": "long"
+                        },
+                        "ssn_memcap_drop": {
+                          "type": "long"
+                        },
+                        "stream_depth_reached": {
+                          "type": "long"
+                        },
+                        "syn": {
+                          "type": "long"
+                        },
+                        "synack": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "uptime": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "tcp": {
+                  "properties": {
+                    "ack": {
+                      "type": "boolean"
+                    },
+                    "fin": {
+                      "type": "boolean"
+                    },
+                    "psh": {
+                      "type": "boolean"
+                    },
+                    "rst": {
+                      "type": "boolean"
+                    },
+                    "state": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "syn": {
+                      "type": "boolean"
+                    },
+                    "tcp_flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tcp_flags_tc": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tcp_flags_ts": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestamp": {
+                  "path": "@timestamp",
+                  "type": "alias"
+                },
+                "tls": {
+                  "properties": {
+                    "fingerprint": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuerdn": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "notafter": {
+                      "type": "date"
+                    },
+                    "notbefore": {
+                      "type": "date"
+                    },
+                    "serial": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "session_resumed": {
+                      "type": "boolean"
+                    },
+                    "sni": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "tx_id": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "syslog": {
+          "properties": {
+            "facility": {
+              "type": "long"
+            },
+            "facility_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "severity_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "auth": {
+              "properties": {
+                "groupadd": {
+                  "type": "object"
+                },
+                "ssh": {
+                  "properties": {
+                    "dropped_ip": {
+                      "type": "ip"
+                    },
+                    "geoip": {
+                      "type": "object"
+                    },
+                    "method": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "sudo": {
+                  "properties": {
+                    "command": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "error": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pwd": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tty": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "useradd": {
+                  "properties": {
+                    "home": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "shell": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "syslog": {
+              "type": "object"
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "traefik": {
+          "properties": {
+            "access": {
+              "properties": {
+                "backend_url": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "frontend_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "properties": {
+                    "city_name": {
+                      "path": "source.geo.city_name",
+                      "type": "alias"
+                    },
+                    "continent_name": {
+                      "path": "source.geo.continent_name",
+                      "type": "alias"
+                    },
+                    "country_iso_code": {
+                      "path": "source.geo.country_iso_code",
+                      "type": "alias"
+                    },
+                    "location": {
+                      "path": "source.geo.location",
+                      "type": "alias"
+                    },
+                    "region_iso_code": {
+                      "path": "source.geo.region_iso_code",
+                      "type": "alias"
+                    },
+                    "region_name": {
+                      "path": "source.geo.region_name",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "request_count": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "properties": {
+                    "device": {
+                      "path": "user_agent.device.name",
+                      "type": "alias"
+                    },
+                    "name": {
+                      "path": "user_agent.name",
+                      "type": "alias"
+                    },
+                    "original": {
+                      "path": "user_agent.original",
+                      "type": "alias"
+                    },
+                    "os": {
+                      "path": "user_agent.os.full_name",
+                      "type": "alias"
+                    },
+                    "os_name": {
+                      "path": "user_agent.os.name",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "user_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "major": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "minor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "major": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "minor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "patch": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "zeek": {
+          "properties": {
+            "connection": {
+              "properties": {
+                "history": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "local_orig": {
+                  "type": "boolean"
+                },
+                "local_resp": {
+                  "type": "boolean"
+                },
+                "missed_bytes": {
+                  "type": "long"
+                },
+                "orig_l2_addr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "dns": {
+              "properties": {
+                "AA": {
+                  "type": "boolean"
+                },
+                "RA": {
+                  "type": "boolean"
+                },
+                "RD": {
+                  "type": "boolean"
+                },
+                "TC": {
+                  "type": "boolean"
+                },
+                "TTLs": {
+                  "type": "double"
+                },
+                "answers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qclass": {
+                  "type": "long"
+                },
+                "qclass_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qtype": {
+                  "type": "long"
+                },
+                "qtype_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rcode": {
+                  "type": "long"
+                },
+                "rcode_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rejected": {
+                  "type": "boolean"
+                },
+                "rtt": {
+                  "type": "double"
+                },
+                "saw_query": {
+                  "type": "boolean"
+                },
+                "saw_reply": {
+                  "type": "boolean"
+                },
+                "total_answers": {
+                  "type": "long"
+                },
+                "total_replies": {
+                  "type": "long"
+                },
+                "trans_id": {
+                  "type": "long"
+                }
+              }
+            },
+            "files": {
+              "properties": {
+                "analyzers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "depth": {
+                  "type": "long"
+                },
+                "duration": {
+                  "type": "double"
+                },
+                "entropy": {
+                  "type": "double"
+                },
+                "extracted": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "extracted_cutoff": {
+                  "type": "boolean"
+                },
+                "extracted_size": {
+                  "type": "long"
+                },
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "is_orig": {
+                  "type": "boolean"
+                },
+                "local_orig": {
+                  "type": "boolean"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mime_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "missing_bytes": {
+                  "type": "long"
+                },
+                "overflow_bytes": {
+                  "type": "long"
+                },
+                "parent_fuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rx_host": {
+                  "type": "ip"
+                },
+                "seen_bytes": {
+                  "type": "long"
+                },
+                "session_ids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timedout": {
+                  "type": "boolean"
+                },
+                "total_bytes": {
+                  "type": "long"
+                },
+                "tx_host": {
+                  "type": "ip"
+                }
+              }
+            },
+            "http": {
+              "properties": {
+                "captured_password": {
+                  "type": "boolean"
+                },
+                "client_header_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "info_code": {
+                  "type": "long"
+                },
+                "info_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "orig_filenames": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "orig_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "orig_mime_depth": {
+                  "type": "long"
+                },
+                "orig_mime_types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "proxied": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "range_request": {
+                  "type": "boolean"
+                },
+                "resp_filenames": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resp_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resp_mime_depth": {
+                  "type": "long"
+                },
+                "resp_mime_types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "server_header_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trans_depth": {
+                  "type": "long"
+                }
+              }
+            },
+            "inner_vlan": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resp_l2_addr": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "session_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ssl": {
+              "properties": {
+                "cert_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cert_chain_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cipher": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_cert_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_cert_chain_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "curve": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "established": {
+                  "type": "boolean"
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "last_alert": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "next_protocol": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resumed": {
+                  "type": "boolean"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "validation_status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "vlan": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "name": "filebeat-7.0.0",
+          "rollover_alias": "filebeat-7.0.0"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "tags",
+            "message",
+            "agent.version",
+            "agent.name",
+            "agent.type",
+            "agent.id",
+            "agent.ephemeral_id",
+            "client.address",
+            "client.mac",
+            "client.domain",
+            "client.geo.continent_name",
+            "client.geo.country_name",
+            "client.geo.region_name",
+            "client.geo.city_name",
+            "client.geo.country_iso_code",
+            "client.geo.region_iso_code",
+            "client.geo.name",
+            "cloud.provider",
+            "cloud.availability_zone",
+            "cloud.region",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.account.id",
+            "container.runtime",
+            "container.id",
+            "container.image.name",
+            "container.image.tag",
+            "container.name",
+            "destination.address",
+            "destination.mac",
+            "destination.domain",
+            "destination.geo.continent_name",
+            "destination.geo.country_name",
+            "destination.geo.region_name",
+            "destination.geo.city_name",
+            "destination.geo.country_iso_code",
+            "destination.geo.region_iso_code",
+            "destination.geo.name",
+            "ecs.version",
+            "error.id",
+            "error.message",
+            "error.code",
+            "event.id",
+            "event.kind",
+            "event.category",
+            "event.action",
+            "event.outcome",
+            "event.type",
+            "event.module",
+            "event.dataset",
+            "event.hash",
+            "event.timezone",
+            "file.path",
+            "file.target_path",
+            "file.extension",
+            "file.type",
+            "file.device",
+            "file.inode",
+            "file.uid",
+            "file.owner",
+            "file.gid",
+            "file.group",
+            "file.mode",
+            "group.id",
+            "group.name",
+            "host.hostname",
+            "host.name",
+            "host.id",
+            "host.mac",
+            "host.type",
+            "host.architecture",
+            "host.os.platform",
+            "host.os.name",
+            "host.os.full",
+            "host.os.family",
+            "host.os.version",
+            "host.os.kernel",
+            "host.geo.continent_name",
+            "host.geo.country_name",
+            "host.geo.region_name",
+            "host.geo.city_name",
+            "host.geo.country_iso_code",
+            "host.geo.region_iso_code",
+            "host.geo.name",
+            "http.request.method",
+            "http.request.body.content",
+            "http.request.referrer",
+            "http.response.body.content",
+            "http.version",
+            "log.level",
+            "network.name",
+            "network.type",
+            "network.iana_number",
+            "network.transport",
+            "network.application",
+            "network.protocol",
+            "network.direction",
+            "network.community_id",
+            "observer.mac",
+            "observer.hostname",
+            "observer.vendor",
+            "observer.version",
+            "observer.serial_number",
+            "observer.type",
+            "observer.os.platform",
+            "observer.os.name",
+            "observer.os.full",
+            "observer.os.family",
+            "observer.os.version",
+            "observer.os.kernel",
+            "observer.geo.continent_name",
+            "observer.geo.country_name",
+            "observer.geo.region_name",
+            "observer.geo.city_name",
+            "observer.geo.country_iso_code",
+            "observer.geo.region_iso_code",
+            "observer.geo.name",
+            "organization.name",
+            "organization.id",
+            "os.platform",
+            "os.name",
+            "os.full",
+            "os.family",
+            "os.version",
+            "os.kernel",
+            "process.name",
+            "process.args",
+            "process.executable",
+            "process.title",
+            "process.working_directory",
+            "server.address",
+            "server.mac",
+            "server.domain",
+            "server.geo.continent_name",
+            "server.geo.country_name",
+            "server.geo.region_name",
+            "server.geo.city_name",
+            "server.geo.country_iso_code",
+            "server.geo.region_iso_code",
+            "server.geo.name",
+            "service.id",
+            "service.name",
+            "service.type",
+            "service.state",
+            "service.version",
+            "service.ephemeral_id",
+            "source.address",
+            "source.mac",
+            "source.domain",
+            "source.geo.continent_name",
+            "source.geo.country_name",
+            "source.geo.region_name",
+            "source.geo.city_name",
+            "source.geo.country_iso_code",
+            "source.geo.region_iso_code",
+            "source.geo.name",
+            "url.original",
+            "url.full",
+            "url.scheme",
+            "url.domain",
+            "url.path",
+            "url.query",
+            "url.fragment",
+            "url.username",
+            "url.password",
+            "user.id",
+            "user.name",
+            "user.full_name",
+            "user.email",
+            "user.hash",
+            "user.group.id",
+            "user.group.name",
+            "user_agent.original",
+            "user_agent.name",
+            "user_agent.version",
+            "user_agent.device.name",
+            "user_agent.os.platform",
+            "user_agent.os.name",
+            "user_agent.os.full",
+            "user_agent.os.family",
+            "user_agent.os.version",
+            "user_agent.os.kernel",
+            "agent.hostname",
+            "error.type",
+            "cloud.project.id",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "log.file.path",
+            "log.source.address",
+            "stream",
+            "input.type",
+            "syslog.severity_label",
+            "syslog.facility_label",
+            "process.program",
+            "log.flags",
+            "user_agent.os.full_name",
+            "fileset.name",
+            "apache.access.ssl.protocol",
+            "apache.access.ssl.cipher",
+            "apache.error.module",
+            "user.terminal",
+            "user.audit.id",
+            "user.audit.name",
+            "user.audit.group.id",
+            "user.audit.group.name",
+            "user.effective.id",
+            "user.effective.name",
+            "user.effective.group.id",
+            "user.effective.group.name",
+            "user.filesystem.id",
+            "user.filesystem.name",
+            "user.filesystem.group.id",
+            "user.filesystem.group.name",
+            "user.owner.id",
+            "user.owner.name",
+            "user.owner.group.id",
+            "user.owner.group.name",
+            "user.saved.id",
+            "user.saved.name",
+            "user.saved.group.id",
+            "user.saved.group.name",
+            "auditd.log.old_auid",
+            "auditd.log.new_auid",
+            "auditd.log.old_ses",
+            "auditd.log.new_ses",
+            "auditd.log.items",
+            "auditd.log.item",
+            "auditd.log.tty",
+            "auditd.log.a0",
+            "elasticsearch.component",
+            "elasticsearch.cluster.uuid",
+            "elasticsearch.cluster.name",
+            "elasticsearch.node.id",
+            "elasticsearch.node.name",
+            "elasticsearch.index.name",
+            "elasticsearch.index.id",
+            "elasticsearch.shard.id",
+            "elasticsearch.audit.layer",
+            "elasticsearch.audit.origin.type",
+            "elasticsearch.audit.realm",
+            "elasticsearch.audit.user.realm",
+            "elasticsearch.audit.user.roles",
+            "elasticsearch.audit.action",
+            "elasticsearch.audit.url.params",
+            "elasticsearch.audit.indices",
+            "elasticsearch.audit.request.id",
+            "elasticsearch.audit.request.name",
+            "elasticsearch.gc.phase.name",
+            "elasticsearch.gc.tags",
+            "elasticsearch.slowlog.logger",
+            "elasticsearch.slowlog.took",
+            "elasticsearch.slowlog.types",
+            "elasticsearch.slowlog.stats",
+            "elasticsearch.slowlog.search_type",
+            "elasticsearch.slowlog.source_query",
+            "elasticsearch.slowlog.extra_source",
+            "elasticsearch.slowlog.total_hits",
+            "elasticsearch.slowlog.total_shards",
+            "elasticsearch.slowlog.routing",
+            "elasticsearch.slowlog.id",
+            "elasticsearch.slowlog.type",
+            "haproxy.frontend_name",
+            "haproxy.backend_name",
+            "haproxy.server_name",
+            "haproxy.bind_name",
+            "haproxy.error_message",
+            "haproxy.source",
+            "haproxy.termination_state",
+            "haproxy.mode",
+            "haproxy.http.response.captured_cookie",
+            "haproxy.http.response.captured_headers",
+            "haproxy.http.request.captured_cookie",
+            "haproxy.http.request.captured_headers",
+            "haproxy.http.request.raw_request_line",
+            "icinga.debug.facility",
+            "icinga.main.facility",
+            "icinga.startup.facility",
+            "iis.access.site_name",
+            "iis.access.server_name",
+            "iis.access.cookie",
+            "iis.error.reason_phrase",
+            "iis.error.queue_name",
+            "iptables.fragment_flags",
+            "iptables.input_device",
+            "iptables.output_device",
+            "iptables.tcp.flags",
+            "iptables.ubiquiti.input_zone",
+            "iptables.ubiquiti.output_zone",
+            "iptables.ubiquiti.rule_number",
+            "iptables.ubiquiti.rule_set",
+            "kafka.log.component",
+            "kafka.log.class",
+            "kafka.log.trace.class",
+            "kafka.log.trace.message",
+            "kibana.log.tags",
+            "kibana.log.state",
+            "logstash.log.module",
+            "logstash.log.thread",
+            "text",
+            "logstash.slowlog.module",
+            "logstash.slowlog.thread",
+            "text",
+            "logstash.slowlog.event",
+            "text",
+            "logstash.slowlog.plugin_name",
+            "logstash.slowlog.plugin_type",
+            "logstash.slowlog.plugin_params",
+            "text",
+            "mongodb.log.component",
+            "mongodb.log.context",
+            "mysql.slowlog.query",
+            "mysql.slowlog.schema",
+            "mysql.slowlog.current_user",
+            "mysql.slowlog.last_errno",
+            "mysql.slowlog.killed",
+            "mysql.slowlog.log_slow_rate_type",
+            "mysql.slowlog.log_slow_rate_limit",
+            "mysql.slowlog.innodb.trx_id",
+            "netflow.type",
+            "netflow.exporter.address",
+            "netflow.source_mac_address",
+            "netflow.post_destination_mac_address",
+            "netflow.destination_mac_address",
+            "netflow.post_source_mac_address",
+            "netflow.interface_name",
+            "netflow.interface_description",
+            "netflow.sampler_name",
+            "netflow.application_description",
+            "netflow.application_name",
+            "netflow.class_name",
+            "netflow.wlan_ssid",
+            "netflow.vr_fname",
+            "netflow.metro_evc_id",
+            "netflow.nat_pool_name",
+            "netflow.p2p_technology",
+            "netflow.tunnel_technology",
+            "netflow.encrypted_technology",
+            "netflow.observation_domain_name",
+            "netflow.selector_name",
+            "netflow.information_element_description",
+            "netflow.information_element_name",
+            "netflow.virtual_station_interface_name",
+            "netflow.virtual_station_name",
+            "netflow.sta_mac_address",
+            "netflow.wtp_mac_address",
+            "netflow.user_name",
+            "netflow.application_category_name",
+            "netflow.application_sub_category_name",
+            "netflow.application_group_name",
+            "netflow.dot1q_customer_source_mac_address",
+            "netflow.dot1q_customer_destination_mac_address",
+            "netflow.mib_context_name",
+            "netflow.mib_object_name",
+            "netflow.mib_object_description",
+            "netflow.mib_object_syntax",
+            "netflow.mib_module_name",
+            "netflow.mobile_imsi",
+            "netflow.mobile_msisdn",
+            "netflow.http_request_method",
+            "netflow.http_request_host",
+            "netflow.http_request_target",
+            "netflow.http_message_version",
+            "netflow.http_user_agent",
+            "netflow.http_content_type",
+            "netflow.http_reason_phrase",
+            "osquery.result.name",
+            "osquery.result.action",
+            "osquery.result.host_identifier",
+            "osquery.result.calendar_time",
+            "postgresql.log.timestamp",
+            "postgresql.log.database",
+            "postgresql.log.query",
+            "redis.log.role",
+            "redis.slowlog.cmd",
+            "redis.slowlog.key",
+            "redis.slowlog.args",
+            "santa.action",
+            "santa.decision",
+            "santa.reason",
+            "santa.mode",
+            "santa.disk.volume",
+            "santa.disk.bus",
+            "santa.disk.serial",
+            "santa.disk.bsdname",
+            "santa.disk.model",
+            "santa.disk.fs",
+            "santa.disk.mount",
+            "certificate.common_name",
+            "certificate.sha256",
+            "hash.sha256",
+            "suricata.eve.event_type",
+            "suricata.eve.app_proto_orig",
+            "suricata.eve.tcp.tcp_flags",
+            "suricata.eve.tcp.tcp_flags_tc",
+            "suricata.eve.tcp.state",
+            "suricata.eve.tcp.tcp_flags_ts",
+            "suricata.eve.fileinfo.sha1",
+            "suricata.eve.fileinfo.state",
+            "suricata.eve.fileinfo.sha256",
+            "suricata.eve.fileinfo.md5",
+            "suricata.eve.dns.type",
+            "suricata.eve.dns.rrtype",
+            "suricata.eve.dns.rrname",
+            "suricata.eve.dns.rdata",
+            "suricata.eve.dns.rcode",
+            "suricata.eve.flow_id",
+            "suricata.eve.email.status",
+            "suricata.eve.http.redirect",
+            "suricata.eve.http.protocol",
+            "suricata.eve.http.http_content_type",
+            "suricata.eve.in_iface",
+            "suricata.eve.alert.category",
+            "suricata.eve.alert.signature",
+            "suricata.eve.ssh.client.proto_version",
+            "suricata.eve.ssh.client.software_version",
+            "suricata.eve.ssh.server.proto_version",
+            "suricata.eve.ssh.server.software_version",
+            "suricata.eve.tls.issuerdn",
+            "suricata.eve.tls.sni",
+            "suricata.eve.tls.version",
+            "suricata.eve.tls.fingerprint",
+            "suricata.eve.tls.serial",
+            "suricata.eve.tls.subject",
+            "suricata.eve.app_proto_ts",
+            "suricata.eve.flow.state",
+            "suricata.eve.flow.reason",
+            "suricata.eve.app_proto_tc",
+            "suricata.eve.smtp.rcpt_to",
+            "suricata.eve.smtp.mail_from",
+            "suricata.eve.smtp.helo",
+            "suricata.eve.app_proto_expected",
+            "system.auth.ssh.method",
+            "system.auth.ssh.signature",
+            "system.auth.sudo.error",
+            "system.auth.sudo.tty",
+            "system.auth.sudo.pwd",
+            "system.auth.sudo.user",
+            "system.auth.sudo.command",
+            "system.auth.useradd.home",
+            "system.auth.useradd.shell",
+            "traefik.access.user_identifier",
+            "traefik.access.frontend_name",
+            "traefik.access.backend_url",
+            "zeek.session_id",
+            "zeek.connection.state",
+            "zeek.connection.history",
+            "zeek.connection.orig_l2_addr",
+            "zeek.resp_l2_addr",
+            "zeek.vlan",
+            "zeek.inner_vlan",
+            "zeek.dns.query",
+            "zeek.dns.qclass_name",
+            "zeek.dns.qtype_name",
+            "zeek.dns.rcode_name",
+            "zeek.dns.answers",
+            "zeek.http.status_msg",
+            "zeek.http.info_msg",
+            "zeek.http.filename",
+            "zeek.http.tags",
+            "zeek.http.proxied",
+            "zeek.http.client_header_names",
+            "zeek.http.server_header_names",
+            "zeek.http.orig_fuids",
+            "zeek.http.orig_mime_types",
+            "zeek.http.orig_filenames",
+            "zeek.http.resp_fuids",
+            "zeek.http.resp_mime_types",
+            "zeek.http.resp_filenames",
+            "zeek.files.fuid",
+            "zeek.files.session_ids",
+            "zeek.files.source",
+            "zeek.files.analyzers",
+            "zeek.files.mime_type",
+            "zeek.files.filename",
+            "zeek.files.parent_fuid",
+            "zeek.files.md5",
+            "zeek.files.sha1",
+            "zeek.files.sha256",
+            "zeek.files.extracted",
+            "zeek.ssl.version",
+            "zeek.ssl.cipher",
+            "zeek.ssl.curve",
+            "zeek.ssl.server_name",
+            "zeek.ssl.next_protocol",
+            "zeek.ssl.cert_chain",
+            "zeek.ssl.cert_chain_fuids",
+            "zeek.ssl.client_cert_chain",
+            "zeek.ssl.client_cert_chain_fuids",
+            "zeek.ssl.issuer",
+            "zeek.ssl.client_issuer",
+            "zeek.ssl.validation_status",
+            "zeek.ssl.subject",
+            "zeek.ssl.client_subject",
+            "zeek.ssl.last_alert",
+            "fields.*"
+          ]
+        },
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index 65020be390f9d8..100ed8e079d379 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -18,6 +18,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
   const find = getService('find');
   const comboBox = getService('comboBox');
   const browser = getService('browser');
+  const dashboardAddPanel = getService('dashboardAddPanel');
 
   const PageObjects = getPageObjects([
     'common',
@@ -753,7 +754,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       if (inViewMode) {
         await PageObjects.dashboard.switchToEditMode();
       }
-      await PageObjects.visualize.clickLensWidget();
+      await dashboardAddPanel.clickCreateNewLink();
       await this.goToTimeRange();
       await this.configureDimension({
         dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
diff --git a/x-pack/test/functional/services/dashboard/drilldowns_manage.ts b/x-pack/test/functional/services/dashboard/drilldowns_manage.ts
index 6f4deb2d329864..34212262aedba0 100644
--- a/x-pack/test/functional/services/dashboard/drilldowns_manage.ts
+++ b/x-pack/test/functional/services/dashboard/drilldowns_manage.ts
@@ -10,12 +10,6 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 
 const CREATE_DRILLDOWN_FLYOUT_DATA_TEST_SUBJ = 'createDrilldownFlyout';
 const MANAGE_DRILLDOWNS_FLYOUT_DATA_TEST_SUBJ = 'editDrilldownFlyout';
-const DASHBOARD_TO_DASHBOARD_ACTION_LIST_ITEM =
-  'actionFactoryItem-DASHBOARD_TO_DASHBOARD_DRILLDOWN';
-const DASHBOARD_TO_DASHBOARD_ACTION_WIZARD =
-  'selectedActionFactory-DASHBOARD_TO_DASHBOARD_DRILLDOWN';
-const DASHBOARD_TO_URL_ACTION_LIST_ITEM = 'actionFactoryItem-URL_DRILLDOWN';
-const DASHBOARD_TO_URL_ACTION_WIZARD = 'selectedActionFactory-URL_DRILLDOWN';
 const DESTINATION_DASHBOARD_SELECT = 'dashboardDrilldownSelectDashboard';
 const DRILLDOWN_WIZARD_SUBMIT = 'drilldownWizardSubmit';
 
@@ -69,7 +63,6 @@ export function DashboardDrilldownsManageProvider({ getService }: FtrProviderCon
       destinationDashboardTitle: string;
     }) {
       await this.fillInDrilldownName(drilldownName);
-      await this.selectDashboardToDashboardActionIfNeeded();
       await this.selectDestinationDashboard(destinationDashboardTitle);
     }
 
@@ -83,7 +76,6 @@ export function DashboardDrilldownsManageProvider({ getService }: FtrProviderCon
       trigger: 'VALUE_CLICK_TRIGGER' | 'SELECT_RANGE_TRIGGER';
     }) {
       await this.fillInDrilldownName(drilldownName);
-      await this.selectDashboardToURLActionIfNeeded();
       await this.selectTriggerIfNeeded(trigger);
       await this.fillInURLTemplate(destinationURLTemplate);
     }
@@ -92,20 +84,6 @@ export function DashboardDrilldownsManageProvider({ getService }: FtrProviderCon
       await testSubjects.setValue('drilldownNameInput', name);
     }
 
-    async selectDashboardToURLActionIfNeeded() {
-      if (await testSubjects.exists(DASHBOARD_TO_URL_ACTION_LIST_ITEM)) {
-        await testSubjects.click(DASHBOARD_TO_URL_ACTION_LIST_ITEM);
-      }
-      await testSubjects.existOrFail(DASHBOARD_TO_URL_ACTION_WIZARD);
-    }
-
-    async selectDashboardToDashboardActionIfNeeded() {
-      if (await testSubjects.exists(DASHBOARD_TO_DASHBOARD_ACTION_LIST_ITEM)) {
-        await testSubjects.click(DASHBOARD_TO_DASHBOARD_ACTION_LIST_ITEM);
-      }
-      await testSubjects.existOrFail(DASHBOARD_TO_DASHBOARD_ACTION_WIZARD);
-    }
-
     async selectDestinationDashboard(title: string) {
       await comboBox.set(DESTINATION_DASHBOARD_SELECT, title);
     }
diff --git a/x-pack/test/functional/services/ml/alerting.ts b/x-pack/test/functional/services/ml/alerting.ts
index 82f6a86d091992..8d27a75b7b485b 100644
--- a/x-pack/test/functional/services/ml/alerting.ts
+++ b/x-pack/test/functional/services/ml/alerting.ts
@@ -16,6 +16,7 @@ export function MachineLearningAlertingProvider(
   const retry = getService('retry');
   const comboBox = getService('comboBox');
   const testSubjects = getService('testSubjects');
+  const find = getService('find');
 
   return {
     async selectAnomalyDetectionAlertType() {
@@ -100,5 +101,47 @@ export function MachineLearningAlertingProvider(
         await testSubjects.existOrFail(`mlAnomalyAlertPreviewCallout`);
       });
     },
+
+    async assertLookbackInterval(expectedValue: string) {
+      const actualValue = await testSubjects.getAttribute(
+        'mlAnomalyAlertLookbackInterval',
+        'value'
+      );
+      expect(actualValue).to.eql(
+        expectedValue,
+        `Expected lookback interval to equal ${expectedValue}, got ${actualValue}`
+      );
+    },
+
+    async assertTopNBuckets(expectedNumberOfBuckets: number) {
+      const actualValue = await testSubjects.getAttribute('mlAnomalyAlertTopNBuckets', 'value');
+      expect(actualValue).to.eql(
+        expectedNumberOfBuckets,
+        `Expected number of buckets to equal ${expectedNumberOfBuckets}, got ${actualValue}`
+      );
+    },
+
+    async setLookbackInterval(interval: string) {
+      await this.ensureAdvancedSectionOpen();
+      await testSubjects.setValue('mlAnomalyAlertLookbackInterval', interval);
+      await this.assertLookbackInterval(interval);
+    },
+
+    async setTopNBuckets(numberOfBuckets: number) {
+      await this.ensureAdvancedSectionOpen();
+      await testSubjects.setValue('mlAnomalyAlertTopNBuckets', numberOfBuckets.toString());
+      await this.assertTopNBuckets(numberOfBuckets);
+    },
+
+    async ensureAdvancedSectionOpen() {
+      await retry.tryForTime(5000, async () => {
+        const isVisible = await find.existsByDisplayedByCssSelector(
+          '#mlAnomalyAlertAdvancedSettings'
+        );
+        if (!isVisible) {
+          await testSubjects.click('mlAnomalyAlertAdvancedSettingsTrigger');
+        }
+      });
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/dashboard_embeddables.ts b/x-pack/test/functional/services/ml/dashboard_embeddables.ts
index d0e100a57075a4..db5c3f35a2e144 100644
--- a/x-pack/test/functional/services/ml/dashboard_embeddables.ts
+++ b/x-pack/test/functional/services/ml/dashboard_embeddables.ts
@@ -8,14 +8,17 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { MlCommonUI } from './common_ui';
+import { MlDashboardJobSelectionTable } from './dashboard_job_selection_table';
 
 export function MachineLearningDashboardEmbeddablesProvider(
   { getService }: FtrProviderContext,
-  mlCommonUI: MlCommonUI
+  mlCommonUI: MlCommonUI,
+  mlDashboardJobSelectionTable: MlDashboardJobSelectionTable
 ) {
   const retry = getService('retry');
   const testSubjects = getService('testSubjects');
   const find = getService('find');
+  const dashboardAddPanel = getService('dashboardAddPanel');
 
   return {
     async assertAnomalyChartsEmbeddableInitializerExists() {
@@ -91,5 +94,17 @@ export function MachineLearningDashboardEmbeddablesProvider(
     async assertAnomalyChartsExists() {
       await testSubjects.existOrFail(`mlExplorerChartsContainer`);
     },
+
+    async openJobSelectionFlyout() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await dashboardAddPanel.clickEditorMenuButton();
+        await testSubjects.existOrFail('dashboardEditorContextMenu', { timeout: 2000 });
+
+        await dashboardAddPanel.clickEmbeddableFactoryGroupButton('ml');
+        await dashboardAddPanel.clickAddNewEmbeddableLink('ml_anomaly_charts');
+
+        await mlDashboardJobSelectionTable.assertJobSelectionTableExists();
+      });
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/dashboard_job_selection_table.ts b/x-pack/test/functional/services/ml/dashboard_job_selection_table.ts
index b9fe43b000baf6..f372928d92a50d 100644
--- a/x-pack/test/functional/services/ml/dashboard_job_selection_table.ts
+++ b/x-pack/test/functional/services/ml/dashboard_job_selection_table.ts
@@ -6,8 +6,13 @@
  */
 
 import expect from '@kbn/expect';
+import { ProvidedType } from '@kbn/test/types/ftr';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
+export type MlDashboardJobSelectionTable = ProvidedType<
+  typeof MachineLearningDashboardJobSelectionTableProvider
+>;
+
 export function MachineLearningDashboardJobSelectionTableProvider({
   getService,
 }: FtrProviderContext) {
@@ -16,8 +21,8 @@ export function MachineLearningDashboardJobSelectionTableProvider({
 
   return {
     async assertJobSelectionTableExists(): Promise<void> {
-      await retry.tryForTime(5000, async () => {
-        await testSubjects.existOrFail('mlCustomSelectionTable');
+      await retry.tryForTime(20 * 1000, async () => {
+        await testSubjects.existOrFail('mlCustomSelectionTable', { timeout: 2000 });
       });
     },
 
diff --git a/x-pack/test/functional/services/ml/index.ts b/x-pack/test/functional/services/ml/index.ts
index fe46263f502663..05d369d890289c 100644
--- a/x-pack/test/functional/services/ml/index.ts
+++ b/x-pack/test/functional/services/ml/index.ts
@@ -60,7 +60,11 @@ export function MachineLearningProvider(context: FtrProviderContext) {
   const customUrls = MachineLearningCustomUrlsProvider(context);
 
   const dashboardJobSelectionTable = MachineLearningDashboardJobSelectionTableProvider(context);
-  const dashboardEmbeddables = MachineLearningDashboardEmbeddablesProvider(context, commonUI);
+  const dashboardEmbeddables = MachineLearningDashboardEmbeddablesProvider(
+    context,
+    commonUI,
+    dashboardJobSelectionTable
+  );
 
   const dataFrameAnalytics = MachineLearningDataFrameAnalyticsProvider(context, api);
   const dataFrameAnalyticsCreation = MachineLearningDataFrameAnalyticsCreationProvider(
diff --git a/x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts
index 8fcf8be9fa4930..cc0dcff5286635 100644
--- a/x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/ml/alert_flyout.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Datafeed } from '@elastic/elasticsearch/api/types';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { DATAFEED_STATE } from '../../../../plugins/ml/common/constants/states';
 
@@ -39,7 +40,7 @@ function createTestJobAndDatafeed() {
         categorization_examples_limit: 4,
       },
     },
-    datafeed: {
+    datafeed: ({
       datafeed_id: `datafeed-${jobId}`,
       job_id: jobId,
       query: {
@@ -53,8 +54,9 @@ function createTestJobAndDatafeed() {
           must_not: [],
         },
       },
+      query_delay: '120s',
       indices: ['ft_ecommerce'],
-    },
+    } as unknown) as Datafeed,
   };
 }
 
@@ -83,7 +85,6 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       // @ts-expect-error not full interface
       await ml.api.createAnomalyDetectionJob(job);
       await ml.api.openAnomalyDetectionJob(job.job_id);
-      // @ts-expect-error not full interface
       await ml.api.createDatafeed(datafeed);
       await ml.api.startDatafeed(datafeed.datafeed_id);
       await ml.api.waitForDatafeedState(datafeed.datafeed_id, DATAFEED_STATE.STARTED);
@@ -109,6 +110,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await ml.alerting.selectResultType('record');
         await ml.alerting.setSeverity(10);
 
+        await ml.testExecution.logTestStep('should populate advanced settings with default values');
+        await ml.alerting.assertTopNBuckets(1);
+        await ml.alerting.assertLookbackInterval('123m');
+
         await ml.testExecution.logTestStep('should preview the alert condition');
         await ml.alerting.assertPreviewButtonState(false);
         await ml.alerting.setTestInterval('2y');
diff --git a/x-pack/test/search_sessions_integration/tests/apps/dashboard/async_search/save_search_session_relative_time.ts b/x-pack/test/search_sessions_integration/tests/apps/dashboard/async_search/save_search_session_relative_time.ts
index bb0e9d697063bd..dc107040ecd2e0 100644
--- a/x-pack/test/search_sessions_integration/tests/apps/dashboard/async_search/save_search_session_relative_time.ts
+++ b/x-pack/test/search_sessions_integration/tests/apps/dashboard/async_search/save_search_session_relative_time.ts
@@ -93,7 +93,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     log.debug('Checking area, bar and heatmap charts rendered');
     await dashboardExpect.seriesElementCount(15);
     log.debug('Checking saved searches rendered');
-    await dashboardExpect.savedSearchRowCount(50);
+    await dashboardExpect.savedSearchRowCount(11);
     log.debug('Checking input controls rendered');
     await dashboardExpect.inputControlItemCount(3);
     log.debug('Checking tag cloud rendered');
diff --git a/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts b/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts
index 2bd539dab5bf30..b9397964fd16a8 100644
--- a/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts
+++ b/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts
@@ -14,9 +14,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const browser = getService('browser');
   const inspector = getService('inspector');
-  const docTable = getService('docTable');
   const PageObjects = getPageObjects(['discover', 'common', 'timePicker', 'header', 'context']);
   const searchSessions = getService('searchSessions');
+  const dataGrid = getService('dataGrid');
+  const retry = getService('retry');
 
   describe('discover async search', () => {
     before(async () => {
@@ -66,9 +67,16 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
     it('navigation to context cleans the session', async () => {
       await PageObjects.common.clearAllToasts();
-      await docTable.clickRowToggle({ rowIndex: 0 });
-      const rowActions = await docTable.getRowActions({ rowIndex: 0 });
-      await rowActions[0].click();
+      await dataGrid.clickRowToggle({ rowIndex: 0 });
+
+      await retry.try(async () => {
+        const rowActions = await dataGrid.getRowActions({ rowIndex: 0 });
+        if (!rowActions.length) {
+          throw new Error('row actions empty, trying again');
+        }
+        await rowActions[1].click();
+      });
+
       await PageObjects.context.waitUntilContextLoadingHasFinished();
       await searchSessions.missingOrFail();
     });
diff --git a/yarn.lock b/yarn.lock
index 4d453cdb1dd27b..bdc6f78f1e8608 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -326,7 +326,7 @@
     chalk "^2.0.0"
     js-tokens "^4.0.0"
 
-"@babel/parser@^7.1.0", "@babel/parser@^7.12.10", "@babel/parser@^7.12.11", "@babel/parser@^7.12.13", "@babel/parser@^7.12.3", "@babel/parser@^7.12.7", "@babel/parser@^7.13.0", "@babel/parser@^7.2.0", "@babel/parser@^7.4.5", "@babel/parser@^7.7.0":
+"@babel/parser@^7.1.0", "@babel/parser@^7.12.10", "@babel/parser@^7.12.11", "@babel/parser@^7.12.13", "@babel/parser@^7.12.3", "@babel/parser@^7.12.7", "@babel/parser@^7.13.0", "@babel/parser@^7.4.5", "@babel/parser@^7.7.0":
   version "7.13.9"
   resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.13.9.tgz#ca34cb95e1c2dd126863a84465ae8ef66114be99"
   integrity sha512-nEUfRiARCcaVo3ny3ZQjURjHQZUo/JkEw7rLlSZy/psWGnvwXFtPcr6jb7Yb41DVW5LTe6KRq9LGleRNsg1Frw==
@@ -1163,7 +1163,7 @@
     "@babel/parser" "^7.12.13"
     "@babel/types" "^7.12.13"
 
-"@babel/traverse@^7.1.0", "@babel/traverse@^7.1.6", "@babel/traverse@^7.10.4", "@babel/traverse@^7.12.1", "@babel/traverse@^7.12.10", "@babel/traverse@^7.12.12", "@babel/traverse@^7.12.5", "@babel/traverse@^7.12.9", "@babel/traverse@^7.13.0", "@babel/traverse@^7.4.5", "@babel/traverse@^7.7.0":
+"@babel/traverse@^7.1.0", "@babel/traverse@^7.10.4", "@babel/traverse@^7.12.1", "@babel/traverse@^7.12.10", "@babel/traverse@^7.12.12", "@babel/traverse@^7.12.5", "@babel/traverse@^7.12.9", "@babel/traverse@^7.13.0", "@babel/traverse@^7.4.5", "@babel/traverse@^7.7.0":
   version "7.13.0"
   resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.13.0.tgz#6d95752475f86ee7ded06536de309a65fc8966cc"
   integrity sha512-xys5xi5JEhzC3RzEmSGrs/b3pJW/o87SypZ+G/PhaE7uqVQNv/jlmVIBXuoh5atqQ434LfXV+sf23Oxj0bchJQ==
@@ -1178,7 +1178,7 @@
     globals "^11.1.0"
     lodash "^4.17.19"
 
-"@babel/types@^7.0.0", "@babel/types@^7.10.4", "@babel/types@^7.10.5", "@babel/types@^7.12.1", "@babel/types@^7.12.10", "@babel/types@^7.12.11", "@babel/types@^7.12.12", "@babel/types@^7.12.13", "@babel/types@^7.12.5", "@babel/types@^7.12.7", "@babel/types@^7.13.0", "@babel/types@^7.2.0", "@babel/types@^7.3.0", "@babel/types@^7.3.3", "@babel/types@^7.4.4", "@babel/types@^7.7.0":
+"@babel/types@^7.0.0", "@babel/types@^7.10.4", "@babel/types@^7.10.5", "@babel/types@^7.12.1", "@babel/types@^7.12.10", "@babel/types@^7.12.11", "@babel/types@^7.12.12", "@babel/types@^7.12.13", "@babel/types@^7.12.5", "@babel/types@^7.12.7", "@babel/types@^7.13.0", "@babel/types@^7.3.0", "@babel/types@^7.3.3", "@babel/types@^7.4.4", "@babel/types@^7.7.0":
   version "7.13.0"
   resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.13.0.tgz#74424d2816f0171b4100f0ab34e9a374efdf7f80"
   integrity sha512-hE+HE8rnG1Z6Wzo+MhaKE5lM5eMx71T4EHJgku2E3xIfaULhDcxiiRxUYgwX8qwP1BBSlag+TdGOt6JAidIZTA==
@@ -2624,7 +2624,7 @@
   version "0.0.0"
   uid ""
 
-"@kbn/babel-preset@link:packages/kbn-babel-preset":
+"@kbn/babel-preset@link:bazel-bin/packages/kbn-babel-preset/npm_module":
   version "0.0.0"
   uid ""
 
@@ -4536,16 +4536,6 @@
   resolved "https://registry.yarnpkg.com/@types/aria-query/-/aria-query-4.2.0.tgz#14264692a9d6e2fa4db3df5e56e94b5e25647ac0"
   integrity sha512-iIgQNzCm0v7QMhhe4Jjn9uRh+I6GoPmt03CbEtwx3ao8/EfoQcmgtqH4vQ5Db/lxiIGaWDv6nwvunuh0RyX0+A==
 
-"@types/async@2.0.49":
-  version "2.0.49"
-  resolved "https://registry.yarnpkg.com/@types/async/-/async-2.0.49.tgz#92e33d13f74c895cb9a7f38ba97db8431ed14bc0"
-  integrity sha512-Benr3i5odUkvpFkOpzGqrltGdbSs+EVCkEBGXbuR7uT0VzhXKIkhem6PDzHdx5EonA+rfbB3QvP6aDOw5+zp5Q==
-
-"@types/babel-types@*":
-  version "7.0.4"
-  resolved "https://registry.yarnpkg.com/@types/babel-types/-/babel-types-7.0.4.tgz#bfd5b0d0d1ba13e351dff65b6e52783b816826c8"
-  integrity sha512-WiZhq3SVJHFRgRYLXvpf65XnV6ipVHhnNaNvE8yCimejrGglkg38kEj0JcizqwSHxmPSjcTlig/6JouxLGEhGw==
-
 "@types/babel__core@^7.0.0", "@types/babel__core@^7.1.7":
   version "7.1.10"
   resolved "https://registry.yarnpkg.com/@types/babel__core/-/babel__core-7.1.10.tgz#ca58fc195dd9734e77e57c6f2df565623636ab40"
@@ -4590,13 +4580,6 @@
   dependencies:
     "@babel/types" "^7.3.0"
 
-"@types/babylon@6.16.5":
-  version "6.16.5"
-  resolved "https://registry.yarnpkg.com/@types/babylon/-/babylon-6.16.5.tgz#1c5641db69eb8cdf378edd25b4be7754beeb48b4"
-  integrity sha512-xH2e58elpj1X4ynnKp9qSnWlsRTIs6n3tgLGNfwAGHwePw0mulHQllV34n0T25uYSu1k0hRKkWXF890B1yS47w==
-  dependencies:
-    "@types/babel-types" "*"
-
 "@types/base64-js@^1.2.5":
   version "1.2.5"
   resolved "https://registry.yarnpkg.com/@types/base64-js/-/base64-js-1.2.5.tgz#582b2476169a6cba460a214d476c744441d873d5"
@@ -5052,11 +5035,6 @@
   resolved "https://registry.yarnpkg.com/@types/is-function/-/is-function-1.0.0.tgz#1b0b819b1636c7baf0d6785d030d12edf70c3e83"
   integrity sha512-iTs9HReBu7evG77Q4EC8hZnqRt57irBDkK9nvmHroiOIVwYMQc4IvYvdRgwKfYepunIY7Oh/dBuuld+Gj9uo6w==
 
-"@types/is-glob@4.0.0":
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/@types/is-glob/-/is-glob-4.0.0.tgz#fb8a2bff539025d4dcd6d5efe7689e03341b876d"
-  integrity sha512-zC/2EmD8scdsGIeE+Xg7kP7oi9VP90zgMQtm9Cr25av4V+a+k8slQyiT60qSw8KORYrOKlPXfHwoa1bQbRzskQ==
-
 "@types/istanbul-lib-coverage@*", "@types/istanbul-lib-coverage@^2.0.0", "@types/istanbul-lib-coverage@^2.0.1":
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.1.tgz#42995b446db9a48a11a07ec083499a860e9138ff"
@@ -5398,7 +5376,7 @@
   dependencies:
     "@types/node" "*"
 
-"@types/node@*", "@types/node@12.12.50", "@types/node@14.14.14", "@types/node@8.10.54", "@types/node@>= 8", "@types/node@>=8.9.0", "@types/node@^10.1.0", "@types/node@^12.0.2":
+"@types/node@*", "@types/node@12.12.50", "@types/node@14.14.14", "@types/node@8.10.54", "@types/node@>= 8", "@types/node@>=8.9.0", "@types/node@^10.1.0":
   version "14.14.14"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-14.14.14.tgz#f7fd5f3cc8521301119f63910f0fb965c7d761ae"
   integrity sha512-UHnOPWVWV1z+VV8k6L1HhG7UbGBgIdghqF3l9Ny9ApPghbjICXkUJSd/b9gOgQfjM1r+37cipdw/HJ3F6ICEnQ==
@@ -5505,11 +5483,6 @@
   dependencies:
     "@types/node" "*"
 
-"@types/prettier@1.16.1":
-  version "1.16.1"
-  resolved "https://registry.yarnpkg.com/@types/prettier/-/prettier-1.16.1.tgz#328d1c9b54402e44119398bcb6a31b7bbd606d59"
-  integrity sha512-db6pZL5QY3JrlCHBhYQzYDci0xnoDuxfseUuguLRr3JNk+bnCfpkK6p8quiUDyO8A0vbpBKkk59Fw125etrNeA==
-
 "@types/prettier@^2.0.0":
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.0.2.tgz#5bb52ee68d0f8efa9cc0099920e56be6cc4e37f3"
@@ -5954,11 +5927,6 @@
   dependencies:
     "@types/node" "*"
 
-"@types/valid-url@1.0.2":
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/@types/valid-url/-/valid-url-1.0.2.tgz#60fa435ce24bfd5ba107b8d2a80796aeaf3a8f45"
-  integrity sha1-YPpDXOJL/VuhB7jSqAeWrq86j0U=
-
 "@types/vfile-message@^2.0.0":
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/@types/vfile-message/-/vfile-message-2.0.0.tgz#690e46af0fdfc1f9faae00cd049cc888957927d5"
@@ -6349,21 +6317,6 @@
   resolved "https://registry.yarnpkg.com/@wildpeaks/snapshot-dom/-/snapshot-dom-1.6.0.tgz#83297612bf93b97983beafbe6ae71672642ac884"
   integrity sha512-fCM5tYK6VZ1nhbk3Q11lkf6UOJlOCRU0oScQ8NV8OYBPC58wQmQaOF9g+rk+yhNYf3beybOBr+ZuiNen3B0Bxw==
 
-"@wry/context@^0.4.0":
-  version "0.4.1"
-  resolved "https://registry.yarnpkg.com/@wry/context/-/context-0.4.1.tgz#b3e23ca036035cbad0bd9711269352dd03a6fe3c"
-  integrity sha512-ZpIrDGek+IU9wkID/TYSgcYeLXsSM2VkbfAxO4NjWBGeM/OrA9KyNmy8msYlAEKPmKxi3mIbXg3jcb3f6pqnaQ==
-  dependencies:
-    "@types/node" "^12.0.2"
-    tslib "^1.9.3"
-
-"@wry/equality@^0.1.2":
-  version "0.1.9"
-  resolved "https://registry.yarnpkg.com/@wry/equality/-/equality-0.1.9.tgz#b13e18b7a8053c6858aa6c85b54911fb31e3a909"
-  integrity sha512-mB6ceGjpMGz1ZTza8HYnrPGos2mC6So4NhS1PtZ8s4Qt0K7fBiIGhpSxUbQmhwcSWE3no+bYxmI2OL6KuXYmoQ==
-  dependencies:
-    tslib "^1.9.3"
-
 "@xobotyi/scrollbar-width@1.9.5":
   version "1.9.5"
   resolved "https://registry.yarnpkg.com/@xobotyi/scrollbar-width/-/scrollbar-width-1.9.5.tgz#80224a6919272f405b87913ca13b92929bdf3c4d"
@@ -6531,14 +6484,6 @@ agentkeepalive@^3.4.1:
   dependencies:
     humanize-ms "^1.2.1"
 
-aggregate-error@2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/aggregate-error/-/aggregate-error-2.1.0.tgz#051a9a733ad2e95ab503d84fb81989e6419b8f09"
-  integrity sha512-rIZJqC4XACGWwmPpi18IhDjIzXTJ93KQwYHXuyMCa0Ak9mtzLIbykuei+0i5EnGDy6ts8JVnSyRnZc2cVIMvVg==
-  dependencies:
-    clean-stack "^2.0.0"
-    indent-string "^3.0.0"
-
 aggregate-error@^3.0.0:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/aggregate-error/-/aggregate-error-3.0.1.tgz#db2fe7246e536f40d9b5442a39e117d7dd6a24e0"
@@ -6729,7 +6674,7 @@ ansi-colors@^3.0.0:
   resolved "https://registry.yarnpkg.com/ansi-colors/-/ansi-colors-3.2.4.tgz#e3a3da4bfbae6c86a9c285625de124a234026fbf"
   integrity sha512-hHUXGagefjN2iRrID63xckIvotOXOojhQKWIPUZ4mNUZ9nLZW+7FMNoE1lOkEhNWYsx/7ysGIuJYCiMAA9FnrA==
 
-ansi-escapes@^3.0.0, ansi-escapes@^3.1.0, ansi-escapes@^3.2.0:
+ansi-escapes@^3.0.0, ansi-escapes@^3.1.0:
   version "3.2.0"
   resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-3.2.0.tgz#8780b98ff9dbf5638152d1f1fe5c1d7b4442976b"
   integrity sha512-cBhpre4ma+U0T1oM5fXg7Dy1Jw7zzwv7lt/GoCpr+hDQJoYnKVPLL4dCvSEFMmQurOQvSrwT7SL/DAlhBI97RQ==
@@ -6909,201 +6854,6 @@ apidoc@^0.25.0:
     nodemon "^2.0.4"
     winston "^3.3.3"
 
-apollo-cache-control@^0.1.0:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/apollo-cache-control/-/apollo-cache-control-0.1.1.tgz#173d14ceb3eb9e7cb53de7eb8b61bee6159d4171"
-  integrity sha512-XJQs167e9u+e5ybSi51nGYr70NPBbswdvTEHtbtXbwkZ+n9t0SLPvUcoqceayOSwjK1XYOdU/EKPawNdb3rLQA==
-  dependencies:
-    graphql-extensions "^0.0.x"
-
-apollo-cache-inmemory@1.6.2:
-  version "1.6.2"
-  resolved "https://registry.yarnpkg.com/apollo-cache-inmemory/-/apollo-cache-inmemory-1.6.2.tgz#bbf2e4e1eacdf82b2d526f5c2f3b37e5acee3c5e"
-  integrity sha512-AyCl3PGFv5Qv1w4N9vlg63GBPHXgMCekZy5mhlS042ji0GW84uTySX+r3F61ZX3+KM1vA4m9hQyctrEGiv5XjQ==
-  dependencies:
-    apollo-cache "^1.3.2"
-    apollo-utilities "^1.3.2"
-    optimism "^0.9.0"
-    ts-invariant "^0.4.0"
-    tslib "^1.9.3"
-
-apollo-cache@^1.1.14:
-  version "1.1.14"
-  resolved "https://registry.yarnpkg.com/apollo-cache/-/apollo-cache-1.1.14.tgz#c7d54cdbc7f544161f78fa5e4bae56650e22f7ad"
-  integrity sha512-Zmo9nVqpWFogki2QyulX6Xx6KYXMyYWX74grwgsYYUOukl4pIAdtYyK8e874o0QDgzSOq5AYPXjtfkoVpqhCRw==
-  dependencies:
-    apollo-utilities "^1.0.18"
-
-apollo-cache@^1.3.2:
-  version "1.3.2"
-  resolved "https://registry.yarnpkg.com/apollo-cache/-/apollo-cache-1.3.2.tgz#df4dce56240d6c95c613510d7e409f7214e6d26a"
-  integrity sha512-+KA685AV5ETEJfjZuviRTEImGA11uNBp/MJGnaCvkgr+BYRrGLruVKBv6WvyFod27WEB2sp7SsG8cNBKANhGLg==
-  dependencies:
-    apollo-utilities "^1.3.2"
-    tslib "^1.9.3"
-
-apollo-client@^2.3.8:
-  version "2.3.8"
-  resolved "https://registry.yarnpkg.com/apollo-client/-/apollo-client-2.3.8.tgz#0384a7210eb601ab88b1c13750da076fc9255b95"
-  integrity sha512-X5wsBD1be1P/mScGsH5H+2hIE8d78WAfqOvFvBpP+C+jzJ9387uHLyFmYYMLRRqDQ3ihjI4iSID7KEOW2gyCcQ==
-  dependencies:
-    "@types/zen-observable" "^0.8.0"
-    apollo-cache "^1.1.14"
-    apollo-link "^1.0.0"
-    apollo-link-dedup "^1.0.0"
-    apollo-utilities "^1.0.18"
-    symbol-observable "^1.0.2"
-    zen-observable "^0.8.0"
-  optionalDependencies:
-    "@types/async" "2.0.49"
-
-apollo-link-dedup@^1.0.0:
-  version "1.0.9"
-  resolved "https://registry.yarnpkg.com/apollo-link-dedup/-/apollo-link-dedup-1.0.9.tgz#3c4e4af88ef027cbddfdb857c043fd0574051dad"
-  integrity sha512-RbuEKpmSHVMtoREMPh2wUFTeh65q+0XPVeqgaOP/rGEAfvLyOMvX0vT2nVaejMohoMxuUnfZwpldXaDFWnlVbg==
-  dependencies:
-    apollo-link "^1.2.2"
-
-apollo-link-error@^1.1.7:
-  version "1.1.10"
-  resolved "https://registry.yarnpkg.com/apollo-link-error/-/apollo-link-error-1.1.10.tgz#ce57f0793f0923b598655de5bf5e028d4cf4fba6"
-  integrity sha512-itG5UV7mQqaalmRkuRsF0cUS4zW2ja8XCbxkMZnIEeN24X3yoJi5hpJeAaEkXf0KgYNsR0+rmtCQNruWyxDnZQ==
-  dependencies:
-    apollo-link "^1.2.11"
-    apollo-link-http-common "^0.2.13"
-    tslib "^1.9.3"
-
-apollo-link-http-common@^0.2.13:
-  version "0.2.13"
-  resolved "https://registry.yarnpkg.com/apollo-link-http-common/-/apollo-link-http-common-0.2.13.tgz#c688f6baaffdc7b269b2db7ae89dae7c58b5b350"
-  integrity sha512-Uyg1ECQpTTA691Fwx5e6Rc/6CPSu4TB4pQRTGIpwZ4l5JDOQ+812Wvi/e3IInmzOZpwx5YrrOfXrtN8BrsDXoA==
-  dependencies:
-    apollo-link "^1.2.11"
-    ts-invariant "^0.3.2"
-    tslib "^1.9.3"
-
-apollo-link-http-common@^0.2.15:
-  version "0.2.15"
-  resolved "https://registry.yarnpkg.com/apollo-link-http-common/-/apollo-link-http-common-0.2.15.tgz#304e67705122bf69a9abaded4351b10bc5efd6d9"
-  integrity sha512-+Heey4S2IPsPyTf8Ag3PugUupASJMW894iVps6hXbvwtg1aHSNMXUYO5VG7iRHkPzqpuzT4HMBanCTXPjtGzxg==
-  dependencies:
-    apollo-link "^1.2.13"
-    ts-invariant "^0.4.0"
-    tslib "^1.9.3"
-
-apollo-link-http@^1.5.16:
-  version "1.5.16"
-  resolved "https://registry.yarnpkg.com/apollo-link-http/-/apollo-link-http-1.5.16.tgz#44fe760bcc2803b8a7f57fc9269173afb00f3814"
-  integrity sha512-IA3xA/OcrOzINRZEECI6IdhRp/Twom5X5L9jMehfzEo2AXdeRwAMlH5LuvTZHgKD8V1MBnXdM6YXawXkTDSmJw==
-  dependencies:
-    apollo-link "^1.2.13"
-    apollo-link-http-common "^0.2.15"
-    tslib "^1.9.3"
-
-apollo-link-schema@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/apollo-link-schema/-/apollo-link-schema-1.1.0.tgz#033fda26ffdbfc809d04892de554867f50e2af8e"
-  integrity sha512-sqWjse5RfrMAhrXecv0WdSLLdF1R5lI4YpbfkioIeJAkB7VB2o+mgA/+onATYKp214MSjloCDWzkvnVpRPFoBw==
-  dependencies:
-    apollo-link "^1.2.2"
-
-apollo-link-state@^0.4.1:
-  version "0.4.1"
-  resolved "https://registry.yarnpkg.com/apollo-link-state/-/apollo-link-state-0.4.1.tgz#65e9e0e12c67936b8c4b12b8438434f393104579"
-  integrity sha512-69/til4ENfl/Fvf7br2xSsLSBcxcXPbOHVNkzLLejvUZickl93HLO4/fO+uvoBi4dCYRgN17Zr8FwI41ueRx0g==
-  dependencies:
-    apollo-utilities "^1.0.8"
-    graphql-anywhere "^4.1.0-alpha.0"
-
-apollo-link@^1.0.0, apollo-link@^1.2.2, apollo-link@^1.2.3:
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/apollo-link/-/apollo-link-1.2.3.tgz#9bd8d5fe1d88d31dc91dae9ecc22474d451fb70d"
-  integrity sha512-iL9yS2OfxYhigme5bpTbmRyC+Htt6tyo2fRMHT3K1XRL/C5IQDDz37OjpPy4ndx7WInSvfSZaaOTKFja9VWqSw==
-  dependencies:
-    apollo-utilities "^1.0.0"
-    zen-observable-ts "^0.8.10"
-
-apollo-link@^1.2.11:
-  version "1.2.11"
-  resolved "https://registry.yarnpkg.com/apollo-link/-/apollo-link-1.2.11.tgz#493293b747ad3237114ccd22e9f559e5e24a194d"
-  integrity sha512-PQvRCg13VduLy3X/0L79M6uOpTh5iHdxnxYuo8yL7sJlWybKRJwsv4IcRBJpMFbChOOaHY7Og9wgPo6DLKDKDA==
-  dependencies:
-    apollo-utilities "^1.2.1"
-    ts-invariant "^0.3.2"
-    tslib "^1.9.3"
-    zen-observable-ts "^0.8.18"
-
-apollo-link@^1.2.13:
-  version "1.2.13"
-  resolved "https://registry.yarnpkg.com/apollo-link/-/apollo-link-1.2.13.tgz#dff00fbf19dfcd90fddbc14b6a3f9a771acac6c4"
-  integrity sha512-+iBMcYeevMm1JpYgwDEIDt/y0BB7VWyvlm/7x+TIPNLHCTCMgcEgDuW5kH86iQZWo0I7mNwQiTOz+/3ShPFmBw==
-  dependencies:
-    apollo-utilities "^1.3.0"
-    ts-invariant "^0.4.0"
-    tslib "^1.9.3"
-    zen-observable-ts "^0.8.20"
-
-apollo-server-core@^1.3.6:
-  version "1.3.6"
-  resolved "https://registry.yarnpkg.com/apollo-server-core/-/apollo-server-core-1.3.6.tgz#08636243c2de56fa8c267d68dd602cb1fbd323e3"
-  integrity sha1-CGNiQ8LeVvqMJn1o3WAssfvTI+M=
-  dependencies:
-    apollo-cache-control "^0.1.0"
-    apollo-tracing "^0.1.0"
-    graphql-extensions "^0.0.x"
-
-apollo-server-errors@^2.0.2:
-  version "2.0.2"
-  resolved "https://registry.yarnpkg.com/apollo-server-errors/-/apollo-server-errors-2.0.2.tgz#e9cbb1b74d2cd78aed23cd886ca2d0c186323b2b"
-  integrity sha512-zyWDqAVDCkj9espVsoUpZr9PwDznM8UW6fBfhV+i1br//s2AQb07N6ektZ9pRIEvkhykDZW+8tQbDwAO0vUROg==
-
-apollo-server-hapi@^1.3.6:
-  version "1.3.6"
-  resolved "https://registry.yarnpkg.com/apollo-server-hapi/-/apollo-server-hapi-1.3.6.tgz#44dea128b64c1c10fdd35ac8307896a57ba1f4a8"
-  integrity sha1-RN6hKLZMHBD901rIMHiWpXuh9Kg=
-  dependencies:
-    apollo-server-core "^1.3.6"
-    apollo-server-module-graphiql "^1.3.4"
-    boom "^7.1.0"
-
-apollo-server-module-graphiql@^1.3.4:
-  version "1.3.4"
-  resolved "https://registry.yarnpkg.com/apollo-server-module-graphiql/-/apollo-server-module-graphiql-1.3.4.tgz#50399b7c51b7267d0c841529f5173e5fc7304de4"
-  integrity sha1-UDmbfFG3Jn0MhBUp9Rc+X8cwTeQ=
-
-apollo-tracing@^0.1.0:
-  version "0.1.4"
-  resolved "https://registry.yarnpkg.com/apollo-tracing/-/apollo-tracing-0.1.4.tgz#5b8ae1b01526b160ee6e552a7f131923a9aedcc7"
-  integrity sha512-Uv+1nh5AsNmC3m130i2u3IqbS+nrxyVV3KYimH5QKsdPjxxIQB3JAT+jJmpeDxBel8gDVstNmCh82QSLxLSIdQ==
-  dependencies:
-    graphql-extensions "~0.0.9"
-
-apollo-utilities@^1.0.0, apollo-utilities@^1.0.1, apollo-utilities@^1.0.18, apollo-utilities@^1.0.8:
-  version "1.0.18"
-  resolved "https://registry.yarnpkg.com/apollo-utilities/-/apollo-utilities-1.0.18.tgz#e4ee91534283fde2b744a26caaea120fe6a94f67"
-  integrity sha512-hHrmsoMYzzzfUlTOPpxr0qRpTLotMkBIQ93Ub7ki2SWdLfYYKrp6/KB8YOUkbCwXxSFvYSV24ccuwUEqZIaHIA==
-  dependencies:
-    fast-json-stable-stringify "^2.0.0"
-
-apollo-utilities@^1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/apollo-utilities/-/apollo-utilities-1.2.1.tgz#1c3a1ebf5607d7c8efe7636daaf58e7463b41b3c"
-  integrity sha512-Zv8Udp9XTSFiN8oyXOjf6PMHepD4yxxReLsl6dPUy5Ths7jti3nmlBzZUOxuTWRwZn0MoclqL7RQ5UEJN8MAxg==
-  dependencies:
-    fast-json-stable-stringify "^2.0.0"
-    ts-invariant "^0.2.1"
-    tslib "^1.9.3"
-
-apollo-utilities@^1.3.0, apollo-utilities@^1.3.2:
-  version "1.3.2"
-  resolved "https://registry.yarnpkg.com/apollo-utilities/-/apollo-utilities-1.3.2.tgz#8cbdcf8b012f664cd6cb5767f6130f5aed9115c9"
-  integrity sha512-JWNHj8XChz7S4OZghV6yc9FNnzEXj285QYp/nLNh943iObycI5GTDO3NGR9Dth12LRrSFMeDOConPfPln+WGfg==
-  dependencies:
-    "@wry/equality" "^0.1.2"
-    fast-json-stable-stringify "^2.0.0"
-    ts-invariant "^0.4.0"
-    tslib "^1.9.3"
-
 app-root-dir@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/app-root-dir/-/app-root-dir-1.0.2.tgz#38187ec2dea7577fff033ffcb12172692ff6e118"
@@ -7568,7 +7318,7 @@ async@^1.4.2, async@~1.5.2:
   resolved "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"
   integrity sha1-7GphrlZIDAw8skHJVhjiCJL5Zyo=
 
-async@^2.1.4, async@^2.6.1, async@^2.6.2:
+async@^2.1.4, async@^2.6.2:
   version "2.6.3"
   resolved "https://registry.yarnpkg.com/async/-/async-2.6.3.tgz#d72625e2344a3656e3a3ad4fa749fa83299d82ff"
   integrity sha512-zflvls11DCy+dQWzTW2dzuilv8Z5X/pjfmZOWba6TNIVDm+2UDaJmXSOXlasHKfNBs8oo3M0aT50fDEWfKZjXg==
@@ -8168,15 +7918,6 @@ babel-traverse@^6.18.0, babel-traverse@^6.26.0:
     invariant "^2.2.2"
     lodash "^4.17.4"
 
-babel-types@7.0.0-beta.3:
-  version "7.0.0-beta.3"
-  resolved "https://registry.yarnpkg.com/babel-types/-/babel-types-7.0.0-beta.3.tgz#cd927ca70e0ae8ab05f4aab83778cfb3e6eb20b4"
-  integrity sha512-36k8J+byAe181OmCMawGhw+DtKO7AwexPVtsPXoMfAkjtZgoCX3bEuHWfdE5sYxRM8dojvtG/+O08M0Z/YDC6w==
-  dependencies:
-    esutils "^2.0.2"
-    lodash "^4.2.0"
-    to-fast-properties "^2.0.0"
-
 babel-types@^6.18.0, babel-types@^6.26.0:
   version "6.26.0"
   resolved "https://registry.yarnpkg.com/babel-types/-/babel-types-6.26.0.tgz#a3b073f94ab49eb6fa55cd65227a334380632497"
@@ -8192,11 +7933,6 @@ babelify@10.0.0:
   resolved "https://registry.yarnpkg.com/babelify/-/babelify-10.0.0.tgz#fe73b1a22583f06680d8d072e25a1e0d1d1d7fb5"
   integrity sha512-X40FaxyH7t3X+JFAKvb1H9wooWKLRCi8pg3m8poqtdZaIng+bjzp9RvKQCvRjF9isHiPkXspbbXT/zwXLtwgwg==
 
-babylon@7.0.0-beta.47:
-  version "7.0.0-beta.47"
-  resolved "https://registry.yarnpkg.com/babylon/-/babylon-7.0.0-beta.47.tgz#6d1fa44f0abec41ab7c780481e62fd9aafbdea80"
-  integrity sha512-+rq2cr4GDhtToEzKFD6KZZMDBXhjFAr9JjPw9pAppZACeEWqNM294j+NdBzkSHYXwzzBmVjZ3nEVJlOhbR2gOQ==
-
 babylon@^6.18.0:
   version "6.18.0"
   resolved "https://registry.yarnpkg.com/babylon/-/babylon-6.18.0.tgz#af2f3b88fa6f5c1e4c634d1a0f8eac4f55b395e3"
@@ -8436,7 +8172,7 @@ boolbase@^1.0.0, boolbase@~1.0.0:
   resolved "https://registry.yarnpkg.com/boolbase/-/boolbase-1.0.0.tgz#68dff5fbe60c51eb37725ea9e3ed310dcc1e776e"
   integrity sha1-aN/1++YMUes3cl6p4+0xDcwed24=
 
-boom@7.x.x, boom@^7.1.0:
+boom@7.x.x:
   version "7.2.2"
   resolved "https://registry.yarnpkg.com/boom/-/boom-7.2.2.tgz#ac92101451aa5cea901aed07d881dd32b4f08345"
   integrity sha512-IFUbOa8PS7xqmhIjpeStwT3d09hGkNYQ6aj2iELSTxcVs2u0aKn1NzhkdUQSzsRg1FVkj3uit3I6mXQCBixw+A==
@@ -9108,7 +8844,7 @@ callsites@^3.1.0:
   resolved "https://registry.yarnpkg.com/callsites/-/callsites-3.1.0.tgz#b3630abd8943432f54b3f0519238e33cd7df2f73"
   integrity sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==
 
-camel-case@3.0.x, camel-case@^3.0.0:
+camel-case@3.0.x:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/camel-case/-/camel-case-3.0.0.tgz#ca3c3688a4e9cf3a4cda777dc4dcbc713249cf73"
   integrity sha1-yjw2iKTpzzpM2nd9xNy8cTJJz3M=
@@ -9316,30 +9052,6 @@ chance@1.0.18:
   resolved "https://registry.yarnpkg.com/chance/-/chance-1.0.18.tgz#79788fe6fca4c338bf404321c347eecc80f969ee"
   integrity sha512-g9YLQVHVZS/3F+zIicfB58vjcxopvYQRp7xHzvyDFDhXH1aRZI/JhwSAO0X5qYiQluoGnaNAU6wByD2KTxJN1A==
 
-change-case@3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/change-case/-/change-case-3.1.0.tgz#0e611b7edc9952df2e8513b27b42de72647dd17e"
-  integrity sha512-2AZp7uJZbYEzRPsFoa+ijKdvp9zsrnnt6+yFokfwEpeJm0xuJDVoxiRCAaTzyJND8GJkofo2IcKWaUZ/OECVzw==
-  dependencies:
-    camel-case "^3.0.0"
-    constant-case "^2.0.0"
-    dot-case "^2.1.0"
-    header-case "^1.0.0"
-    is-lower-case "^1.1.0"
-    is-upper-case "^1.1.0"
-    lower-case "^1.1.1"
-    lower-case-first "^1.0.0"
-    no-case "^2.3.2"
-    param-case "^2.1.0"
-    pascal-case "^2.0.0"
-    path-case "^2.1.0"
-    sentence-case "^2.1.0"
-    snake-case "^2.1.0"
-    swap-case "^1.1.0"
-    title-case "^2.1.0"
-    upper-case "^1.1.1"
-    upper-case-first "^1.1.0"
-
 change-emitter@^0.1.2:
   version "0.1.6"
   resolved "https://registry.yarnpkg.com/change-emitter/-/change-emitter-0.1.6.tgz#e8b2fe3d7f1ab7d69a32199aff91ea6931409515"
@@ -9429,7 +9141,7 @@ cheerio@^1.0.0-rc.3:
     lodash "^4.15.0"
     parse5 "^3.0.1"
 
-chokidar@2.1.2, chokidar@3.4.3, chokidar@^2.0.0, chokidar@^2.0.4, chokidar@^2.1.1, chokidar@^2.1.2, chokidar@^2.1.8, chokidar@^3.2.2, chokidar@^3.4.0, chokidar@^3.4.1, chokidar@^3.4.3:
+chokidar@3.4.3, chokidar@^2.0.0, chokidar@^2.0.4, chokidar@^2.1.1, chokidar@^2.1.2, chokidar@^2.1.8, chokidar@^3.2.2, chokidar@^3.4.0, chokidar@^3.4.1, chokidar@^3.4.3:
   version "3.4.3"
   resolved "https://registry.yarnpkg.com/chokidar/-/chokidar-3.4.3.tgz#c1df38231448e45ca4ac588e6c79573ba6a57d5b"
   integrity sha512-DtM3g7juCXQxFVSNPNByEC2+NImtBuxQQvWlHunpJIS5Ocr0lG306cC7FCi7cEA0fzmybPUIl4txBIobk1gGOQ==
@@ -9629,11 +9341,6 @@ cli-ux@^4.9.0:
     treeify "^1.1.0"
     tslib "^1.9.3"
 
-cli-width@^2.0.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/cli-width/-/cli-width-2.2.0.tgz#ff19ede8a9a5e579324147b0c11f0fbcbabed639"
-  integrity sha1-/xnt6Kml5XkyQUewwR8PvLq+1jk=
-
 cli-width@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/cli-width/-/cli-width-3.0.0.tgz#a2f48437a2caa9a22436e794bf071ec9e61cedf6"
@@ -9898,11 +9605,6 @@ colorette@^1.2.0, colorette@^1.2.1:
   resolved "https://registry.yarnpkg.com/colorette/-/colorette-1.2.1.tgz#4d0b921325c14faf92633086a536db6e89564b1b"
   integrity sha512-puCDz0CzydiSYOrnXpz/PKd69zRrribezjtE9yd4zvytoRc8+RY/KJPvtPFKZS3E3wP6neGyMe0vOTlHO5L3Pw==
 
-colornames@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/colornames/-/colornames-1.1.1.tgz#f8889030685c7c4ff9e2a559f5077eb76a816f96"
-  integrity sha1-+IiQMGhcfE/54qVZ9Qd+t2qBb5Y=
-
 colors@1.0.3:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/colors/-/colors-1.0.3.tgz#0433f44d809680fdeb60ed260f1b0c262e82a40b"
@@ -9968,11 +9670,6 @@ commander@2.17.x, commander@~2.17.1:
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.17.1.tgz#bd77ab7de6de94205ceacc72f1716d29f20a77bf"
   integrity sha512-wPMUt6FnH2yzG95SA6mzjQOEKUU3aLaDEmzs1ti+1E9h+CsrZghRlqEM/EJ4KscsQVG8uNN4uVreUeT8+drlgg==
 
-commander@2.19.0:
-  version "2.19.0"
-  resolved "https://registry.yarnpkg.com/commander/-/commander-2.19.0.tgz#f6198aa84e5b83c46054b94ddedbfed5ee9ff12a"
-  integrity sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg==
-
 commander@^3.0.2:
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/commander/-/commander-3.0.2.tgz#6837c3fb677ad9933d1cfba42dd14d5117d6b39e"
@@ -9993,7 +9690,7 @@ commander@^5.1.0:
   resolved "https://registry.yarnpkg.com/commander/-/commander-5.1.0.tgz#46abbd1652f8e059bddaef99bbdcb2ad9cf179ae"
   integrity sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==
 
-common-tags@1.8.0, common-tags@^1.8.0:
+common-tags@^1.8.0:
   version "1.8.0"
   resolved "https://registry.yarnpkg.com/common-tags/-/common-tags-1.8.0.tgz#8e3153e542d4a39e9b10554434afaaf98956a937"
   integrity sha512-6P6g0uetGpW/sdyUy/iQQCbFF0kWVMSIVSyYz7Zgjcgh8mgw8PQzDNZeyZ5DQ2gM7LBoZPHmnjz8rUthkBG5tw==
@@ -10169,14 +9866,6 @@ console-log-level@^1.4.1:
   resolved "https://registry.yarnpkg.com/console-log-level/-/console-log-level-1.4.1.tgz#9c5a6bb9ef1ef65b05aba83028b0ff894cdf630a"
   integrity sha512-VZzbIORbP+PPcN/gg3DXClTLPLg5Slwd5fL2MIc+o1qZ4BXBvWyc6QxPk6T/Mkr6IVjRpoAGf32XxP3ZWMVRcQ==
 
-constant-case@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/constant-case/-/constant-case-2.0.0.tgz#4175764d389d3fa9c8ecd29186ed6005243b6a46"
-  integrity sha1-QXV2TTidP6nI7NKRhu1gBSQ7akY=
-  dependencies:
-    snake-case "^2.1.0"
-    upper-case "^1.1.1"
-
 constants-browserify@^1.0.0, constants-browserify@~1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/constants-browserify/-/constants-browserify-1.0.0.tgz#c20b96d8c617748aaf1c16021760cd27fcb8cb75"
@@ -10323,7 +10012,7 @@ core-js@^1.0.0:
   resolved "https://registry.yarnpkg.com/core-js/-/core-js-1.2.7.tgz#652294c14651db28fa93bd2d5ff2983a4f08c636"
   integrity sha1-ZSKUwUZR2yj6k70tX/KYOk8IxjY=
 
-core-js@^2.4.0, core-js@^2.5.0, core-js@^2.5.3, core-js@^2.6.9:
+core-js@^2.4.0, core-js@^2.5.0, core-js@^2.6.9:
   version "2.6.9"
   resolved "https://registry.yarnpkg.com/core-js/-/core-js-2.6.9.tgz#6b4b214620c834152e179323727fc19741b084f2"
   integrity sha512-HOpZf6eXmnl7la+cUdMnLvUxKNqLUzJvgIziQ0DiF3JwSImNphIqdGqzj6hIKyX04MmV0poclQ7+wjWvxQyR2A==
@@ -10513,14 +10202,6 @@ cross-env@^6.0.3:
   dependencies:
     cross-spawn "^7.0.0"
 
-cross-fetch@2.2.2:
-  version "2.2.2"
-  resolved "https://registry.yarnpkg.com/cross-fetch/-/cross-fetch-2.2.2.tgz#a47ff4f7fc712daba8f6a695a11c948440d45723"
-  integrity sha1-pH/09/xxLauo9qaVoRyUhEDUVyM=
-  dependencies:
-    node-fetch "2.1.2"
-    whatwg-fetch "2.0.4"
-
 cross-spawn@7.0.3, cross-spawn@^7.0.0, cross-spawn@^7.0.2:
   version "7.0.3"
   resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz#f73a85b9d5d41d045551c177e2882d4ac85728a6"
@@ -11768,11 +11449,6 @@ dependency-check@^4.1.0:
     read-package-json "^2.0.10"
     resolve "^1.1.7"
 
-deprecated-decorator@^0.1.6:
-  version "0.1.6"
-  resolved "https://registry.yarnpkg.com/deprecated-decorator/-/deprecated-decorator-0.1.6.tgz#00966317b7a12fe92f3cc831f7583af329b86c37"
-  integrity sha1-AJZjF7ehL+kvPMgx91g68ym4bDc=
-
 deprecation@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/deprecation/-/deprecation-1.0.1.tgz#2df79b79005752180816b7b6e079cbd80490d711"
@@ -11818,11 +11494,6 @@ detect-file@^1.0.0:
   resolved "https://registry.yarnpkg.com/detect-file/-/detect-file-1.0.0.tgz#f0d66d03672a825cb1b73bdb3fe62310c8e552b7"
   integrity sha1-8NZtA2cqglyxtzvbP+YjEMjlUrc=
 
-detect-indent@5.0.0, detect-indent@^5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/detect-indent/-/detect-indent-5.0.0.tgz#3871cc0a6a002e8c3e5b3cf7f336264675f06b9d"
-  integrity sha1-OHHMCmoALow+Wzz38zYmRnXwa50=
-
 detect-indent@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/detect-indent/-/detect-indent-4.0.0.tgz#f76d064352cdf43a1cb6ce619c4ee3a9475de208"
@@ -11830,6 +11501,11 @@ detect-indent@^4.0.0:
   dependencies:
     repeating "^2.0.0"
 
+detect-indent@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/detect-indent/-/detect-indent-5.0.0.tgz#3871cc0a6a002e8c3e5b3cf7f336264675f06b9d"
+  integrity sha1-OHHMCmoALow+Wzz38zYmRnXwa50=
+
 detect-newline@2.X:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/detect-newline/-/detect-newline-2.1.0.tgz#f41f1c10be4b00e87b5f13da680759f2c5bfd3e2"
@@ -11898,15 +11574,6 @@ diacritics@^1.3.0:
   resolved "https://registry.yarnpkg.com/diacritics/-/diacritics-1.3.0.tgz#3efa87323ebb863e6696cebb0082d48ff3d6f7a1"
   integrity sha1-PvqHMj67hj5mls67AILUj/PW96E=
 
-diagnostics@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/diagnostics/-/diagnostics-1.1.1.tgz#cab6ac33df70c9d9a727490ae43ac995a769b22a"
-  integrity sha512-8wn1PmdunLJ9Tqbx+Fx/ZEuHfJf4NKSN2ZBj7SJC/OWRWha843+WsTjqMe1B5E3p28jqBlp+mJ2fPVxPyNgYKQ==
-  dependencies:
-    colorspace "1.1.x"
-    enabled "1.0.x"
-    kuler "1.0.x"
-
 diff-match-patch@^1.0.0, diff-match-patch@^1.0.4:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/diff-match-patch/-/diff-match-patch-1.0.5.tgz#abb584d5f10cd1196dfc55aa03701592ae3f7b37"
@@ -12121,13 +11788,6 @@ domutils@^1.5.1, domutils@^1.7.0:
     dom-serializer "0"
     domelementtype "1"
 
-dot-case@^2.1.0:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/dot-case/-/dot-case-2.1.1.tgz#34dcf37f50a8e93c2b3bca8bb7fb9155c7da3bee"
-  integrity sha1-NNzzf1Co6TwrO8qLt/uRVcfaO+4=
-  dependencies:
-    no-case "^2.2.0"
-
 dot-case@^3.0.3:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/dot-case/-/dot-case-3.0.3.tgz#21d3b52efaaba2ea5fda875bb1aa8124521cf4aa"
@@ -12478,13 +12138,6 @@ emotion@^9.1.2:
     babel-plugin-emotion "^9.2.11"
     create-emotion "^9.2.12"
 
-enabled@1.0.x:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/enabled/-/enabled-1.0.2.tgz#965f6513d2c2d1c5f4652b64a2e3396467fc2f93"
-  integrity sha1-ll9lE9LC0cX0ZStkouM5ZGf8L5M=
-  dependencies:
-    env-variable "0.0.x"
-
 enabled@2.0.x:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/enabled/-/enabled-2.0.0.tgz#f9dd92ec2d6f4bbc0d5d1e64e21d61cd4665e7c2"
@@ -12544,11 +12197,6 @@ env-paths@^2.2.0:
   resolved "https://registry.yarnpkg.com/env-paths/-/env-paths-2.2.0.tgz#cdca557dc009152917d6166e2febe1f039685e43"
   integrity sha512-6u0VYSCo/OW6IoD5WCLLy9JUGARbamfSavcNXry/eu8aHVFei6CD3Sw+VGX5alea1i9pgPHW0mbu6Xj0uBh7gA==
 
-env-variable@0.0.x:
-  version "0.0.5"
-  resolved "https://registry.yarnpkg.com/env-variable/-/env-variable-0.0.5.tgz#913dd830bef11e96a039c038d4130604eba37f88"
-  integrity sha512-zoB603vQReOFvTg5xMl9I1P2PnHsHQQKTEowsKKD7nseUfJq6UWzK+4YtlWUO1nhiQUxe6XMkk+JleSZD1NZFA==
-
 enzyme-adapter-react-16@^1.15.2:
   version "1.15.2"
   resolved "https://registry.yarnpkg.com/enzyme-adapter-react-16/-/enzyme-adapter-react-16-1.15.2.tgz#b16db2f0ea424d58a808f9df86ab6212895a4501"
@@ -13722,7 +13370,7 @@ fb-watchman@^2.0.0:
   dependencies:
     bser "^2.0.0"
 
-fbjs@^0.8.1, fbjs@^0.8.16, fbjs@^0.8.9:
+fbjs@^0.8.1, fbjs@^0.8.9:
   version "0.8.17"
   resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-0.8.17.tgz#c4d598ead6949112653d6588b01a5cdcd9f90fdd"
   integrity sha1-xNWY6taUkRJlPWWIsBpc3Nn5D90=
@@ -14721,18 +14369,6 @@ glob-watcher@5.0.3, glob-watcher@^5.0.3:
     just-debounce "^1.0.0"
     object.defaults "^1.1.0"
 
-glob@7.1.3:
-  version "7.1.3"
-  resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.3.tgz#3960832d3f1574108342dafd3a67b332c0969df1"
-  integrity sha512-vcfuiIxogLV4DlGBHIUOwI0IbrJ8HWPc4MU7HzviGeNho/UJDfi6B5p3sHeWIQ0KGIU0Jpxi5ZHxemQfLkkAwQ==
-  dependencies:
-    fs.realpath "^1.0.0"
-    inflight "^1.0.4"
-    inherits "2"
-    minimatch "^3.0.4"
-    once "^1.3.0"
-    path-is-absolute "^1.0.0"
-
 glob@7.1.4:
   version "7.1.4"
   resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.4.tgz#aa608a2f6c577ad357e1ae5a5c26d9a8d1969255"
@@ -15048,219 +14684,11 @@ graphlib@^2.1.8:
   dependencies:
     lodash "^4.17.15"
 
-graphql-anywhere@^4.1.0-alpha.0:
-  version "4.1.16"
-  resolved "https://registry.yarnpkg.com/graphql-anywhere/-/graphql-anywhere-4.1.16.tgz#82bb59643e30183cfb7b485ed4262a7b39d8a6c1"
-  integrity sha512-DNQGxrh2p8w4vQwHIW1Sw65ZDbOr6ktQCeol6itH3LeWy1a3IoZ67jxrhgrHM+Upg8oiazvteSr64VRxJ8n5+g==
-  dependencies:
-    apollo-utilities "^1.0.18"
-
-graphql-code-generator@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-code-generator/-/graphql-code-generator-0.18.2.tgz#080d91f8b44d26d7c69069118ac9f775f3fd5971"
-  integrity sha512-9ifA5T6hM6qo3RVQz7oYld1R6XYyglT/TanYDoweVEX+6iLxgi0rvGFjFcQ45bPDgLyVkQ9LEsEJuL1YxFmrDw==
-  dependencies:
-    "@types/babylon" "6.16.5"
-    "@types/is-glob" "4.0.0"
-    "@types/prettier" "1.16.1"
-    "@types/valid-url" "1.0.2"
-    babel-types "7.0.0-beta.3"
-    babylon "7.0.0-beta.47"
-    chalk "2.4.2"
-    change-case "3.1.0"
-    chokidar "2.1.2"
-    commander "2.19.0"
-    common-tags "1.8.0"
-    detect-indent "5.0.0"
-    glob "7.1.3"
-    graphql-codegen-core "0.18.2"
-    graphql-config "2.2.1"
-    graphql-import "0.7.1"
-    graphql-tag-pluck "0.6.0"
-    graphql-toolkit "0.2.0"
-    graphql-tools "4.0.4"
-    indent-string "3.2.0"
-    inquirer "6.2.2"
-    is-glob "4.0.0"
-    is-valid-path "0.1.1"
-    js-yaml "3.13.1"
-    json-to-pretty-yaml "1.2.2"
-    listr "0.14.3"
-    listr-update-renderer "0.5.0"
-    log-symbols "2.2.0"
-    log-update "2.3.0"
-    mkdirp "0.5.1"
-    prettier "1.16.4"
-    request "2.88.0"
-    valid-url "1.0.9"
-
-graphql-codegen-add@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-add/-/graphql-codegen-add-0.18.2.tgz#27625f6b6bcfe29076b5f8b02496425eeb360b46"
-  integrity sha512-X8i3WEjfI2YYS6giE3BZ0LlOlTnae2btuyjU1TAN7Cec+dOI5XzRz25cPRi6D1Y0++j2h480e60tgXwMORW9pA==
-  dependencies:
-    graphql-codegen-core "0.18.2"
-
-graphql-codegen-core@0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-core/-/graphql-codegen-core-0.18.2.tgz#205b25d2bdb20a35b986495b60d219a8d02ef266"
-  integrity sha512-fjfIUrDx0KDdr/jYjUs51+07DvcEc5w9tdid/bNezNzT2iJLtmnnmYLR62an3/PKUnKSOAIKLYxFIBOzsFJH9A==
-  dependencies:
-    chalk "2.4.2"
-    change-case "3.1.0"
-    common-tags "1.8.0"
-    graphql-tag "2.10.1"
-    graphql-toolkit "0.2.0"
-    graphql-tools "4.0.4"
-    ts-log "2.1.4"
-    winston "3.2.1"
-
-graphql-codegen-introspection@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-introspection/-/graphql-codegen-introspection-0.18.2.tgz#1e749e342aebe219271dcf4c5c56357ad300921a"
-  integrity sha512-L71rDI9gFQdcGNHsOnlW8nOtUXsZCFnXvC+faEwNse4P/OGrRm4jLQU/6/EUk92okFCbLytKWNcq1uxD8fiY1Q==
-
-graphql-codegen-plugin-helpers@0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-plugin-helpers/-/graphql-codegen-plugin-helpers-0.18.2.tgz#ce03d02ced0bc28ef2f61e0a5205d85ee7e9ccdb"
-  integrity sha512-WZahfp95RdePwwPWxnxAHgfkXXEQXNrgX9sGrB//uGfj8lygcf7m/rNZQ4iooUzoqBEkTtJpi7bezWCieNcq2A==
-  dependencies:
-    graphql-codegen-core "0.18.2"
-    import-from "2.1.0"
-
-graphql-codegen-typescript-client@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-typescript-client/-/graphql-codegen-typescript-client-0.18.2.tgz#5478f8af83fac8063362fe2905dac20fe02d5548"
-  integrity sha512-HffKYPrT5jGIRTiWCTst/X3EBpuOHsheI5tKUEf9NfrR8ySWs6PfqZO5fKCFWZOqC9xn7Y75jFXaeH8tgV5y1g==
-  dependencies:
-    graphql-codegen-core "0.18.2"
-    graphql-codegen-plugin-helpers "0.18.2"
-    graphql-codegen-typescript-common "0.18.2"
-
-graphql-codegen-typescript-common@0.18.2, graphql-codegen-typescript-common@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-typescript-common/-/graphql-codegen-typescript-common-0.18.2.tgz#1ccbb3bfa1aeb8664127f881db27c658636465da"
-  integrity sha512-uGGHd/vgwMlnCNOMQkvMxW8Xz0fqPGjPHROsniRNP1ragsa6KfFBrGu9toHgxv8m3MzC6ZPeoUa3wtwtS9oVnA==
-  dependencies:
-    change-case "3.1.0"
-    common-tags "1.8.0"
-    graphql-codegen-core "0.18.2"
-    graphql-codegen-plugin-helpers "0.18.2"
-
-graphql-codegen-typescript-resolvers@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-typescript-resolvers/-/graphql-codegen-typescript-resolvers-0.18.2.tgz#fa44b2668285184d2976116c2982c17bc6866a23"
-  integrity sha512-BlS286ap2hsOjx2a7H6WKcwxfQtjRay9d+P/0u4t6zUkjpFSpHWWYgymVopfckrjHCo/8g+THPFCmUgFg34vKQ==
-  dependencies:
-    graphql-codegen-plugin-helpers "0.18.2"
-    graphql-codegen-typescript-common "0.18.2"
-
-graphql-codegen-typescript-server@^0.18.2:
-  version "0.18.2"
-  resolved "https://registry.yarnpkg.com/graphql-codegen-typescript-server/-/graphql-codegen-typescript-server-0.18.2.tgz#2e11607512bdf77b152c554afc18f5210c1785ba"
-  integrity sha512-1marSv3TCry6IsQd+Hdarq/AhDpgJ3Yg+e9Or3Urv7Fkw4YbhtyGp6AkpBK+DMKlyKFPjpLnmjAaHS3hjrCp3Q==
-  dependencies:
-    graphql-codegen-typescript-common "0.18.2"
-
-graphql-config@2.2.1:
-  version "2.2.1"
-  resolved "https://registry.yarnpkg.com/graphql-config/-/graphql-config-2.2.1.tgz#5fd0ec77ac7428ca5fb2026cf131be10151a0cb2"
-  integrity sha512-U8+1IAhw9m6WkZRRcyj8ZarK96R6lQBQ0an4lp76Ps9FyhOXENC5YQOxOFGm5CxPrX2rD0g3Je4zG5xdNJjwzQ==
-  dependencies:
-    graphql-import "^0.7.1"
-    graphql-request "^1.5.0"
-    js-yaml "^3.10.0"
-    lodash "^4.17.4"
-    minimatch "^3.0.4"
-
-graphql-extensions@^0.0.x, graphql-extensions@~0.0.9:
-  version "0.0.10"
-  resolved "https://registry.yarnpkg.com/graphql-extensions/-/graphql-extensions-0.0.10.tgz#34bdb2546d43f6a5bc89ab23c295ec0466c6843d"
-  integrity sha512-TnQueqUDCYzOSrpQb3q1ngDSP2otJSF+9yNLrQGPzkMsvnQ+v6e2d5tl+B35D4y+XpmvVnAn4T3ZK28mkILveA==
-  dependencies:
-    core-js "^2.5.3"
-    source-map-support "^0.5.1"
-
-graphql-fields@^1.0.2:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/graphql-fields/-/graphql-fields-1.2.1.tgz#3777112af0bd6f55cc3c7b8f6d7748ab7a1b23bb"
-  integrity sha512-ufg/dxb78IjQUblNfiaEMkZWD1CwcZjdK0nTEW0dBQyNArxKZI7N+zohZdIdqVJcihPWJod1yymx4NM+1bZjTw==
-
-graphql-import@0.7.1, graphql-import@^0.7.1:
-  version "0.7.1"
-  resolved "https://registry.yarnpkg.com/graphql-import/-/graphql-import-0.7.1.tgz#4add8d91a5f752d764b0a4a7a461fcd93136f223"
-  integrity sha512-YpwpaPjRUVlw2SN3OPljpWbVRWAhMAyfSba5U47qGMOSsPLi2gYeJtngGpymjm9nk57RFWEpjqwh4+dpYuFAPw==
-  dependencies:
-    lodash "^4.17.4"
-    resolve-from "^4.0.0"
-
-graphql-request@^1.5.0:
-  version "1.8.2"
-  resolved "https://registry.yarnpkg.com/graphql-request/-/graphql-request-1.8.2.tgz#398d10ae15c585676741bde3fc01d5ca948f8fbe"
-  integrity sha512-dDX2M+VMsxXFCmUX0Vo0TopIZIX4ggzOtiCsThgtrKR4niiaagsGTDIHj3fsOMFETpa064vzovI+4YV4QnMbcg==
-  dependencies:
-    cross-fetch "2.2.2"
-
-graphql-tag-pluck@0.6.0:
-  version "0.6.0"
-  resolved "https://registry.yarnpkg.com/graphql-tag-pluck/-/graphql-tag-pluck-0.6.0.tgz#d03ab981cd8d31e564d37f8b9bac94a523dc29dd"
-  integrity sha512-C1SRw5zZtl7CN7mv6Q0abFVSJwG8M+FniFCPqWD+AjQMj9igNPthraMUQ02KSo+j19khR60mksqmFN3BwboFaw==
-  dependencies:
-    "@babel/parser" "^7.2.0"
-    "@babel/traverse" "^7.1.6"
-    "@babel/types" "^7.2.0"
-    source-map-support "^0.5.9"
-    typescript "^3.2.2"
-
-graphql-tag@2.10.1:
-  version "2.10.1"
-  resolved "https://registry.yarnpkg.com/graphql-tag/-/graphql-tag-2.10.1.tgz#10aa41f1cd8fae5373eaf11f1f67260a3cad5e02"
-  integrity sha512-jApXqWBzNXQ8jYa/HLkZJaVw9jgwNqZkywa2zfFn16Iv1Zb7ELNHkJaXHR7Quvd5SIGsy6Ny7SUKATgnu05uEg==
-
 graphql-tag@^2.10.3:
   version "2.10.3"
   resolved "https://registry.yarnpkg.com/graphql-tag/-/graphql-tag-2.10.3.tgz#ea1baba5eb8fc6339e4c4cf049dabe522b0edf03"
   integrity sha512-4FOv3ZKfA4WdOKJeHdz6B3F/vxBLSgmBcGeAFPf4n1F64ltJUvOOerNj0rsJxONQGdhUMynQIvd6LzB+1J5oKA==
 
-graphql-toolkit@0.2.0:
-  version "0.2.0"
-  resolved "https://registry.yarnpkg.com/graphql-toolkit/-/graphql-toolkit-0.2.0.tgz#91364b69911d51bc915269a37963f4ea2d5f335c"
-  integrity sha512-dMwb+V2u6vwJF70tWuqSxgNal9fK1xcB8JtmCJUStVUh+PjfNrlKH1X5e17vJlN+lRPz1hatr8jH+Q6lTW0jLw==
-  dependencies:
-    aggregate-error "2.1.0"
-    deepmerge "3.2.0"
-    glob "7.1.3"
-    graphql-import "0.7.1"
-    graphql-tag-pluck "0.6.0"
-    is-glob "4.0.0"
-    is-valid-path "0.1.1"
-    lodash "4.17.11"
-    request "2.88.0"
-    tslib "^1.9.3"
-    valid-url "1.0.9"
-
-graphql-tools@4.0.4:
-  version "4.0.4"
-  resolved "https://registry.yarnpkg.com/graphql-tools/-/graphql-tools-4.0.4.tgz#ca08a63454221fdde825fe45fbd315eb2a6d566b"
-  integrity sha512-chF12etTIGVVGy3fCTJ1ivJX2KB7OSG4c6UOJQuqOHCmBQwTyNgCDuejZKvpYxNZiEx7bwIjrodDgDe9RIkjlw==
-  dependencies:
-    apollo-link "^1.2.3"
-    apollo-utilities "^1.0.1"
-    deprecated-decorator "^0.1.6"
-    iterall "^1.1.3"
-    uuid "^3.1.0"
-
-graphql-tools@^3.0.2:
-  version "3.1.1"
-  resolved "https://registry.yarnpkg.com/graphql-tools/-/graphql-tools-3.1.1.tgz#d593358f01e7c8b1671a17b70ddb034dea9dbc50"
-  integrity sha512-yHvPkweUB0+Q/GWH5wIG60bpt8CTwBklCSzQdEHmRUgAdEQKxw+9B7zB3dG7wB3Ym7M7lfrS4Ej+jtDZfA2UXg==
-  dependencies:
-    apollo-link "^1.2.2"
-    apollo-utilities "^1.0.1"
-    deprecated-decorator "^0.1.6"
-    iterall "^1.1.3"
-    uuid "^3.1.0"
-
 graphql@^0.13.2:
   version "0.13.2"
   resolved "https://registry.yarnpkg.com/graphql/-/graphql-0.13.2.tgz#4c740ae3c222823e7004096f832e7b93b2108270"
@@ -15752,14 +15180,6 @@ he@1.2.0, he@1.2.x, he@^1.2.0:
   resolved "https://registry.yarnpkg.com/he/-/he-1.2.0.tgz#84ae65fa7eafb165fddb61566ae14baf05664f0f"
   integrity sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==
 
-header-case@^1.0.0:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/header-case/-/header-case-1.0.1.tgz#9535973197c144b09613cd65d317ef19963bd02d"
-  integrity sha1-lTWXMZfBRLCWE81l0xfvGZY70C0=
-  dependencies:
-    no-case "^2.2.0"
-    upper-case "^1.1.3"
-
 heap@^0.2.6:
   version "0.2.6"
   resolved "https://registry.yarnpkg.com/heap/-/heap-0.2.6.tgz#087e1f10b046932fc8594dd9e6d378afc9d1e5ac"
@@ -15821,7 +15241,7 @@ hoek@6.x.x:
   resolved "https://registry.yarnpkg.com/hoek/-/hoek-6.0.3.tgz#7884360426d927865a0a1251fc9c59313af5b798"
   integrity sha512-TU6RyZ/XaQCTWRLrdqZZtZqwxUVr6PDMfi6MlWNURZ7A6czanQqX4pFE1mdOUQR9FdPCsZ0UzL8jI/izZ+eBSQ==
 
-hoist-non-react-statics@^2.3.1, hoist-non-react-statics@^2.5.0, hoist-non-react-statics@^2.5.5, hoist-non-react-statics@^3.0.0, hoist-non-react-statics@^3.1.0, hoist-non-react-statics@^3.3.0, hoist-non-react-statics@^3.3.2:
+hoist-non-react-statics@^2.3.1, hoist-non-react-statics@^2.5.5, hoist-non-react-statics@^3.0.0, hoist-non-react-statics@^3.1.0, hoist-non-react-statics@^3.3.0, hoist-non-react-statics@^3.3.2:
   version "3.3.2"
   resolved "https://registry.yarnpkg.com/hoist-non-react-statics/-/hoist-non-react-statics-3.3.2.tgz#ece0acaf71d62c2969c2ec59feff42a4b1a85b45"
   integrity sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==
@@ -16275,7 +15695,7 @@ import-fresh@^3.0.0, import-fresh@^3.1.0, import-fresh@^3.2.1:
     parent-module "^1.0.0"
     resolve-from "^4.0.0"
 
-import-from@2.1.0, import-from@^2.1.0:
+import-from@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/import-from/-/import-from-2.1.0.tgz#335db7f2a7affd53aaa471d4b8021dee36b7f3b1"
   integrity sha1-M1238qev/VOqpHHUuAId7ja387E=
@@ -16318,11 +15738,6 @@ in-publish@^2.0.0:
   resolved "https://registry.yarnpkg.com/in-publish/-/in-publish-2.0.0.tgz#e20ff5e3a2afc2690320b6dc552682a9c7fadf51"
   integrity sha1-4g/146KvwmkDILbcVSaCqcf631E=
 
-indent-string@3.2.0, indent-string@^3.0.0, indent-string@^3.1.0, indent-string@^3.2.0:
-  version "3.2.0"
-  resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-3.2.0.tgz#4a5fd6d27cc332f37e5419a504dbb837105c9289"
-  integrity sha1-Sl/W0nzDMvN+VBmlBNu4NxBckok=
-
 indent-string@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-2.1.0.tgz#8e2d48348742121b4a8218b7a137e9a52049dc80"
@@ -16330,6 +15745,11 @@ indent-string@^2.1.0:
   dependencies:
     repeating "^2.0.0"
 
+indent-string@^3.0.0, indent-string@^3.1.0, indent-string@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-3.2.0.tgz#4a5fd6d27cc332f37e5419a504dbb837105c9289"
+  integrity sha1-Sl/W0nzDMvN+VBmlBNu4NxBckok=
+
 indent-string@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-4.0.0.tgz#624f8f4497d619b2d9768531d58f4122854d7251"
@@ -16405,25 +15825,6 @@ inline-style@^2.0.0:
   dependencies:
     dashify "^0.1.0"
 
-inquirer@6.2.2:
-  version "6.2.2"
-  resolved "https://registry.yarnpkg.com/inquirer/-/inquirer-6.2.2.tgz#46941176f65c9eb20804627149b743a218f25406"
-  integrity sha512-Z2rREiXA6cHRR9KBOarR3WuLlFzlIfAEIiB45ll5SSadMg7WqOh1MKEjjndfuH5ewXdixWCxqnVfGOQzPeiztA==
-  dependencies:
-    ansi-escapes "^3.2.0"
-    chalk "^2.4.2"
-    cli-cursor "^2.1.0"
-    cli-width "^2.0.0"
-    external-editor "^3.0.3"
-    figures "^2.0.0"
-    lodash "^4.17.11"
-    mute-stream "0.0.7"
-    run-async "^2.2.0"
-    rxjs "^6.4.0"
-    string-width "^2.1.0"
-    strip-ansi "^5.0.0"
-    through "^2.3.6"
-
 inquirer@^7.0.0, inquirer@^7.3.3:
   version "7.3.3"
   resolved "https://registry.yarnpkg.com/inquirer/-/inquirer-7.3.3.tgz#04d176b2af04afc157a83fd7c100e98ee0aad003"
@@ -16828,13 +16229,6 @@ is-generator@^1.0.2:
   resolved "https://registry.yarnpkg.com/is-generator/-/is-generator-1.0.3.tgz#c14c21057ed36e328db80347966c693f886389f3"
   integrity sha1-wUwhBX7TbjKNuANHlmxpP4hjifM=
 
-is-glob@4.0.0:
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/is-glob/-/is-glob-4.0.0.tgz#9521c76845cc2610a85203ddf080a958c2ffabc0"
-  integrity sha1-lSHHaEXMJhCoUgPd8ICpWML/q8A=
-  dependencies:
-    is-extglob "^2.1.1"
-
 is-glob@^2.0.0:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/is-glob/-/is-glob-2.0.1.tgz#d096f926a3ded5600f3fdfd91198cb0888c2d863"
@@ -16881,20 +16275,6 @@ is-interactive@^1.0.0:
   resolved "https://registry.yarnpkg.com/is-interactive/-/is-interactive-1.0.0.tgz#cea6e6ae5c870a7b0a0004070b7b587e0252912e"
   integrity sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==
 
-is-invalid-path@^0.1.0:
-  version "0.1.0"
-  resolved "https://registry.yarnpkg.com/is-invalid-path/-/is-invalid-path-0.1.0.tgz#307a855b3cf1a938b44ea70d2c61106053714f34"
-  integrity sha1-MHqFWzzxqTi0TqcNLGEQYFNxTzQ=
-  dependencies:
-    is-glob "^2.0.0"
-
-is-lower-case@^1.1.0:
-  version "1.1.3"
-  resolved "https://registry.yarnpkg.com/is-lower-case/-/is-lower-case-1.1.3.tgz#7e147be4768dc466db3bfb21cc60b31e6ad69393"
-  integrity sha1-fhR75HaNxGbbO/shzGCzHmrWk5M=
-  dependencies:
-    lower-case "^1.1.0"
-
 is-map@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/is-map/-/is-map-2.0.1.tgz#520dafc4307bb8ebc33b813de5ce7c9400d644a1"
@@ -17142,13 +16522,6 @@ is-unc-path@^1.0.0:
   dependencies:
     unc-path-regex "^0.1.2"
 
-is-upper-case@^1.1.0:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/is-upper-case/-/is-upper-case-1.1.2.tgz#8d0b1fa7e7933a1e58483600ec7d9661cbaf756f"
-  integrity sha1-jQsfp+eTOh5YSDYA7H2WYcuvdW8=
-  dependencies:
-    upper-case "^1.1.0"
-
 is-url@^1.2.2:
   version "1.2.4"
   resolved "https://registry.yarnpkg.com/is-url/-/is-url-1.2.4.tgz#04a4df46d28c4cff3d73d01ff06abeb318a1aa52"
@@ -17164,13 +16537,6 @@ is-valid-glob@^1.0.0:
   resolved "https://registry.yarnpkg.com/is-valid-glob/-/is-valid-glob-1.0.0.tgz#29bf3eff701be2d4d315dbacc39bc39fe8f601aa"
   integrity sha1-Kb8+/3Ab4tTTFdusw5vDn+j2Aao=
 
-is-valid-path@0.1.1:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/is-valid-path/-/is-valid-path-0.1.1.tgz#110f9ff74c37f663e1ec7915eb451f2db93ac9df"
-  integrity sha1-EQ+f90w39mPh7HkV60UfLbk6yd8=
-  dependencies:
-    is-invalid-path "^0.1.0"
-
 is-weakmap@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/is-weakmap/-/is-weakmap-2.0.1.tgz#5008b59bdc43b698201d18f62b37b2ca243e8cf2"
@@ -17383,10 +16749,10 @@ istanbul-reports@^3.0.2:
     html-escaper "^2.0.0"
     istanbul-lib-report "^3.0.0"
 
-iterall@^1.1.3, iterall@^1.2.1:
-  version "1.2.2"
-  resolved "https://registry.yarnpkg.com/iterall/-/iterall-1.2.2.tgz#92d70deb8028e0c39ff3164fdbf4d8b088130cd7"
-  integrity sha512-yynBb1g+RFUPY64fTrFv7nsjRrENBQJaX2UL+2Szc9REFrSNm1rpSXHGzhmAy7a9uv3vlvgBlXnf9RqmPH1/DA==
+iterall@^1.2.1:
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/iterall/-/iterall-1.3.0.tgz#afcb08492e2915cbd8a0884eb93a8c94d0d72fea"
+  integrity sha512-QZ9qOMdF+QLHxy1QIpUHUU1D5pS2CG2P69LF6L6CPjPYA/XMOmKV3PZpawHoAjHNyB0swdVTRxdYT4tbBbxqwg==
 
 iterate-iterator@^1.0.1:
   version "1.0.1"
@@ -18109,7 +17475,7 @@ js-tokens@^4.0.0:
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-yaml@3.13.1, js-yaml@^3.10.0, js-yaml@^3.13.1, js-yaml@^3.9.0, js-yaml@~3.13.1:
+js-yaml@3.13.1, js-yaml@^3.13.1, js-yaml@^3.9.0, js-yaml@~3.13.1:
   version "3.13.1"
   resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.13.1.tgz#aff151b30bfdfa8e49e05da22e7415e9dfa37847"
   integrity sha512-YfbcO7jXDdyj0DGxYVSlSeQNHbD7XPWvrVWeVUujrQEoZzWJIRrCPoyk6kL6IAjAG2IolMK4T0hNUe0HOUs5Jw==
@@ -18268,14 +17634,6 @@ json-stringify-safe@5.0.1, json-stringify-safe@^5.0.1, json-stringify-safe@~5.0.
   resolved "https://registry.yarnpkg.com/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz#1296a2d58fd45f19a0f6ce01d65701e2c735b6eb"
   integrity sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus=
 
-json-to-pretty-yaml@1.2.2:
-  version "1.2.2"
-  resolved "https://registry.yarnpkg.com/json-to-pretty-yaml/-/json-to-pretty-yaml-1.2.2.tgz#f4cd0bd0a5e8fe1df25aaf5ba118b099fd992d5b"
-  integrity sha1-9M0L0KXo/h3yWq9boRiwmf2ZLVs=
-  dependencies:
-    remedial "^1.0.7"
-    remove-trailing-spaces "^1.0.6"
-
 json2module@^0.0.3:
   version "0.0.3"
   resolved "https://registry.yarnpkg.com/json2module/-/json2module-0.0.3.tgz#00fb5f4a9b7adfc3f0647c29cb17bcd1979be9b2"
@@ -18531,13 +17889,6 @@ knuth-shuffle-seeded@^1.0.6:
   dependencies:
     seed-random "~2.2.0"
 
-kuler@1.0.x:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/kuler/-/kuler-1.0.1.tgz#ef7c784f36c9fb6e16dd3150d152677b2b0228a6"
-  integrity sha512-J9nVUucG1p/skKul6DU3PUZrhs0LPulNaeUOox0IyXDi8S4CztTHs1gQphhuZmzXG7VOQSf6NJfKuzteQLv9gQ==
-  dependencies:
-    colornames "^1.1.1"
-
 kuler@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/kuler/-/kuler-2.0.0.tgz#e2c570a3800388fb44407e851531c1d670b061b3"
@@ -18753,7 +18104,7 @@ listr-silent-renderer@^1.1.1:
   resolved "https://registry.yarnpkg.com/listr-silent-renderer/-/listr-silent-renderer-1.1.1.tgz#924b5a3757153770bf1a8e3fbf74b8bbf3f9242e"
   integrity sha1-kktaN1cVN3C/Go4/v3S4u/P5JC4=
 
-listr-update-renderer@0.5.0, listr-update-renderer@^0.5.0:
+listr-update-renderer@^0.5.0:
   version "0.5.0"
   resolved "https://registry.yarnpkg.com/listr-update-renderer/-/listr-update-renderer-0.5.0.tgz#4ea8368548a7b8aecb7e06d8c95cb45ae2ede6a2"
   integrity sha512-tKRsZpKz8GSGqoI/+caPmfrypiaq+OQCbd+CovEC24uk1h952lVj5sC7SqyFUm+OaJ5HN/a1YLt5cit2FMNsFA==
@@ -18777,7 +18128,7 @@ listr-verbose-renderer@^0.5.0:
     date-fns "^1.27.2"
     figures "^2.0.0"
 
-listr@0.14.3, listr@^0.14.1, listr@^0.14.3:
+listr@^0.14.1, listr@^0.14.3:
   version "0.14.3"
   resolved "https://registry.yarnpkg.com/listr/-/listr-0.14.3.tgz#2fea909604e434be464c50bddba0d496928fa586"
   integrity sha512-RmAl7su35BFd/xoMamRjpIE4j3v+L28o8CT5YhAXQJm1fD+1l9ngXY8JAQRJ+tFK2i5njvi0iRUKV09vPwA0iA==
@@ -19178,7 +18529,7 @@ lodash.uniq@4.5.0, lodash.uniq@^4.5.0:
   resolved "https://registry.yarnpkg.com/lodash.uniq/-/lodash.uniq-4.5.0.tgz#d0225373aeb652adc1bc82e4945339a842754773"
   integrity sha1-0CJTc662Uq3BvILklFM5qEJ1R3M=
 
-lodash@4.17.11, lodash@4.17.15, lodash@>4.17.4, lodash@^4.0.0, lodash@^4.0.1, lodash@^4.10.0, lodash@^4.15.0, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.13, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.4, lodash@^4.2.0, lodash@~4.17.10, lodash@~4.17.15, lodash@~4.17.19, lodash@~4.17.20:
+lodash@4.17.15, lodash@>4.17.4, lodash@^4.0.0, lodash@^4.0.1, lodash@^4.10.0, lodash@^4.15.0, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.13, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.4, lodash@~4.17.10, lodash@~4.17.15, lodash@~4.17.19, lodash@~4.17.20:
   version "4.17.21"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
   integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
@@ -19191,13 +18542,6 @@ log-ok@^0.1.1:
     ansi-green "^0.1.1"
     success-symbol "^0.1.0"
 
-log-symbols@2.2.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-2.2.0.tgz#5740e1c5d6f0dfda4ad9323b5332107ef6b4c40a"
-  integrity sha512-VeIAFslyIerEJLXHziedo2basKbMKtTw3vfn5IzG0XTjhAVEJyNHnL2p7vc+wBDSdQuUpNw3M2u6xb9QsAY5Eg==
-  dependencies:
-    chalk "^2.0.1"
-
 log-symbols@4.0.0, log-symbols@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-4.0.0.tgz#69b3cc46d20f448eccdb75ea1fa733d9e821c920"
@@ -19219,7 +18563,7 @@ log-symbols@^3.0.0:
   dependencies:
     chalk "^2.4.2"
 
-log-update@2.3.0, log-update@^2.3.0:
+log-update@^2.3.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/log-update/-/log-update-2.3.0.tgz#88328fd7d1ce7938b29283746f0b1bc126b24708"
   integrity sha1-iDKP19HOeTiykoN0bwsbwSayRwg=
@@ -19228,7 +18572,7 @@ log-update@2.3.0, log-update@^2.3.0:
     cli-cursor "^2.0.0"
     wrap-ansi "^3.0.1"
 
-logform@^2.1.1, logform@^2.2.0:
+logform@^2.2.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/logform/-/logform-2.2.0.tgz#40f036d19161fc76b68ab50fdc7fe495544492f2"
   integrity sha512-N0qPlqfypFx7UHNn4B3lzS/b0uLqt2hmuoa+PpuXNYgozdJYAyauF5Ky0BWVjrxDlMWiT3qN4zPq3vVAfZy7Yg==
@@ -19286,14 +18630,7 @@ loud-rejection@^1.0.0:
     currently-unhandled "^0.4.1"
     signal-exit "^3.0.0"
 
-lower-case-first@^1.0.0:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/lower-case-first/-/lower-case-first-1.0.2.tgz#e5da7c26f29a7073be02d52bac9980e5922adfa1"
-  integrity sha1-5dp8JvKacHO+AtUrrJmA5ZIq36E=
-  dependencies:
-    lower-case "^1.1.2"
-
-lower-case@^1.1.0, lower-case@^1.1.1, lower-case@^1.1.2:
+lower-case@^1.1.1:
   version "1.1.4"
   resolved "https://registry.yarnpkg.com/lower-case/-/lower-case-1.1.4.tgz#9a2cabd1b9e8e0ae993a4bf7d5875c39c42e8eac"
   integrity sha1-miyr0bno4K6ZOkv31YdcOcQujqw=
@@ -20383,11 +19720,6 @@ mute-stdout@^1.0.0:
   resolved "https://registry.yarnpkg.com/mute-stdout/-/mute-stdout-1.0.1.tgz#acb0300eb4de23a7ddeec014e3e96044b3472331"
   integrity sha512-kDcwXR4PS7caBpuRYYBUz9iVixUk3anO3f5OYFiIPwK/20vCzKCHyKoulbiDY1S53zD2bxUpxN/IJ+TnXjfvxg==
 
-mute-stream@0.0.7:
-  version "0.0.7"
-  resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.7.tgz#3075ce93bc21b8fab43e1bc4da7e8115ed1e7bab"
-  integrity sha1-MHXOk7whuPq0PhvE2n6BFe0ee6s=
-
 mute-stream@0.0.8:
   version "0.0.8"
   resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d"
@@ -20577,7 +19909,7 @@ nise@^1.5.2:
     lolex "^5.0.1"
     path-to-regexp "^1.7.0"
 
-no-case@^2.2.0, no-case@^2.3.2:
+no-case@^2.2.0:
   version "2.3.2"
   resolved "https://registry.yarnpkg.com/no-case/-/no-case-2.3.2.tgz#60b813396be39b3f1288a4c1ed5d1e7d28b464ac"
   integrity sha512-rmTZ9kz+f3rCvK2TD1Ue/oZlns7OGoIWP4fc3llxxRXlOkHKoWPPWJOfFYpITabSow43QJbRIoHQXtt10VldyQ==
@@ -20621,7 +19953,7 @@ node-emoji@^1.10.0:
   dependencies:
     lodash.toarray "^4.4.0"
 
-node-fetch@2.1.2, node-fetch@^1.0.1, node-fetch@^2.3.0, node-fetch@^2.6.0, node-fetch@^2.6.1:
+node-fetch@^1.0.1, node-fetch@^2.3.0, node-fetch@^2.6.0, node-fetch@^2.6.1:
   version "2.6.1"
   resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz#045bd323631f76ed2e2b55573394416b639a0052"
   integrity sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==
@@ -21244,11 +20576,6 @@ once@^1.3.0, once@^1.3.1, once@^1.3.2, once@^1.4.0:
   dependencies:
     wrappy "1"
 
-one-time@0.0.4:
-  version "0.0.4"
-  resolved "https://registry.yarnpkg.com/one-time/-/one-time-0.0.4.tgz#f8cdf77884826fe4dff93e3a9cc37b1e4480742e"
-  integrity sha1-+M33eISCb+Tf+T46nMN7HkSAdC4=
-
 one-time@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/one-time/-/one-time-1.0.0.tgz#e06bc174aed214ed58edede573b433bbf827cb45"
@@ -21307,13 +20634,6 @@ oppsy@^2.0.0:
   dependencies:
     hoek "5.x.x"
 
-optimism@^0.9.0:
-  version "0.9.5"
-  resolved "https://registry.yarnpkg.com/optimism/-/optimism-0.9.5.tgz#b8b5dc9150e97b79ddbf2d2c6c0e44de4d255527"
-  integrity sha512-lNvmuBgONAGrUbj/xpH69FjMOz1d0jvMNoOCKyVynUPzq2jgVlGL4jFYJqrUHzUfBv+jAFSCP61x5UkfbduYJA==
-  dependencies:
-    "@wry/context" "^0.4.0"
-
 optional-js@^2.0.0:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/optional-js/-/optional-js-2.1.1.tgz#c2dc519ad119648510b4d241dbb60b1167c36a46"
@@ -21645,7 +20965,7 @@ parallel-transform@^1.1.0:
     inherits "^2.0.3"
     readable-stream "^2.1.5"
 
-param-case@2.1.x, param-case@^2.1.0:
+param-case@2.1.x:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/param-case/-/param-case-2.1.1.tgz#df94fd8cf6531ecf75e6bef9a0858fbc72be2247"
   integrity sha1-35T9jPZTHs915r75oIWPvHK+Ikc=
@@ -21845,14 +21165,6 @@ parseurl@~1.3.2, parseurl@~1.3.3:
   resolved "https://registry.yarnpkg.com/parseurl/-/parseurl-1.3.3.tgz#9da19e7bee8d12dff0513ed5b76957793bc2e8d4"
   integrity sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==
 
-pascal-case@^2.0.0:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/pascal-case/-/pascal-case-2.0.1.tgz#2d578d3455f660da65eca18ef95b4e0de912761e"
-  integrity sha1-LVeNNFX2YNpl7KGO+VtODekSdh4=
-  dependencies:
-    camel-case "^3.0.0"
-    upper-case-first "^1.1.0"
-
 pascal-case@^3.1.1:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/pascal-case/-/pascal-case-3.1.1.tgz#5ac1975133ed619281e88920973d2cd1f279de5f"
@@ -21879,13 +21191,6 @@ path-browserify@0.0.1, path-browserify@~0.0.0:
   resolved "https://registry.yarnpkg.com/path-browserify/-/path-browserify-0.0.1.tgz#e6c4ddd7ed3aa27c68a20cc4e50e1a4ee83bbc4a"
   integrity sha512-BapA40NHICOS+USX9SN4tyhq+A2RrN/Ws5F0Z5aMHDp98Fl86lX8Oti8B7uN93L4Ifv4fHOEA+pQw87gmMO/lQ==
 
-path-case@^2.1.0:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/path-case/-/path-case-2.1.1.tgz#94b8037c372d3fe2906e465bb45e25d226e8eea5"
-  integrity sha1-lLgDfDctP+KQbkZbtF4l0ibo7qU=
-  dependencies:
-    no-case "^2.2.0"
-
 path-dirname@^1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/path-dirname/-/path-dirname-1.0.2.tgz#cc33d24d525e099a5388c0336c6e32b9160609e0"
@@ -22707,11 +22012,6 @@ prettier-linter-helpers@^1.0.0:
   dependencies:
     fast-diff "^1.1.2"
 
-prettier@1.16.4:
-  version "1.16.4"
-  resolved "https://registry.yarnpkg.com/prettier/-/prettier-1.16.4.tgz#73e37e73e018ad2db9c76742e2647e21790c9717"
-  integrity sha512-ZzWuos7TI5CKUeQAtFd6Zhm2s6EpAD/ZLApIhsF9pRvRtM1RFo61dM/4MSRUA0SuLugA/zgrZD8m0BaY46Og7g==
-
 prettier@^2.2.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/prettier/-/prettier-2.2.0.tgz#8a03c7777883b29b37fb2c4348c66a78e980418b"
@@ -23350,17 +22650,6 @@ react-ace@^7.0.5:
     lodash.isequal "^4.5.0"
     prop-types "^15.7.2"
 
-react-apollo@^2.1.4:
-  version "2.1.8"
-  resolved "https://registry.yarnpkg.com/react-apollo/-/react-apollo-2.1.8.tgz#ebac0d9bee0f0906df3ce29207f94df337009887"
-  integrity sha512-HBz9WDhvaqNxahKvBvW915a9MYSbarJ2Nrwh2pCeDctFiZ/bhixX1xJE/Ea0aU6gU5tGDEl+aWjxzx852FXHoA==
-  dependencies:
-    fbjs "^0.8.16"
-    hoist-non-react-statics "^2.5.0"
-    invariant "^2.2.2"
-    lodash "^4.17.10"
-    prop-types "^15.6.0"
-
 react-beautiful-dnd@^13.0.0:
   version "13.0.0"
   resolved "https://registry.yarnpkg.com/react-beautiful-dnd/-/react-beautiful-dnd-13.0.0.tgz#f70cc8ff82b84bc718f8af157c9f95757a6c3b40"
@@ -23724,10 +23013,10 @@ react-popper@^2.2.4:
     react-fast-compare "^3.0.1"
     warning "^4.0.2"
 
-react-query@^3.12.0:
-  version "3.12.0"
-  resolved "https://registry.yarnpkg.com/react-query/-/react-query-3.12.0.tgz#a2082a167f3e394e84dfd3cec0f8c7503abf33dc"
-  integrity sha512-WJYECeZ6xT2oxIlgqXUjLNLWRvJbeelXscVnAFfyUFgO21OYEYHMWPG61V9W57EUUqrXioQsNPsU9XyddfEvXQ==
+react-query@^3.13.10:
+  version "3.13.10"
+  resolved "https://registry.yarnpkg.com/react-query/-/react-query-3.13.10.tgz#b6a05e22a5debb6e2df79ada588179771cbd7df8"
+  integrity sha512-wFvKhEDnOVL5bFL+9KPgNsiOOei1Ad+l6l1awCBuoX7xMG+SXXKDOF2uuZFsJe0w6gdthdWN+00021yepTR31g==
   dependencies:
     "@babel/runtime" "^7.5.5"
     broadcast-channel "^3.4.1"
@@ -24697,11 +23986,6 @@ remark@^13.0.0:
     remark-stringify "^9.0.0"
     unified "^9.1.0"
 
-remedial@^1.0.7:
-  version "1.0.8"
-  resolved "https://registry.yarnpkg.com/remedial/-/remedial-1.0.8.tgz#a5e4fd52a0e4956adbaf62da63a5a46a78c578a0"
-  integrity sha512-/62tYiOe6DzS5BqVsNpH/nkGlX45C/Sp6V+NtiN6JQNS1Viay7cWkazmRkrQrdFj2eshDe96SIQNIoMxqhzBOg==
-
 remove-accents@0.4.2:
   version "0.4.2"
   resolved "https://registry.yarnpkg.com/remove-accents/-/remove-accents-0.4.2.tgz#0a43d3aaae1e80db919e07ae254b285d9e1c7bb5"
@@ -24729,11 +24013,6 @@ remove-trailing-separator@^1.0.1, remove-trailing-separator@^1.1.0:
   resolved "https://registry.yarnpkg.com/remove-trailing-separator/-/remove-trailing-separator-1.1.0.tgz#c24bce2a283adad5bc3f58e0d48249b92379d8ef"
   integrity sha1-wkvOKig62tW8P1jg1IJJuSN52O8=
 
-remove-trailing-spaces@^1.0.6:
-  version "1.0.7"
-  resolved "https://registry.yarnpkg.com/remove-trailing-spaces/-/remove-trailing-spaces-1.0.7.tgz#491f04e11d98880714d12429b0d0938cbe030ae6"
-  integrity sha512-wjM17CJ2kk0SgoGyJ7ZMzRRCuTq+V8YhMwpZ5XEWX0uaked2OUq6utvHXGNBQrfkUzUUABFMyxlKn+85hMv4dg==
-
 renderkid@^2.0.1:
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/renderkid/-/renderkid-2.0.2.tgz#12d310f255360c07ad8fde253f6c9e9de372d2aa"
@@ -24823,7 +24102,7 @@ request-promise@^4.2.2:
     stealthy-require "^1.1.1"
     tough-cookie "^2.3.3"
 
-request@2.81.0, request@2.88.0, request@^2.44.0, request@^2.87.0, request@^2.88.0, request@^2.88.2:
+request@2.81.0, request@^2.44.0, request@^2.87.0, request@^2.88.0, request@^2.88.2:
   version "2.88.2"
   resolved "https://registry.yarnpkg.com/request/-/request-2.88.2.tgz#d73c918731cb5a87da047e207234146f664d12b3"
   integrity sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==
@@ -25181,7 +24460,7 @@ rtl-css-js@^1.9.0:
   dependencies:
     "@babel/runtime" "^7.1.2"
 
-run-async@^2.2.0, run-async@^2.4.0:
+run-async@^2.4.0:
   version "2.4.0"
   resolved "https://registry.yarnpkg.com/run-async/-/run-async-2.4.0.tgz#e59054a5b86876cfae07f431d18cbaddc594f1e8"
   integrity sha512-xJTbh/d7Lm7SBhc1tNvTpeCHaEzoyxPrqNlvSdMfBTYwaY++UJFyXUOxAtsRUXjlqOfj8luNaR9vjCh4KeV+pg==
@@ -25517,14 +24796,6 @@ send@0.17.1:
     range-parser "~1.2.1"
     statuses "~1.5.0"
 
-sentence-case@^2.1.0:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/sentence-case/-/sentence-case-2.1.1.tgz#1f6e2dda39c168bf92d13f86d4a918933f667ed4"
-  integrity sha1-H24t2jnBaL+S0T+G1KkYkz9mftQ=
-  dependencies:
-    no-case "^2.2.0"
-    upper-case-first "^1.1.2"
-
 serialize-error@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/serialize-error/-/serialize-error-2.1.0.tgz#50b679d5635cdf84667bdc8e59af4e5b81d5f60a"
@@ -25833,13 +25104,6 @@ slide@^1.1.5, slide@~1.1.3:
   resolved "https://registry.yarnpkg.com/slide/-/slide-1.1.6.tgz#56eb027d65b4d2dce6cb2e2d32c4d4afc9e1d707"
   integrity sha1-VusCfWW00tzmyy4tMsTUr8nh1wc=
 
-snake-case@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/snake-case/-/snake-case-2.1.0.tgz#41bdb1b73f30ec66a04d4e2cad1b76387d4d6d9f"
-  integrity sha1-Qb2xtz8w7GagTU4srRt2OH1NbZ8=
-  dependencies:
-    no-case "^2.2.0"
-
 snap-shot-compare@2.8.3:
   version "2.8.3"
   resolved "https://registry.yarnpkg.com/snap-shot-compare/-/snap-shot-compare-2.8.3.tgz#b4982fb7b4e9cd4fa0b03a40a100b5f005b2d515"
@@ -25975,7 +25239,7 @@ source-map-support@^0.3.2:
   dependencies:
     source-map "0.1.32"
 
-source-map-support@^0.5.1, source-map-support@^0.5.16, source-map-support@^0.5.19, source-map-support@^0.5.6, source-map-support@^0.5.9, source-map-support@~0.5.12:
+source-map-support@^0.5.16, source-map-support@^0.5.19, source-map-support@^0.5.6, source-map-support@~0.5.12:
   version "0.5.19"
   resolved "https://registry.yarnpkg.com/source-map-support/-/source-map-support-0.5.19.tgz#a98b62f86dcaf4f67399648c085291ab9e8fed61"
   integrity sha512-Wonm7zOCIJzBGQdB+thsPar0kYuCIzYvxZwlBa87yi/Mdjv7Tip2cyVbLj5o0cFPN4EVkuTwb3GDDyUx2DGnGw==
@@ -26515,7 +25779,7 @@ string-width@^1.0.1, string-width@^1.0.2:
     is-fullwidth-code-point "^1.0.0"
     strip-ansi "^3.0.0"
 
-"string-width@^1.0.2 || 2", string-width@^2.0.0, string-width@^2.1.0, string-width@^2.1.1:
+"string-width@^1.0.2 || 2", string-width@^2.0.0, string-width@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-2.1.1.tgz#ab93f27a8dc13d28cac815c462143a6d9012ae9e"
   integrity sha512-nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==
@@ -27039,15 +26303,7 @@ svgo@^1.0.0:
     unquote "~1.1.1"
     util.promisify "~1.0.0"
 
-swap-case@^1.1.0:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/swap-case/-/swap-case-1.1.2.tgz#c39203a4587385fad3c850a0bd1bcafa081974e3"
-  integrity sha1-w5IDpFhzhfrTyFCgvRvK+ggZdOM=
-  dependencies:
-    lower-case "^1.1.1"
-    upper-case "^1.1.1"
-
-symbol-observable@^1.0.2, symbol-observable@^1.0.4, symbol-observable@^1.1.0, symbol-observable@^1.2.0:
+symbol-observable@^1.0.4, symbol-observable@^1.1.0, symbol-observable@^1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/symbol-observable/-/symbol-observable-1.2.0.tgz#c22688aed4eab3cdc2dfeacbb561660560a00804"
   integrity sha512-e900nM8RRtGhlV36KGEU9k65K3mPb1WV70OdjfxlG2EAuM1noi/E/BaW/uMhL7bPEssK8QV57vN3esixjUvcXQ==
@@ -27518,7 +26774,7 @@ tinyqueue@^2.0.3:
   resolved "https://registry.yarnpkg.com/tinyqueue/-/tinyqueue-2.0.3.tgz#64d8492ebf39e7801d7bd34062e29b45b2035f08"
   integrity sha512-ppJZNDuKGgxzkHihX8v9v9G5f+18gzaTfrukGrq6ueg0lmH4nqVnA2IPG0AEH3jKEk2GRJCUhDoqpoiw3PHLBA==
 
-title-case@^2.1.0, title-case@^2.1.1:
+title-case@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/title-case/-/title-case-2.1.1.tgz#3e127216da58d2bc5becf137ab91dae3a7cd8faa"
   integrity sha1-PhJyFtpY0rxb7PE3q5Ha46fNj6o=
@@ -27810,27 +27066,6 @@ ts-essentials@^2.0.3:
   resolved "https://registry.yarnpkg.com/ts-essentials/-/ts-essentials-2.0.12.tgz#c9303f3d74f75fa7528c3d49b80e089ab09d8745"
   integrity sha512-3IVX4nI6B5cc31/GFFE+i8ey/N2eA0CZDbo6n0yrz0zDX8ZJ8djmU1p+XRz7G3is0F3bB3pu2pAroFdAWQKU3w==
 
-ts-invariant@^0.2.1:
-  version "0.2.1"
-  resolved "https://registry.yarnpkg.com/ts-invariant/-/ts-invariant-0.2.1.tgz#3d587f9d6e3bded97bf9ec17951dd9814d5a9d3f"
-  integrity sha512-Z/JSxzVmhTo50I+LKagEISFJW3pvPCqsMWLamCTX8Kr3N5aMrnGOqcflbe5hLUzwjvgPfnLzQtHZv0yWQ+FIHg==
-  dependencies:
-    tslib "^1.9.3"
-
-ts-invariant@^0.3.2:
-  version "0.3.3"
-  resolved "https://registry.yarnpkg.com/ts-invariant/-/ts-invariant-0.3.3.tgz#b5742b1885ecf9e29c31a750307480f045ec0b16"
-  integrity sha512-UReOKsrJFGC9tUblgSRWo+BsVNbEd77Cl6WiV/XpMlkifXwNIJbknViCucHvVZkXSC/mcWeRnIGdY7uprcwvdQ==
-  dependencies:
-    tslib "^1.9.3"
-
-ts-invariant@^0.4.0:
-  version "0.4.2"
-  resolved "https://registry.yarnpkg.com/ts-invariant/-/ts-invariant-0.4.2.tgz#8685131b8083e67c66d602540e78763408be9113"
-  integrity sha512-PTAAn8lJPEdRBJJEs4ig6MVZWfO12yrFzV7YaPslmyhG7+4MA279y4BXT3f72gXeVl0mC1aAWq2rMX4eKTWU/Q==
-  dependencies:
-    tslib "^1.9.3"
-
 ts-loader@^7.0.5:
   version "7.0.5"
   resolved "https://registry.yarnpkg.com/ts-loader/-/ts-loader-7.0.5.tgz#789338fb01cb5dc0a33c54e50558b34a73c9c4c5"
@@ -27842,11 +27077,6 @@ ts-loader@^7.0.5:
     micromatch "^4.0.0"
     semver "^6.0.0"
 
-ts-log@2.1.4:
-  version "2.1.4"
-  resolved "https://registry.yarnpkg.com/ts-log/-/ts-log-2.1.4.tgz#063c5ad1cbab5d49d258d18015963489fb6fb59a"
-  integrity sha512-P1EJSoyV+N3bR/IWFeAqXzKPZwHpnLY6j7j58mAvewHRipo+BQM2Y1f9Y9BjEQznKwgqqZm7H8iuixmssU7tYQ==
-
 ts-morph@^9.1.0:
   version "9.1.0"
   resolved "https://registry.yarnpkg.com/ts-morph/-/ts-morph-9.1.0.tgz#10d2088387c71f3c674f82492a3cec1e3538f0dd"
@@ -28062,7 +27292,7 @@ typescript-tuple@^2.2.1:
   dependencies:
     typescript-compare "^0.0.2"
 
-typescript@4.1.3, typescript@^3.2.2, typescript@^3.3.3333, typescript@^3.5.3, typescript@~3.7.2, typescript@~4.1.2:
+typescript@4.1.3, typescript@^3.3.3333, typescript@^3.5.3, typescript@~3.7.2, typescript@~4.1.2:
   version "4.1.3"
   resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.1.3.tgz#519d582bd94cba0cf8934c7d8e8467e473f53bb7"
   integrity sha512-B3ZIOf1IKeH2ixgHhj6la6xdwR9QrLC5d1VKeCSY4tvkqhF2eqd9O7txNlS0PO3GrBAFIdr3L1ndNwteUbZLYg==
@@ -28596,14 +27826,7 @@ update-notifier@^4.1.1:
     semver-diff "^3.1.1"
     xdg-basedir "^4.0.0"
 
-upper-case-first@^1.1.0, upper-case-first@^1.1.2:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/upper-case-first/-/upper-case-first-1.1.2.tgz#5d79bedcff14419518fd2edb0a0507c9b6859115"
-  integrity sha1-XXm+3P8UQZUY/S7bCgUHybaFkRU=
-  dependencies:
-    upper-case "^1.1.1"
-
-upper-case@^1.0.3, upper-case@^1.1.0, upper-case@^1.1.1, upper-case@^1.1.3:
+upper-case@^1.0.3, upper-case@^1.1.1:
   version "1.1.3"
   resolved "https://registry.yarnpkg.com/upper-case/-/upper-case-1.1.3.tgz#f6b4501c2ec4cdd26ba78be7222961de77621598"
   integrity sha1-9rRQHC7EzdJrp4vnIilh3ndiFZg=
@@ -28827,7 +28050,7 @@ uuid@^2.0.1:
   resolved "https://registry.yarnpkg.com/uuid/-/uuid-2.0.3.tgz#67e2e863797215530dff318e5bf9dcebfd47b21a"
   integrity sha1-Z+LoY3lyFVMN/zGOW/nc6/1Hsho=
 
-uuid@^3.1.0, uuid@^3.3.2, uuid@^3.3.3, uuid@^3.4.0:
+uuid@^3.3.2, uuid@^3.3.3, uuid@^3.4.0:
   version "3.4.0"
   resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
   integrity sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==
@@ -28880,11 +28103,6 @@ val-loader@^1.1.1:
     loader-utils "^1.0.0"
     schema-utils "^0.4.5"
 
-valid-url@1.0.9:
-  version "1.0.9"
-  resolved "https://registry.yarnpkg.com/valid-url/-/valid-url-1.0.9.tgz#1c14479b40f1397a75782f115e4086447433a200"
-  integrity sha1-HBRHm0DxOXp1eC8RXkCGRHQzogA=
-
 validate-npm-package-license@^3.0.1:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/validate-npm-package-license/-/validate-npm-package-license-3.0.1.tgz#2804babe712ad3379459acfbe24746ab2c303fbc"
@@ -29739,11 +28957,6 @@ whatwg-encoding@^1.0.1, whatwg-encoding@^1.0.5:
   dependencies:
     iconv-lite "0.4.24"
 
-whatwg-fetch@2.0.4:
-  version "2.0.4"
-  resolved "https://registry.yarnpkg.com/whatwg-fetch/-/whatwg-fetch-2.0.4.tgz#dde6a5df315f9d39991aa17621853d720b85566f"
-  integrity sha512-dcQ1GWpOD/eEQ97k66aiEVpNnapVj90/+R+SXTPYGHpYBBypfKJEQjLrvMZ7YXbKm21gXd4NcuxUTjiv1YtLng==
-
 whatwg-fetch@>=0.10.0, whatwg-fetch@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/whatwg-fetch/-/whatwg-fetch-3.0.0.tgz#fc804e458cc460009b1a2b966bc8817d2578aefb"
@@ -29876,7 +29089,7 @@ windows-release@^3.1.0:
   dependencies:
     execa "^1.0.0"
 
-winston-transport@^4.3.0, winston-transport@^4.4.0:
+winston-transport@^4.4.0:
   version "4.4.0"
   resolved "https://registry.yarnpkg.com/winston-transport/-/winston-transport-4.4.0.tgz#17af518daa690d5b2ecccaa7acf7b20ca7925e59"
   integrity sha512-Lc7/p3GtqtqPBYYtS6KCN3c77/2QCev51DvcJKbkFPQNoj1sinkGwLGFDxkXY9J6p9+EPnYs+D90uwbnaiURTw==
@@ -29884,21 +29097,6 @@ winston-transport@^4.3.0, winston-transport@^4.4.0:
     readable-stream "^2.3.7"
     triple-beam "^1.2.0"
 
-winston@3.2.1:
-  version "3.2.1"
-  resolved "https://registry.yarnpkg.com/winston/-/winston-3.2.1.tgz#63061377976c73584028be2490a1846055f77f07"
-  integrity sha512-zU6vgnS9dAWCEKg/QYigd6cgMVVNwyTzKs81XZtTFuRwJOcDdBg7AU0mXVyNbs7O5RH2zdv+BdNZUlx7mXPuOw==
-  dependencies:
-    async "^2.6.1"
-    diagnostics "^1.1.1"
-    is-stream "^1.1.0"
-    logform "^2.1.1"
-    one-time "0.0.4"
-    readable-stream "^3.1.1"
-    stack-trace "0.0.x"
-    triple-beam "^1.3.0"
-    winston-transport "^4.3.0"
-
 winston@^3.0.0, winston@^3.3.3:
   version "3.3.3"
   resolved "https://registry.yarnpkg.com/winston/-/winston-3.3.3.tgz#ae6172042cafb29786afa3d09c8ff833ab7c9170"
@@ -30360,27 +29558,6 @@ z-schema@~3.18.3:
   optionalDependencies:
     commander "^2.7.1"
 
-zen-observable-ts@^0.8.10, zen-observable-ts@^0.8.18:
-  version "0.8.21"
-  resolved "https://registry.yarnpkg.com/zen-observable-ts/-/zen-observable-ts-0.8.21.tgz#85d0031fbbde1eba3cd07d3ba90da241215f421d"
-  integrity sha512-Yj3yXweRc8LdRMrCC8nIc4kkjWecPAUVh0TI0OUrWXx6aX790vLcDlWca6I4vsyCGH3LpWxq0dJRcMOFoVqmeg==
-  dependencies:
-    tslib "^1.9.3"
-    zen-observable "^0.8.0"
-
-zen-observable-ts@^0.8.20:
-  version "0.8.20"
-  resolved "https://registry.yarnpkg.com/zen-observable-ts/-/zen-observable-ts-0.8.20.tgz#44091e335d3fcbc97f6497e63e7f57d5b516b163"
-  integrity sha512-2rkjiPALhOtRaDX6pWyNqK1fnP5KkJJybYebopNSn6wDG1lxBoFs2+nwwXKoA6glHIrtwrfBBy6da0stkKtTAA==
-  dependencies:
-    tslib "^1.9.3"
-    zen-observable "^0.8.0"
-
-zen-observable@^0.8.0:
-  version "0.8.8"
-  resolved "https://registry.yarnpkg.com/zen-observable/-/zen-observable-0.8.8.tgz#1ea93995bf098754a58215a1e0a7309e5749ec42"
-  integrity sha512-HnhhyNnwTFzS48nihkCZIJGsWGFcYUz+XPDlPK5W84Ifji8SksC6m7sQWOf8zdCGhzQ4tDYuMYGu5B0N1dXTtg==
-
 zip-stream@^4.0.4:
   version "4.0.4"
   resolved "https://registry.yarnpkg.com/zip-stream/-/zip-stream-4.0.4.tgz#3a8f100b73afaa7d1ae9338d910b321dec77ff3a"