Merge branch 'master' into discover-context-app

.gitignore

@@ -26,7 +26,8 @@ target
 data
 disabledPlugins
 webpackstats.json
-config/kibana.dev.yml
+config/*
+!config/kibana.yml
 coverage
 selenium
 .babelcache.json

.npmrc

@@ -1,2 +1 @@
 save-exact=true
-global-style=true

Gruntfile.js

@@ -49,23 +49,7 @@ module.exports = function (grunt) {
       '!<%= src %>/core_plugins/timelion/vendor_components/**/*.js',
       '!<%= src %>/fixtures/**/*.js',
       '!<%= root %>/test/fixtures/scenarios/**/*.js'
-    ],
-    deepModules: {
-      'caniuse-db': '1.0.30000265',
-      'chalk': '1.1.0',
-      'glob': '4.5.3',
-      'har-validator': '1.8.0',
-      'json5': '0.4.0',
-      'loader-utils': '0.2.11',
-      'micromatch': '2.2.0',
-      'postcss-normalize-url': '2.1.1',
-      'postcss-reduce-idents': '1.0.2',
-      'postcss-unique-selectors': '1.0.0',
-      'postcss-minify-selectors': '1.4.6',
-      'postcss-single-charset': '0.3.0',
-      'regenerator': '0.8.36',
-      'readable-stream': '2.1.0'
-    }
+    ]
   };
 
   grunt.config.merge(config);

config/kibana.yml

@@ -20,13 +20,13 @@
 # The URL of the Elasticsearch instance to use for all your queries.
 #elasticsearch.url: "http://localhost:9200"
 
-# When this setting’s value is true Kibana uses the hostname specified in the server.host
+# When this setting's value is true Kibana uses the hostname specified in the server.host
 # setting. When the value of this setting is false, Kibana uses the hostname of the host
 # that connects to this Kibana instance.
 #elasticsearch.preserveHost: true
 
 # Kibana uses an index in Elasticsearch to store saved searches, visualizations and
-# dashboards. Kibana creates a new index if the index doesn’t already exist.
+# dashboards. Kibana creates a new index if the index doesn't already exist.
 #kibana.index: ".kibana"
 
 # The default application to load.
@@ -53,7 +53,7 @@
 # authority for your Elasticsearch instance.
 #elasticsearch.ssl.ca: /path/to/your/CA.pem
 
-# To disregard the validity of SSL certificates, change this setting’s value to false.
+# To disregard the validity of SSL certificates, change this setting's value to false.
 #elasticsearch.ssl.verify: true
 
 # Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of

docs/console.asciidoc

@@ -83,4 +83,4 @@ include::console/history.asciidoc[]
 
 include::console/settings.asciidoc[]
 
-include::console/disabling-console.asciidoc[]
+include::console/configuring-console.asciidoc[]

docs/console/configuring-console.asciidoc

@@ -0,0 +1,57 @@
+[[configuring-console]]
+== Configuring Console
+
+You can add the following options in the `config/kibana.yml` file:
+
+`console.enabled`:: *Default: true* Set to false to disable Console. Toggling this will cause the server to regenerate assets on the next startup, which may cause a delay before pages start being served.
+
+`console.proxyFilter`:: *Default: `.*`* A list of regular expressions that are used to validate any outgoing request from Console. If none
+ of these match, the request will be rejected. See <<securing-console>> for more details.
+
+`console.proxyConfig`:: A list of configuration options that are based on the proxy target. Use this to set custom timeouts or SSL settings for specific hosts. This is done by defining a set of `match` criteria using wildcards/globs which will be checked against each request. The configuration from all matching rules will then be merged together to configure the proxy used for that request.
++
+The valid match keys are `match.protocol`, `match.host`, `match.port`, and `match.path`. All of these keys default to `*`, which means they will match any value.
++
+Example:
++
+[source,yaml]
+--------
+console.proxyConfig:
+  - match:
+      host: "*.internal.org" # allow any host that ends in .internal.org
+      port: "{9200..9299}" # allow any port from 9200-9299
+
+    ssl:
+      ca: "/opt/certs/internal.ca"
+      # "key" and "cert" are also valid options here
+
+  - match:
+      protocol: "https"
+
+    ssl:
+      verify: false # allows any certificate to be used, even self-signed certs
+
+  # since this rule has no "match" section it matches everything
+  - timeout: 180000 # 3 minutes
+--------
+
+[[securing-console]]
+=== Securing Console
+
+Console is meant to be used as a local development tool. As such, it will send requests to any host & port combination,
+just as a local curl command would. To overcome the CORS limitations enforced by browsers, Console's Node.js backend
+serves as a proxy to send requests on behalf of the browser. However, if put on a server and exposed to the internet
+this can become a security risk. In those cases, we highly recommend you lock down the proxy by setting the
+`console.proxyFilter` setting. The setting accepts a list of regular expressions that are evaluated against each URL
+ the proxy is requested to retrieve. If none of the regular expressions match the proxy will reject the request.
+
+Here is an example configuration the only allows Console to connect to localhost:
+
+[source,yaml]
+--------
+console.proxyFilter:
+  - ^https?://(localhost|127\.0\.0\.1|\[::0\]).*
+--------
+
+You will need to restart Kibana for these changes to take effect.
+

docs/setup/production.asciidoc

@@ -79,24 +79,25 @@ ca: /path/to/your/ca/cacert.pem
 [[load-balancing]]
 === Load Balancing Across Multiple Elasticsearch Nodes
 If you have multiple nodes in your Elasticsearch cluster, the easiest way to distribute Kibana requests
-across the nodes is to run an Elasticsearch _client_ node on the same machine as Kibana.
-Elasticsearch client nodes are essentially smart load balancers that are part of the cluster. They
+across the nodes is to run an Elasticsearch _Coordinating only_ node on the same machine as Kibana.
+Elasticsearch Coordinating only nodes are essentially smart load balancers that are part of the cluster. They
 process incoming HTTP requests, redirect operations to the other nodes in the cluster as needed, and
 gather and return the results. For more information, see
 {es-ref}modules-node.html[Node] in the Elasticsearch reference.
 
 To use a local client node to load balance Kibana requests:
 
 . Install Elasticsearch on the same machine as Kibana.
-. Configure the node as a client node. In `elasticsearch.yml`, set both `node.data` and `node.master` to `false`:
+. Configure the node as a Coordinating only node. In `elasticsearch.yml`, set `node.data`, `node.master` and `node.ingest` to `false`:
 +
 --------
-# 3. You want this node to be neither master nor data node, but
+# 3. You want this node to be neither master nor data node nor ingest node, but
 #    to act as a "search load balancer" (fetching data from nodes,
 #    aggregating results, etc.)
 #
 node.master: false
 node.data: false
+node.ingest: false 
 --------
 . Configure the client node to join your Elasticsearch cluster. In `elasticsearch.yml`, set the `cluster.name` to the
 name of your cluster.

docs/setup/settings.asciidoc

@@ -65,3 +65,7 @@ The minimum value is 100.
 `status.allowAnonymous`:: *Default: false* If authentication is enabled, setting this to `true` allows
 unauthenticated users to access the Kibana server status API and status page.
 `console.enabled`:: *Default: true* Set to false to disable Console.  Toggling this will cause the server to regenerate assets on the next startup, which may cause a delay before pages start being served.
+`console.proxyFilter`:: *Default: `.*`* A list of regular expressions that are used to validate any outgoing request from Console. If none of these match, the request will be rejected.
+`console.proxyConfig`:: A list of configuration options that are based on the proxy target. Use this to set custom timeouts or SSL settings for specific hosts. This is done by defining a set of `match` criteria using wildcards/globs which will be checked against each request. The configuration from all matching rules will then be merged together to configure the proxy used for that request.
++
+The valid match keys are `match.protocol`, `match.host`, `match.port`, and `match.path`. All of these keys default to `*`, which means they will match any value. See <<configuring-console>> for an example.

docs/visualize.asciidoc

@@ -33,6 +33,7 @@ different series.
 instructions.
 <<metric-chart,Metric>>:: Display a single number.
 <<pie-chart,Pie chart>>:: Display each source's contribution to a total.
+<<tagcloud-chart,Tag cloud>>:: Display words as a cloud in which the size of the word correspond to its importance
 <<tilemap,Tile map>>:: Associate the results of an aggregation with geographic
 locations.
 Timeseries:: Compute and combine data from multiple time series

docs/visualize/tagcloud.asciidoc

@@ -1,5 +1,5 @@
 [[tagcloud-chart]]
-== Cloud Tag Charts
+== Tag Clouds
 
 A tag cloud visualization is a visual representation of text data, typically used to visualize free form text. 
 Tags are usually single words, and the importance of each tag is shown with font size or color.

package.json

@@ -205,7 +205,7 @@
     "karma-safari-launcher": "0.1.1",
     "license-checker": "5.1.2",
     "load-grunt-config": "0.19.2",
-    "makelogs": "3.0.2",
+    "makelogs": "3.1.1",
     "marked-text-renderer": "0.1.0",
     "mocha": "2.5.3",
     "murmurhash3js": "3.0.1",

src/cli_plugin/install/__tests__/rename.js

@@ -0,0 +1,72 @@
+import expect from 'expect.js';
+import sinon from 'sinon';
+import fs from 'fs';
+
+import { renamePlugin } from '../rename';
+
+describe('plugin folder rename', function () {
+  let renameStub;
+
+  beforeEach(function () {
+    renameStub = sinon.stub();
+  });
+
+  afterEach(function () {
+    fs.rename.restore();
+  });
+
+  it('should rethrow any exceptions', function () {
+    renameStub = sinon.stub(fs, 'rename', function (from, to, cb) {
+      cb({
+        code: 'error'
+      });
+    });
+
+    return renamePlugin('/foo/bar', '/bar/foo')
+    .catch(function (err) {
+      expect(err.code).to.be('error');
+      expect(renameStub.callCount).to.be(1);
+    });
+  });
+
+  it('should resolve if there are no errors', function () {
+    renameStub = sinon.stub(fs, 'rename', function (from, to, cb) {
+      cb();
+    });
+
+    return renamePlugin('/foo/bar', '/bar/foo')
+    .then(function (err) {
+      expect(renameStub.callCount).to.be(1);
+    })
+    .catch(function () {
+      throw new Error('We shouln\'t have any errors');
+    });
+  });
+
+  describe('Windows', function () {
+    let platform;
+    beforeEach(function () {
+      platform = Object.getOwnPropertyDescriptor(process, 'platform');
+      Object.defineProperty(process, 'platform', {
+        value: 'win32'
+      });
+    });
+    afterEach(function () {
+      Object.defineProperty(process, 'platform', platform);
+    });
+
+    it('should retry on Windows EPERM errors for up to 3 seconds', function () {
+      this.timeout(5000);
+      renameStub = sinon.stub(fs, 'rename', function (from, to, cb) {
+        cb({
+          code: 'EPERM'
+        });
+      });
+      return renamePlugin('/foo/bar', '/bar/foo')
+      .catch(function (err) {
+        expect(err.code).to.be('EPERM');
+        expect(renameStub.callCount).to.be.greaterThan(1);
+      });
+    });
+  });
+});

src/cli_plugin/install/install.js

@@ -2,8 +2,8 @@ import { download } from './download';
 import Promise from 'bluebird';
 import { cleanPrevious, cleanArtifacts } from './cleanup';
 import { extract, getPackData } from './pack';
+import { renamePlugin } from './rename';
 import { sync as rimrafSync } from 'rimraf';
-import { renameSync } from 'fs';
 import { existingInstall, rebuildCache, assertVersion } from './kibana';
 import mkdirp from 'mkdirp';
 
@@ -27,7 +27,7 @@ export default async function install(settings, logger) {
 
     assertVersion(settings);
 
-    renameSync(settings.workingPath, settings.plugins[0].path);
+    await renamePlugin(settings.workingPath, settings.plugins[0].path);
 
     await rebuildCache(settings, logger);
 

src/cli_plugin/install/rename.js

@@ -0,0 +1,21 @@
+import { rename } from 'fs';
+import { delay } from 'lodash';
+
+export function renamePlugin(workingPath, finalPath) {
+  return new Promise(function (resolve, reject) {
+    const start = Date.now();
+    const retryTime = 3000;
+    const retryDelay = 100;
+    rename(workingPath, finalPath, function retry(err) {
+      if (err) {
+        // In certain cases on Windows, such as running AV, plugin folders can be locked shortly after extracting
+        // Retry for up to retryTime seconds
+        const windowsEPERM = process.platform === 'win32' && err.code === 'EPERM';
+        const retryAvailable = Date.now() - start < retryTime;
+        if (windowsEPERM && retryAvailable) return delay(rename, retryDelay, workingPath, finalPath, retry);
+        reject(err);
+      }
+      resolve();
+    });
+  });
+}

src/core_plugins/elasticsearch/lib/__tests__/check_es_version.js

@@ -56,6 +56,12 @@ describe('plugins/elasticsearch', () => {
       client.nodes.info = sinon.stub().returns(Promise.resolve({ nodes: nodes }));
     }
 
+    function setNodeWithoutHTTP(version) {
+      const nodes = { 'node-without-http': { version, ip: 'ip' } };
+      const client = server.plugins.elasticsearch.client;
+      client.nodes.info = sinon.stub().returns(Promise.resolve({ nodes: nodes }));
+    }
+
     it('returns true with single a node that matches', async () => {
       setNodes('5.1.0');
       const result = await checkEsVersion(server, KIBANA_VERSION);
@@ -99,6 +105,24 @@ describe('plugins/elasticsearch', () => {
       expect(server.log.getCall(1).args[0]).to.contain('warning');
     });
 
+    it('warns if a node is off by a patch version and without http publish address', async () => {
+      setNodeWithoutHTTP('5.1.1');
+      await checkEsVersion(server, KIBANA_VERSION);
+      sinon.assert.callCount(server.log, 2);
+      expect(server.log.getCall(0).args[0]).to.contain('debug');
+      expect(server.log.getCall(1).args[0]).to.contain('warning');
+    });
+
+    it('errors if a node incompatible and without http publish address', async () => {
+      setNodeWithoutHTTP('6.1.1');
+      try {
+        await checkEsVersion(server, KIBANA_VERSION);
+      } catch (e) {
+        expect(e.message).to.contain('incompatible nodes');
+        expect(e).to.be.a(Error);
+      }
+    });
+
     it('only warns once per node list', async () => {
       setNodes('5.1.1');
 

src/core_plugins/elasticsearch/lib/__tests__/create_kibana_index.js

@@ -53,9 +53,7 @@ describe('plugins/elasticsearch', function () {
           expect(params.body.mappings.config.properties)
             .to.have.property('buildNum');
           expect(params.body.mappings.config.properties.buildNum)
-            .to.have.property('type', 'string');
-          expect(params.body.mappings.config.properties.buildNum)
-            .to.have.property('index', 'not_analyzed');
+            .to.have.property('type', 'keyword');
         });
       });