Merge branch 'master' into fix/formula-multiple-fields

.ci/Dockerfile

@@ -1,7 +1,7 @@
 # NOTE: This Dockerfile is ONLY used to run certain tasks in CI. It is not used to run Kibana or as a distributable.
 # If you're looking for the Kibana Docker image distributable, please see: src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.ts
 
-ARG NODE_VERSION=14.17.0
+ARG NODE_VERSION=14.17.3
 
 FROM node:${NODE_VERSION} AS base
 

.node-version

@@ -1 +1 @@
-14.17.2
+14.17.3

.nvmrc

@@ -1 +1 @@
-14.17.2
+14.17.3

WORKSPACE.bazel

@@ -27,13 +27,13 @@ check_rules_nodejs_version(minimum_version_string = "3.6.0")
 # we can update that rule.
 node_repositories(
   node_repositories = {
-    "14.17.2-darwin_amd64": ("node-v14.17.2-darwin-x64.tar.gz", "node-v14.17.2-darwin-x64", "e45db91fc2136202868a5eb7c6d08b0a2b75394fafdf8538f650fa945b7dee16"),
-    "14.17.2-linux_arm64": ("node-v14.17.2-linux-arm64.tar.xz", "node-v14.17.2-linux-arm64", "3aff08c49b8c0c3443e7a9ea9bfe607867d79e6e5ccf204a5c8f13fb92a48abd"),
-    "14.17.2-linux_s390x": ("node-v14.17.2-linux-s390x.tar.xz", "node-v14.17.2-linux-s390x", "76f955856626a3e596b438855fdfe438937623dc71af9a25a8466409be470877"),
-    "14.17.2-linux_amd64": ("node-v14.17.2-linux-x64.tar.xz", "node-v14.17.2-linux-x64", "6cf9db7349407c177b36205feec949729d0ee9db485e19b10b0b1ffca65a3a46"),
-    "14.17.2-windows_amd64": ("node-v14.17.2-win-x64.zip", "node-v14.17.2-win-x64", "0e27897578752865fa61546d75b20f7cd62957726caab3c03f82c57a4aef5636"),
+    "14.17.3-darwin_amd64": ("node-v14.17.3-darwin-x64.tar.gz", "node-v14.17.3-darwin-x64", "522f85db1d1fe798cba5f601d1bba7b5203ca8797b2bc934ff6f24263f0b7fb2"),
+    "14.17.3-linux_arm64": ("node-v14.17.3-linux-arm64.tar.xz", "node-v14.17.3-linux-arm64", "80f4143d3c2d4cf3c4420eea3202c7bf16788b0a72fd512e60bfc8066a08a51c"),
+    "14.17.3-linux_s390x": ("node-v14.17.3-linux-s390x.tar.xz", "node-v14.17.3-linux-s390x", "4f69c30732f94189b9ab98f3100b17f1e4db2000848d56064e887be1c28e81ae"),
+    "14.17.3-linux_amd64": ("node-v14.17.3-linux-x64.tar.xz", "node-v14.17.3-linux-x64", "d659d78144042a1801f35dd611d0fab137e841cde902b2c6a821163a5e36f105"),
+    "14.17.3-windows_amd64": ("node-v14.17.3-win-x64.zip", "node-v14.17.3-win-x64", "170fb4f95539d1d7e1295fb2556cb72bee352cdf81a02ffb16cf6d50ad2fefbf"),
   },
-  node_version = "14.17.2",
+  node_version = "14.17.3",
   node_urls = [
     "https://nodejs.org/dist/v{version}/{filename}",
   ],

api_docs/maps.json

@@ -3085,13 +3085,13 @@
       },
       {
         "parentPluginId": "maps",
-        "id": "def-common.KBN_TOO_MANY_FEATURES_PROPERTY",
+        "id": "def-common.KBN_METADATA_FEATURE",
         "type": "string",
         "tags": [],
-        "label": "KBN_TOO_MANY_FEATURES_PROPERTY",
+        "label": "KBN_METADATA_FEATURE",
         "description": [],
         "signature": [
-          "\"__kbn_too_many_features__\""
+          "\"__kbn_metadata_feature__\""
         ],
         "source": {
           "path": "x-pack/plugins/maps/common/constants.ts",
@@ -3582,4 +3582,4 @@
       }
     ]
   }
-}
+}

docs/canvas/canvas-function-reference.asciidoc

@@ -406,6 +406,60 @@ This prints the `datatable` objects in the browser console before and after the
 
 *Returns:* `any`
 
+[float]
+[[createTable_fn]]
+=== `createTable`
+
+Creates a datatable with a list of columns, and 1 or more empty rows.
+To populate the rows, use <<mapColumn_fn>> or <<mathColumn_fn>>.
+
+[cols="3*^<"]
+|===
+|Argument |Type |Description
+
+|ids *** †
+
+|`string`
+|Column ids to generate in positional order. ID represents the key in the row.
+
+|`names` †
+|`string`
+|Column names to generate in positional order. Names are not required to be unique, and default to the ID if not provided.
+
+|`rowCount`
+
+Default: 1
+|`number`
+|The number of empty rows to add to the table, to be assigned a value later.
+|===
+
+*Expression syntax*
+[source,js]
+----
+createTable id="a" id="b"
+createTable id="a" name="A" id="b" name="B" rowCount=5
+----
+
+*Code example*
+[source,text]
+----
+var_set
+  name="logs" value={essql "select count(*) as a from kibana_sample_data_logs"}
+  name="commerce" value={essql "select count(*) as b from kibana_sample_data_ecommerce"}
+| createTable ids="totalA" ids="totalB"
+| staticColumn name="totalA" value={var "logs" | getCell "a"}
+| alterColumn column="totalA" type="number"
+| staticColumn name="totalB" value={var "commerce" | getCell "b"}
+| alterColumn column="totalB" type="number"
+| mathColumn id="percent" name="percent" expression="totalA / totalB"
+| render
+----
+
+This creates a table based on the results of two `essql` queries, joined
+into one table.
+
+*Accepts:* `null`
+
 
 [float]
 [[columns_fn]]

docs/user/dashboard/lens-advanced.asciidoc

@@ -301,9 +301,6 @@ image::images/lens_advanced_5_2.png[Line chart with cumulative sum of orders mad
 *Lens* allows you to compare the currently selected time range with historical data using the *Time shift* option. To calculate the percent
 change, use *Formula*.
 
-Time shifts can be used on any metric. The special shift *previous* will show the time window preceding the currently selected one, spanning the same duration.
-For example, if *Last 7 days* is selected in the time filter, *previous* will show data from 14 days ago to 7 days ago.
-
 If multiple time shifts are used in a single chart, a multiple of the date histogram interval should be chosen - otherwise data points might not line up in the chart and empty spots can occur.
 For example, if a daily interval is used, shifting one series by *36h*, and another one by *1d*, is not recommended. In this scenario, either reduce the interval to *12h*, or create two separate charts.
 

docs/user/dashboard/tsvb.asciidoc

@@ -45,6 +45,7 @@ It is the default one for new visualizations but it can also be switched for the
 image::images/tsvb_index_pattern_selection_mode.png[Change index pattern selection mode action]
 
 The index pattern mode unlocks many new features, such as:
+
 * Runtime fields
 
 * URL drilldowns

examples/expressions_explorer/public/render_expressions.tsx

@@ -34,7 +34,9 @@ interface Props {
 }
 
 export function RenderExpressionsExample({ expressions, inspector }: Props) {
-  const [expression, updateExpression] = useState('markdown "## expressions explorer rendering"');
+  const [expression, updateExpression] = useState(
+    'markdownVis "## expressions explorer rendering"'
+  );
 
   const expressionChanged = (value: string) => {
     updateExpression(value);

examples/expressions_explorer/public/run_expressions.tsx

@@ -35,7 +35,7 @@ interface Props {
 }
 
 export function RunExpressionsExample({ expressions, inspector }: Props) {
-  const [expression, updateExpression] = useState('markdown "## expressions explorer"');
+  const [expression, updateExpression] = useState('markdownVis "## expressions explorer"');
   const [result, updateResult] = useState<unknown>({});
 
   const expressionChanged = (value: string) => {

package.json

@@ -93,7 +93,7 @@
     "**/underscore": "^1.13.1"
   },
   "engines": {
-    "node": "14.17.2",
+    "node": "14.17.3",
     "yarn": "^1.21.1"
   },
   "dependencies": {
@@ -351,7 +351,7 @@
     "react-moment-proptypes": "^1.7.0",
     "react-monaco-editor": "^0.41.2",
     "react-popper-tooltip": "^2.10.1",
-    "react-query": "^3.13.10",
+    "react-query": "^3.18.1",
     "react-redux": "^7.2.0",
     "react-resizable": "^1.7.5",
     "react-resize-detector": "^4.2.0",

packages/kbn-rule-data-utils/src/technical_field_names.ts

@@ -19,6 +19,7 @@ const RULE_NAME = 'rule.name' as const;
 const RULE_CATEGORY = 'rule.category' as const;
 const TAGS = 'tags' as const;
 const PRODUCER = `${ALERT_NAMESPACE}.producer` as const;
+const OWNER = `${ALERT_NAMESPACE}.owner` as const;
 const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
 const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
 const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
@@ -40,6 +41,7 @@ const fields = {
   RULE_CATEGORY,
   TAGS,
   PRODUCER,
+  OWNER,
   ALERT_ID,
   ALERT_UUID,
   ALERT_START,
@@ -62,6 +64,7 @@ export {
   RULE_CATEGORY,
   TAGS,
   PRODUCER,
+  OWNER,
   ALERT_ID,
   ALERT_UUID,
   ALERT_START,

x-pack/plugins/lists/server/services/utils/decode_version.ts → packages/kbn-securitysolution-es-utils/src/decode_version/index.ts

@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 // Similar to the src/core/server/saved_objects/version/decode_version.ts

x-pack/plugins/lists/server/services/utils/encode_hit_version.ts → packages/kbn-securitysolution-es-utils/src/encode_hit_version/index.ts

@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 /**

packages/kbn-securitysolution-es-utils/src/index.ts

@@ -8,10 +8,12 @@
 
 export * from './bad_request_error';
 export * from './create_boostrap_index';
+export * from './decode_version';
 export * from './delete_all_index';
 export * from './delete_policy';
 export * from './delete_template';
 export * from './elasticsearch_client';
+export * from './encode_hit_version';
 export * from './get_index_aliases';
 export * from './get_index_count';
 export * from './get_index_exists';

packages/kbn-utils/src/path/index.ts

@@ -18,6 +18,7 @@ const CONFIG_PATHS = [
   process.env.KIBANA_PATH_CONF && join(process.env.KIBANA_PATH_CONF, 'kibana.yml'),
   process.env.CONFIG_PATH, // deprecated
   join(REPO_ROOT, 'config/kibana.yml'),
+  '/etc/kibana/kibana.yml',
 ].filter(isString);
 
 const CONFIG_DIRECTORIES = [

src/core/public/chrome/ui/header/collapsible_nav.tsx

@@ -126,7 +126,7 @@ export function CollapsibleNav({
       onClose={closeNav}
       button={button}
       ownFocus={false}
-      size={240}
+      size={248}
     >
       {customNavLink && (
         <Fragment>

src/core/public/doc_links/doc_links_service.ts

@@ -244,14 +244,14 @@ export class DocLinksService {
           anomalyDetectionJobTips: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#job-tips`,
           anomalyDetectionModelMemoryLimits: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#model-memory-limits`,
           calendars: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-calendars.html`,
-          classificationEvaluation: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfanalytics-evaluate.html#ml-dfanalytics-classification`,
+          classificationEvaluation: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfa-classification.html#ml-dfanalytics-classification-evaluation`,
           customRules: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-rules.html`,
           customUrls: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-url.html`,
           dataFrameAnalytics: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfanalytics.html`,
           featureImportance: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-feature-importance.html`,
           outlierDetectionRoc: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfa-finding-outliers.html#ml-dfanalytics-roc`,
-          regressionEvaluation: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfanalytics-evaluate.html#ml-dfanalytics-regression-evaluation`,
-          classificationAucRoc: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfanalytics-evaluate.html#ml-dfanalytics-class-aucroc`,
+          regressionEvaluation: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfa-regression.html#ml-dfanalytics-regression-evaluation`,
+          classificationAucRoc: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfa-classification.html#ml-dfanalytics-class-aucroc`,
         },
         transforms: {
           guide: `${ELASTICSEARCH_DOCS}transforms.html`,

src/core/server/saved_objects/migrations/core/elastic_index.test.ts

@@ -412,38 +412,7 @@ describe('ElasticIndex', () => {
       expect(client.search).toHaveBeenCalledWith({
         body: {
           size: 100,
-          query: {
-            bool: {
-              must_not: [
-                {
-                  term: {
-                    type: 'fleet-agent-events',
-                  },
-                },
-                {
-                  term: {
-                    type: 'tsvb-validation-telemetry',
-                  },
-                },
-                {
-                  bool: {
-                    must: [
-                      {
-                        match: {
-                          type: 'search-session',
-                        },
-                      },
-                      {
-                        match: {
-                          'search-session.persisted': false,
-                        },
-                      },
-                    ],
-                  },
-                },
-              ],
-            },
-          },
+          query: Index.excludeUnusedTypesQuery,
         },
         index,
         scroll: '5m',